Every audit event of the organization and its workspaces, newest first, with filters.
Organization admins only (403 organization_admin_required). API keys, connected apps and service accounts with audit:read can read and export where the organization has machine identities (otherwise 403 session_required); retention and legal holds change only with a person. Events come from the organization's log and its workspaces' logs and never hold secrets, codes or anything that identifies a head. Being introduced: 404 not_found until it is on for your organization. Ordered by at, then id; page with nextCursor (no gaps or repeats when events are written between pages).
Request
- Base URL: https://api.50heads.com
- URL: https://api.50heads.com/v1/organizations/current/audit/events
- Auth: one of:
- HTTP bearer
- OAuth 2 (authorization code, authorization URL https://auth.50heads.com/authorize, token URL https://auth.50heads.com/token; client credentials, token URL https://auth.50heads.com/token, scopes: audit:read)
Query parameters
<at>|<id> of the last event you have: the list's nextCursor, or the last line of an export to resume it.
Events at or after this time (ISO 8601, or a date).
Events before this time (ISO 8601); a bare date includes that whole day.
A user id, or system for 50heads itself.
An action (domain.added); a group for every action in it (organization, domain, member, sso, scim, question, billing, key, audit); or any action prefix (break_glass).
A workspace (team) id of this organization.
Events list only: 1 to 200, default 50.
Response
OK
Changes
No recorded changes to this operation across all 2 revisions of this API.