---
title: "Every audit event of the organization and its workspaces, newest first, with filters."
method: GET
path: "/v1/organizations/current/audit/events"
tags: ["organizations"]
---

# Every audit event of the organization and its workspaces, newest first, with filters.

`GET /v1/organizations/current/audit/events`

## Request

- Base URL: `https://api.50heads.com`
- URL: `https://api.50heads.com/v1/organizations/current/audit/events`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://auth.50heads.com/authorize`, token URL `https://auth.50heads.com/token`; client credentials, token URL `https://auth.50heads.com/token`, scopes: `audit:read`)

Organization admins only (403 `organization_admin_required`). API keys, connected apps and service accounts with `audit:read` can read and export where the organization has machine identities (otherwise 403 `session_required`); retention and legal holds change only with a person. Events come from the organization's log and its workspaces' logs and never hold secrets, codes or anything that identifies a head. Being introduced: 404 `not_found` until it is on for your organization. Ordered by `at`, then `id`; page with `nextCursor` (no gaps or repeats when events are written between pages).

## Query parameters

- `cursor` string: `<at>|<id>` of the last event you have: the list's `nextCursor`, or the last line of an export to resume it.
- `from` string: Events at or after this time (ISO 8601, or a date).
- `to` string: Events before this time (ISO 8601); a bare date includes that whole day.
- `actor` string: A user id, or `system` for 50heads itself.
- `action` string: An action (`domain.added`); a group for every action in it (`organization`, `domain`, `member`, `sso`, `scim`, `question`, `billing`, `key`, `audit`); or any action prefix (`break_glass`).
- `workspace` string: A workspace (team) id of this organization.
- `limit` integer: Events list only: 1 to 200, default 50.

## Response `200`

OK

- OrganizationAuditEventsResponse
  - `events` OrganizationAuditExportJsonlLine[], required
    - `id` string, required
    - `at` string, required
    - `organizationId` string, required
    - `workspaceId` string, nullable, required
    - `source` 'organization' | 'workspace', required
    - `actor` object, required
      - `type` 'person' | 'system' | 'api_key' | 'oauth' | 'scim' | 'service_account', required
      - `id` string, nullable, required
      - `name` string, nullable, required
    - `action` 'organization.created' | 'organization.renamed' | 'domain.added' | 'domain.removed' | 'domain.verified' | 'domain.check_failed' | 'domain.warning' | 'domain.restored' | 'domain.failed' | 'policy.changed' | 'member.joined' | 'sso.configured' | 'sso.updated' | 'sso.test_started' | 'sso.tested' | 'sso.enabled' | 'sso.disabled' | 'sso.enforced' | 'sso.unenforced' | 'sso.enforcement_suspended' | 'sso.linked' | 'sso.unlinked' | 'break_glass.added' | 'break_glass.removed' | 'break_glass.used' | 'scim.token_created' | 'scim.token_rotated' | 'scim.token_revoked' | 'scim.settings_changed' | 'scim.mapping_created' | 'scim.mapping_changed' | 'scim.mapping_removed' | 'group.created' | 'group.renamed' | 'group.members_changed' | 'group.deleted' | 'member.provisioned' | 'member.linked' | 'member.updated' | 'member.role_changed' | 'member.removed' | 'member.deprovisioned' | 'member.reactivated' | 'member.deleted' | 'member.sessions_revoked' | 'member.credentials_revoked' | 'member.webhooks_stopped' | 'deprovision.failing' | 'workspace.owner_changed' | 'sso.sessions_ended' | 'service_account.created' | 'service_account.updated' | 'service_account.disabled' | 'service_account.enabled' | 'service_account.deleted' | 'service_account.secret_rotated' | 'service_account.secret_revoked' | 'service_account.keys_changed' | 'approval.requested' | 'approval.viewed' | 'approval.reauthenticated' | 'approval.decided' | 'approval.refused' | 'approval.expired' | 'approval.canceled' | 'approval.policy_changed' | 'workspace.created' | 'workspace.renamed' | 'workspace.cost_center_changed' | 'workspace.closed' | 'workspace.move_requested' | 'workspace.move_canceled' | 'workspace.move_declined' | 'workspace.moved_in' | 'workspace.moved_out' | 'organization.default_workspace_changed' | 'organization.closed' | 'invitation.resent' | 'invitation.revoked' | 'warehouse.destination_created' | 'warehouse.destination_updated' | 'warehouse.destination_deleted' | 'warehouse.export_failing' | 'warehouse.export_recovered' | 'question.asked' | 'question.canceled' | 'credits.purchased' | 'key.created' | 'key.revoked' | 'key.updated' | 'member.invited' | 'member.cap_changed' | 'connection.created' | 'connection.revoked' | 'connection.cap_changed' | 'team.created' | 'team.moved' | 'team.closed' | 'team.cost_center_changed' | 'project.cost_center_changed' | 'member.invite_resent' | 'member.invite_revoked' | 'member.invite_declined' | 'credits.refunded' | 'credits.adjusted' | 'credits.invoice_terms_changed' | 'audit.retention_changed' | 'audit.retention_applied' | 'audit.hold_created' | 'audit.hold_released' | 'audit.exported', required
    - `subject` string, required
    - `data` object, required
    - `ip` string, nullable, required
  - `nextCursor` string, nullable, required

## Other responses

- `400`: The request is not valid; `error.details.validation` lists the fixes.
- `401`: No key or token, or it expired or was revoked.
- `403`: The key or token lacks the scope (`insufficient_scope`), or the action is not allowed.
- `429`: Too many requests; wait for Retry-After.

---

[API](https://skmtc.dev/50heads/apis/50heads-api.md) · [All operations](https://skmtc.dev/50heads/apis/50heads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/50heads/apis/50heads-api/revisions/edbfecb1e360?raw)