The audit trail as JSON lines (application/x-ndjson), oldest first, streamed.
Organization admins only (403 organization_admin_required). API keys, connected apps and service accounts with audit:read can read and export where the organization has machine identities (otherwise 403 session_required); retention and legal holds change only with a person. Events come from the organization's log and its workspaces' logs and never hold secrets, codes or anything that identifies a head. Being introduced: 404 not_found until it is on for your organization. One AuditEvent per line, newline-terminated. Events written after the export starts are left for the next one. Up to 1,000,000 events per request: to resume, pass cursor as the last line's <at>|<id>. Each export is itself recorded (audit.exported).
Request
- Base URL: https://api.50heads.com
- URL: https://api.50heads.com/v1/organizations/current/audit/export.jsonl
- Auth: one of:
- HTTP bearer
- OAuth 2 (authorization code, authorization URL https://auth.50heads.com/authorize, token URL https://auth.50heads.com/token; client credentials, token URL https://auth.50heads.com/token, scopes: audit:read)
Query parameters
<at>|<id> of the last event you have: the list's nextCursor, or the last line of an export to resume it.
Events at or after this time (ISO 8601, or a date).
Events before this time (ISO 8601); a bare date includes that whole day.
A user id, or system for 50heads itself.
An action (domain.added); a group for every action in it (organization, domain, member, sso, scim, question, billing, key, audit); or any action prefix (break_glass).
A workspace (team) id of this organization.
Response
JSON lines: one object per line, each newline-terminated. The schema is one line.
Changes
No recorded changes to this operation across all 1 revision of this API.