COcodeant
Audit Logs

List Audit Events

Changed on

Retrieves your organization's audit events oldest-first with cursor pagination. Designed for incremental ingestion: pass since (or the previous next_cursor) on each run to fetch only new events. Authenticate with a CodeAnt API token (requires the settings_organization: read permission when token scoping is configured). Every call to this endpoint is itself recorded in the audit log as audit_log.api_read.

post/api/audit/events

Request

  • Base URL
    https://api.codeant.ai
  • URL
    https://api.codeant.ai/api/audit/events
  • Auth
    HTTP bearer

Request body

platform'github' | 'gitlab' | 'bitbucket' | 'azure_devops' required

Git platform of the organization

orgstring required

Organization / workspace slug

github_base_urlstring

Self-hosted instance URL (also gitlab_base_url / bitbucket_base_url / azure_devops_base_url). Defaults to the cloud host.

start_datestring date

Inclusive UTC start date. Default: last 7 days; clamped to the 180-day retention window.

end_datestring date

Inclusive UTC end date. Default: today.

daysinteger

Alternative to explicit dates: lookback window in days (max 180).

sincestring date-time

Only events STRICTLY AFTER this ISO 8601 timestamp; also defaults the range to [since, today]. Use your last consumed event's timestamp for incremental pulls.

cursorstring

Opaque cursor from a previous response — resume paging after it.

limitinteger

Events per page.

format'json' | 'ndjson' | 'csv'

json returns the envelope below; ndjson/csv return the raw file body with paging in X-Next-Cursor / X-Has-More headers. CSV is RFC 4180 (fields with commas, quotes or line breaks are properly quoted).

Example request

{
  "github_base_url": "https://github.com"
}

Response

Audit events retrieved successfully. With format: ndjson or csv the body is the raw file instead, and paging moves to the X-Next-Cursor and X-Has-More response headers.

orgstring
servicestring
base_url_domainstring
start_datestring date
end_datestring date
retention_daysinteger
countinteger

Events in this page

has_moreboolean

True when more pages match — call again with next_cursor

next_cursorstring nullable

Opaque cursor for the next page; also a durable resume point

Example response

{
  "retention_days": 180,
  "events": [
    {
      "event_id": "a3f9c2e1b4d84f7a9c0e5d6b7a8f9012",
      "timestamp": "2026-07-30T09:14:03.512345Z",
      "action": "rbac.role_update",
      "description": "Access control: role update",
      "actor_id": "harshit-dubey",
      "actor_email": "admin@example.com",
      "org": "Example-Org",
      "base_url_domain": "github.com",
      "target_type": "rbac",
      "target_id": "role_7d2f",
      "target_name": "Security Reviewer",
      "status_code": 200,
      "method": "POST",
      "path": "/settings/rbac/roles/update",
      "ip": "203.0.113.42"
    }
  ]
}

Changes