Pull Audit Logs

Pull your organization's audit events for ingestion into a SIEM or archive. Events are returned oldest-first as newline-delimited JSON (application/x-ndjson) by default, or as CSV with the same columns as the Settings → Organization → Audit Logs download.

Results are always scoped to the organization the credential belongs to. Pagination is cursor-based: when more events match, the response carries an X-Next-Cursor header — pass it as cursor on the next request and keep the same since/until window.

Reading the trail is itself an audited event: every pull records an audit.pulled event for the calling organization before the body is served, deduplicated to one event per credential per UTC day. If that event cannot be recorded the request fails with 500 and returns no events — retry the same request.