GEgetorchestra
Audit

List audit events

Changed on

List the audit trail for the workspace the credential resolves to, newest first: who did what, to which resource, and what changed.

occurred_after is required and sets how far back the trail is read; every other filter narrows within that window.

get/audit_events

Request

  • Base URL
    https://app.getorchestra.io/api/engine/public
  • URL
    https://app.getorchestra.io/api/engine/public/audit_events
  • Auth
    • HTTP bearer
    • or OAuth 2
      Authorization code: https://app.getorchestra.io/oauth/authorize
      Token URL: https://app.getorchestra.io/oauth/token scopes: orchestra:read

Query parameters

occurred_afterstring required

Only events at or after this time, as an ISO 8601 timestamp (e.g. 2026-09-01T00:00:00Z). Required.

occurred_beforestring nullable

Only events at or before this time, as an ISO 8601 timestamp.

page_sizeinteger

Number of items per page. Defaults to 25; maximum 100.

pageinteger

Page number. Must be greater than or equal to 1.

actor_idstring nullable

Only events performed by this actor, matched on the recorded actor id.

actionstring

Filter by action. Comma-separated values are supported. One of: ACCOUNT_CREATED, ACCOUNT_DELETED, ACCOUNT_SETTINGS_UPDATED, ACCOUNT_UPDATED, AGENT_CREATED, AGENT_DELETED, AGENT_SESSION_DELETED, AGENT_SESSION_UPDATED, AGENT_UPDATED, API_KEY_ROTATED, ASSET_CREATED, ASSET_DELETED, ASSET_DEPENDENCIES_CREATED, ASSET_UPDATED, ENVIRONMENT_CREATED, ENVIRONMENT_DELETED, ENVIRONMENT_UPDATED, GIT_CONNECTION_CREATED, GIT_CONNECTION_DELETED, GIT_CONNECTION_UPDATED, GROUP_CREATED, GROUP_DELETED, GROUP_UPDATED, INCIDENT_MERGED, INCIDENT_STATUS_UPDATED, INCIDENT_UNMERGED, INCIDENT_UPDATED, INTEGRATION_CONNECTION_CREATED, INTEGRATION_CONNECTION_DELETED, INTEGRATION_CONNECTION_UPDATED, INTEGRATION_CONNECTION_VALIDATED, INTEGRATION_STATE_UPDATED, INVITE_SENT, IP_RESTRICTIONS_UPDATED, LOGIN_GOOGLE, LOGIN_KEYCLOAK, LOGIN_MICROSOFT, LOGIN_OKTA, LOGIN_PASSWORD, MONITOR_CREATED, MONITOR_DELETED, MONITOR_UPDATED, MONITORS_REORDERED, ORGANISATION_SETTINGS_UPDATED, PIPELINE_CREATED, PIPELINE_DELETED, PIPELINE_IMPORTED, PIPELINE_PAUSED, PIPELINE_RUN_CANCELLED, PIPELINE_RUN_RESTARTED, PIPELINE_STARTED, PIPELINE_UPDATED, PRODUCT_CREATED, PRODUCT_DELETED, PRODUCT_UPDATED, SKILL_CREATED, SKILL_DELETED, SKILL_IMPORTED, SKILL_UPDATED, TASK_RUN_OUTPUT_SET, USER_ADDED_TO_ACCOUNT, USER_ADDED_TO_GROUP, USER_CREATED, USER_DEACTIVATED, USER_MIGRATED, USER_REACTIVATED, USER_REMOVED_FROM_GROUP, USER_UPDATED.

resource_typestring

Filter by the type of resource acted on. Comma-separated values are supported. One of: ACCOUNT, AGENT, AGENT_SESSION, API_KEY, ASSET, ENVIRONMENT, GIT_CONNECTION, GROUP, INCIDENT, INTEGRATION_CONNECTION, INTEGRATION_STATE, INVITE, IP_RESTRICTIONS, MONITOR, ORGANISATION, PIPELINE, PIPELINE_RUN, PRODUCT, SKILL, TASK_RUN, USER.

resource_idstring nullable

Only events on this resource, by its id or YAML name.

Headers

X-Orchestra-Account-Idstring uuid4 nullable

Act on this account rather than the one the credential resolves to. Omit it to use the credential's own account. An API key is issued to a single account, so it may only name that account; an OAuth token may name any account its grant covers.

Response

Successful Response

pageinteger required
pageSizeinteger required
totalinteger required

Changes