---
title: "List audit events"
method: GET
path: "/audit_events"
tags: ["Audit"]
---

# List audit events

`GET /audit_events`

## Request

- Base URL: `https://app.getorchestra.io/api/engine/public`
- URL: `https://app.getorchestra.io/api/engine/public/audit_events`
- Auth: one of:
  - HTTP bearer
  - OAuth 2
    - Authorization code: `https://app.getorchestra.io/oauth/authorize`
    - Token URL: `https://app.getorchestra.io/oauth/token` scopes: `orchestra:read`

List the audit trail for the workspace the credential resolves to, newest first: who did what, to which resource, and what changed.

`occurred_after` is required and sets how far back the trail is read; every other filter narrows within that window.

## Query parameters

- `occurred_after` string, required
- `occurred_before` string, nullable
- `page_size` integer
- `page` integer
- `actor_id` string, nullable
- `action` string
- `resource_type` string
- `resource_id` string, nullable

## Headers

- `X-Orchestra-Account-Id` string, uuid4, nullable

## Response `200`

Successful Response

- PaginatedResponseAuditEventResponse
  - `page` integer, required
  - `pageSize` integer, required
  - `total` integer, required
  - `results` AuditEventResponse[], required
    - `auditEventId` string, uuid, required
    - `occurredAt` string, required
    - `action` 'ACCOUNT_CREATED' | 'ACCOUNT_DELETED' | 'ACCOUNT_SETTINGS_UPDATED' | 'ACCOUNT_UPDATED' | 'AGENT_CREATED' | 'AGENT_DELETED' | 'AGENT_SESSION_DELETED' | 'AGENT_SESSION_UPDATED' | 'AGENT_UPDATED' | 'API_KEY_ROTATED' | 'ASSET_CREATED' | 'ASSET_DELETED' | 'ASSET_DEPENDENCIES_CREATED' | 'ASSET_UPDATED' | 'ENVIRONMENT_CREATED' | 'ENVIRONMENT_DELETED' | 'ENVIRONMENT_UPDATED' | 'GIT_CONNECTION_CREATED' | 'GIT_CONNECTION_DELETED' | 'GIT_CONNECTION_UPDATED' | 'GROUP_CREATED' | 'GROUP_DELETED' | 'GROUP_UPDATED' | 'INCIDENT_MERGED' | 'INCIDENT_STATUS_UPDATED' | 'INCIDENT_UNMERGED' | 'INCIDENT_UPDATED' | 'INTEGRATION_CONNECTION_CREATED' | 'INTEGRATION_CONNECTION_DELETED' | 'INTEGRATION_CONNECTION_UPDATED' | 'INTEGRATION_CONNECTION_VALIDATED' | 'INTEGRATION_STATE_UPDATED' | 'INVITE_SENT' | 'IP_RESTRICTIONS_UPDATED' | 'LOGIN_GOOGLE' | 'LOGIN_KEYCLOAK' | 'LOGIN_MICROSOFT' | 'LOGIN_OKTA' | 'LOGIN_PASSWORD' | 'MONITOR_CREATED' | 'MONITOR_DELETED' | 'MONITOR_UPDATED' | 'MONITORS_REORDERED' | 'ORGANISATION_SETTINGS_UPDATED' | 'PIPELINE_CREATED' | 'PIPELINE_DELETED' | 'PIPELINE_IMPORTED' | 'PIPELINE_PAUSED' | 'PIPELINE_RUN_CANCELLED' | 'PIPELINE_RUN_RESTARTED' | 'PIPELINE_STARTED' | 'PIPELINE_UPDATED' | 'PRODUCT_CREATED' | 'PRODUCT_DELETED' | 'PRODUCT_UPDATED' | 'SKILL_CREATED' | 'SKILL_DELETED' | 'SKILL_IMPORTED' | 'SKILL_UPDATED' | 'TASK_RUN_OUTPUT_SET' | 'USER_ADDED_TO_ACCOUNT' | 'USER_ADDED_TO_GROUP' | 'USER_CREATED' | 'USER_DEACTIVATED' | 'USER_MIGRATED' | 'USER_REACTIVATED' | 'USER_REMOVED_FROM_GROUP' | 'USER_UPDATED', required: Every action the audit trail records, flat rather than a resource type crossed with a verb. A composed pair admits nonsense like LOGIN on PIPELINE, and forces the UI to handle combinations that never occur; flat keeps the display-string table 1:1 with the members.
    - `resourceType` 'ACCOUNT' | 'AGENT' | 'AGENT_SESSION' | 'API_KEY' | 'ASSET' | 'ENVIRONMENT' | 'GIT_CONNECTION' | 'GROUP' | 'INCIDENT' | 'INTEGRATION_CONNECTION' | 'INTEGRATION_STATE' | 'INVITE' | 'IP_RESTRICTIONS' | 'MONITOR' | 'ORGANISATION' | 'PIPELINE' | 'PIPELINE_RUN' | 'PRODUCT' | 'SKILL' | 'TASK_RUN' | 'USER', required: What an audited action was performed on. Used for filtering and for the per-resource history tab, so it is a typed column rather than free text.
    - `resourceId` string, nullable
    - `resourceName` string, nullable
    - `actorType` 'API' | 'SYSTEM' | 'USER', required: Who performed an audited action. API is a key acting for a person, SYSTEM is Orchestra acting on the account's behalf.
    - `actorId` string, nullable
    - `actorEmail` string, nullable
    - `sourceService` string, required
    - `changes` object, nullable
    - `ipAddress` string, nullable
    - `userAgent` string, nullable

## Other responses

- `422`: Validation Error

## Changes

- **2026-11-03** `e45165e7e223`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/getorchestra/apis/orchestra-api/changes/audit_events/get.md)

---

[API](https://skmtc.dev/getorchestra/apis/orchestra-api.md) - [All operations](https://skmtc.dev/getorchestra/apis/orchestra-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getorchestra/apis/orchestra-api/revisions/daf2c16b3057?raw)