---
title: "Unified audit feed (JSON or CSV)"
method: GET
path: "/audit-events"
---

# Unified audit feed (JSON or CSV)

`GET /audit-events`

## Request

- Base URL: `https://getsanction.com/api/v1`
- URL: `https://getsanction.com/api/v1/audit-events`
- Auth: one of:
  - API key in header `x-api-key`
  - API key in header `x-mgmt-key`

Merged, time-sorted feed of spend decisions, token logs, and secret access. Cursor-paginate with `before`. `format=csv` returns the same page spreadsheet-ready (RFC 4180, formula-injection neutralized) as an attachment.

## Query parameters

- `wallet_id` string, required
- `type` 'authorization' | 'token' | 'injection'
- `limit` integer
- `before` string, date-time
- `format` 'csv'
- `scope` 'wallet' | 'subtree'

## Response `200`

Events page (application/json, or text/csv attachment with format=csv)

## Other responses

- `400`: wallet_id missing, or before is not a valid ISO timestamp
- `401`: Management key or wallet agent key required

---

[API](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api.md) · [All operations](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getsanction/apis/sanction-agent-governance-api/revisions/c645a9e4b72d?raw)