Sign in

List audit events

get/v1/audit

Query parameters

actionstring

Return only events with this exact action, or events whose action starts with it followed by a dot (workspace returns workspace.member_added but not workspace_automation.created). Lowercase, as actions are.

Example:workspace
string date
OR
string date-time
string date
OR
string date-time
cursorstring

The cursor to continue from

Example:eyJjcmVkZW50aWFsfQ==
page_sizeinteger

Maximum number of audit events to return per page

Example:10

Response

List of audit events

hasMoreboolean required

Whether there are more audit events to fetch. A page can hold fewer than page_size events and still not be the last one, so page on this and cursor rather than on the number of events returned.

cursorstring nullable required

The cursor to continue from

Example response

{
  "events": [
    {
      "id": "aud_7Kq2mXbT9vRp3L",
      "action": "workspace.member_added",
      "occurred_at": "2026-01-27T15:30:00.482Z",
      "collected_at": "2026-01-27T15:30:04.109733Z",
      "actor": {
        "object": "api_key",
        "id_suffix": "aB3dE7hK"
      },
      "data": {
        "role": "member"
      },
      "context": {
        "ip_address": "203.0.113.42",
        "user_agent": "Granola/7.400.0 (macOS 15.3)",
        "client_version": "7.400.0"
      }
    }
  ],
  "hasMore": true,
  "cursor": "eyJjcmVkZW50aWFsfQ=="
}

Changes

Changed in 4 of the 8 revisions of this API.212

  • d7f5ed61082011See the full diff
    • ▲

      added subschema #4: Anonymous to the events/items/actor response property oneOf list for the response status 200

      response-property-one-of-added

    • ○

      added the required property events/items/collected_at to the response with the 200 status

      response-required-property-added

  • 8fe0776c0d451See the full diff
    • ▲

      added subschema #1: API key to the events/items/actor response property oneOf list for the response status 200

      response-property-one-of-added

  • b531ab97083c1See the full diff
    • ●

      changed the pattern of the query request parameter action from ^[a-z][a-z0-9_.]*$ to ^[a-z][a-z0-9_.-]*$

      request-parameter-pattern-changed

  • 77eee61915021See the full diff
    • ○

      endpoint added

      endpoint-added