---
title: "Get Audit Events"
method: POST
path: "/method-api-gateway/api/v1/audit/getAuditEvents"
tags: ["audit"]
---

# Get Audit Events

`POST /method-api-gateway/api/v1/audit/getAuditEvents`

## Request

- Base URL: `https://docs.method.security` (the document declares no server; this is the origin it was published from)
- URL: `https://docs.method.security/method-api-gateway/api/v1/audit/getAuditEvents`
- Auth: HTTP bearer

Retrieves all audit events in the specified time range

## Query parameters

- `pageSize` integer
- `token` string

## Request body

- V1AuditGetAuditEventsRequest
  - `startTime` string, date-time, required
  - `endTime` string, date-time, required

## Response `200`

Response with status 200

- V1AuditAuditEventsResponse
  - `auditEvents` V1AuditAuditEvent[], required
    - `id` string, required: The unique identifier for an audit event in Method
    - `tenantId` string, required: The unique identifier of the tenant for which the audit event was emitted
    - `timestamp` string, date-time, required
    - `actor` union, required
      - object
        - `type` 'user', required: Discriminator value: user
        - `id` string, required: The unique identifier of a human user in Method
        - `name` string, required
        - `email` string
        - `externalId` string: The identifier of a user in Method according to an external auth provider
      - object
        - `type` 'serviceAccount', required: Discriminator value: serviceAccount
        - `id` string, required: The unique identifier of a service account in Method
      - object
        - `type` 'oauthApplication', required: Discriminator value: oauthApplication
        - `id` string, required: The unique identifier of an OAuth application in Method
        - `clientId` string, required: The OAuth client identifier for an OAuth application
    - `action` union, required
      - object
        - `type` 'userLogin', required: Discriminator value: userLogin
      - object
        - `type` 'userLogout', required: Discriminator value: userLogout
      - object
        - `type` 'userAccountCreation', required: Discriminator value: userAccountCreation
      - object
        - `type` 'userAccountModification', required: Discriminator value: userAccountModification
      - object
        - `type` 'userAccountDeletion', required: Discriminator value: userAccountDeletion
      - object
        - `type` 'auditLogAccess', required: Discriminator value: auditLogAccess
        - `pageSize` integer
        - `since` string, date-time
        - `until` string, date-time
      - object
        - `type` 'groupMembershipAddition', required: Discriminator value: groupMembershipAddition
        - `userIds` V1AuditUserId[], required
      - object
        - `type` 'groupMembershipRemoval', required: Discriminator value: groupMembershipRemoval
        - `userIds` V1AuditUserId[], required
      - object
        - `type` 'scimIntegrationCreation', required: Discriminator value: scimIntegrationCreation
        - `name` string, required
        - `identityProviderType` string, required
      - object
        - `type` 'updateNoStrikeList', required: Discriminator value: updateNoStrikeList
        - `noStrikeListObjectSetId` string, required: The unique identifier for an object set in Method
      - object
        - `type` 'load', required: Discriminator value: load
      - object
        - `type` 'platformAction', required: Discriminator value: platformAction
        - `operation` 'APPROVE' | 'CREATE' | 'UPDATE' | 'DELETE' | 'LOAD' | 'LAUNCH' | 'QUERY' | 'DECRYPT', required
        - `resourceKind` 'AGENT' | 'AGENT_SESSION' | 'ENVIRONMENT' | 'GROUP' | 'ISSUE' | 'ISSUE_DEFINITION' | 'JACKAL' | 'MODEL' | 'MODEL_PROVIDER' | 'OAUTH_CLIENT' | 'OBJECT_SET' | 'ONTOLOGY_OBJECT' | 'OPERATOR_SESSION' | 'REPORT' | 'SCIM_INTEGRATION' | 'SENSITIVE_VALUE' | 'SKILL' | 'TARGET' | 'TARGET_PACKAGE' | 'TASK' | 'TASK_RUN' | 'TOKEN' | 'TOOL' | 'USER_ACCOUNT'
    - `resource` union
      - object
        - `type` 'userAccount', required: Discriminator value: userAccount
        - `user` V1AuditUser, required
          - `id` string, required: The unique identifier of a human user in Method
          - `name` string, required
          - `email` string
          - `externalId` string: The identifier of a user in Method according to an external auth provider
      - object
        - `type` 'group', required: Discriminator value: group
        - `id` string, required: The unique identifier of a user group in Method
        - `name` string, required
      - object
        - `type` 'issue', required: Discriminator value: issue
        - `id` string, required: The unique identifier for an issue in Method
      - object
        - `type` 'ontologyObject', required: Discriminator value: ontologyObject
        - `id` string, required: The unique identifier for an object in Method
      - object
        - `type` 'platformResource', required: Discriminator value: platformResource
        - `kind` 'AGENT' | 'AGENT_SESSION' | 'ENVIRONMENT' | 'GROUP' | 'ISSUE' | 'ISSUE_DEFINITION' | 'JACKAL' | 'MODEL' | 'MODEL_PROVIDER' | 'OAUTH_CLIENT' | 'OBJECT_SET' | 'ONTOLOGY_OBJECT' | 'OPERATOR_SESSION' | 'REPORT' | 'SCIM_INTEGRATION' | 'SENSITIVE_VALUE' | 'SKILL' | 'TARGET' | 'TARGET_PACKAGE' | 'TASK' | 'TASK_RUN' | 'TOKEN' | 'TOOL' | 'USER_ACCOUNT', required
        - `id` string, required: The unique identifier for a Method platform resource.
    - `context` V1AuditContext, required
      - `sourceIp` string: The source IP for a request made to the Method platform
      - `userAgent` string: The user agent for a request made to the Method platform.
    - `status` union, required
      - object
        - `type` 'success', required: Discriminator value: success
      - object
        - `type` 'failure', required: Discriminator value: failure
        - `message` string
  - `pagingToken` string

## Changes

- **2026-09-17** `3eef5dd697fe`: 4 breaking, 1 warning, 3 info
  - added the new required request property `endTime`
  - added the new required request property `startTime`
  - the request's body type changed from no type to `object`
  - the response's body type changed from no type to `object` for status `200`
  - …4 more
- **2026-09-12** `c83332415bf0`: 1 info
  - api operation id `getAuditEvents` removed and replaced with `audit_getAuditEvents`

[Operation history](https://skmtc.dev/method/apis/method/changes/method-api-gateway/api/v1/audit/getAuditEvents/post.md)

---

[API](https://skmtc.dev/method/apis/method.md) - [All operations](https://skmtc.dev/method/apis/method/llms.txt) - [OpenAPI document](https://skmtc.dev/method/apis/method/revisions/7dbb018a8caf?raw)