---
title: "GET /v1/orgs/:slug/events — list audit events (Admin+). Pinned to the `audit` category server-side: lifecycle (system/internal) events are never returned here, whatever the query says."
method: GET
path: "/v1/orgs/{slug}/events"
tags: ["audit-log"]
---

# GET /v1/orgs/:slug/events — list audit events (Admin+). Pinned to the \`audit\` category server-side: lifecycle (system/internal) events are never returned here, whatever the query says.

`GET /v1/orgs/{slug}/events`

## Path parameters

- `slug` string, required

## Query parameters

- `event_type` string, nullable
- `since` string, date-time, nullable
- `until` string, date-time, nullable
- `cursor` string, nullable
- `limit` integer, nullable

## Response `200`

Paginated list of audit events

- PaginatedEventResponse — Wrapper for paginated event responses (needed for OpenAPI schema generation).
  - `data` EventResponse[], required
    - `actor` union, required — Maximum total length, in characters, of the truncated `command` field in Immutable actor snapshot stored alongside an event.
      - object
        - `kind` 'user', required
        - `label` string, required
        - `redacted_email` string, required
        - `user_id` string, uuid, required
      - object
        - `api_key_id` string, uuid, required
        - `kind` 'api_key', required
        - `name` string, required
      - object
        - `code` string, required
        - `kind` 'system', required
        - `label` string, required
      - object — The authorized SSH key that authenticated a front-door session. The principal SSH actually proves at connect is the *key*, not a person — the scope-only model (D8) doesn't bind a key to a user (a global key may be shared), so the session is attributed to the key (label + fingerprint), while whoever registered it rides the event payload as `added_by`.
        - `fingerprint` string, required — `SHA256:…` fingerprint.
        - `key_id` string, uuid, required
        - `kind` 'ssh_key', required
        - `label` string, nullable — Human label set at registration (e.g. `alice-laptop`), if any.
    - `category` string, required
    - `event_type` string, required
    - `id` string, uuid, required
    - `org_id` string, uuid, required
    - `payload` unknown, required
    - `timestamp` string, date-time, required
  - `has_more` boolean, required
  - `next_cursor` string, nullable

## Other responses

- `401` — Unauthorized
- `403` — Insufficient permissions

---

[API](https://skmtc.dev/microsandbox/apis/microsandbox-api.md) · [All operations](https://skmtc.dev/microsandbox/apis/microsandbox-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/microsandbox/microsandbox-api/revisions/23f2a45cb09b/schema)