---
title: "GET /api/support/organizations/{org_pk}/security-events/"
method: GET
path: "/api/support/organizations/{org_pk}/security-events/"
tags: ["support"]
---

# GET /api/support/organizations/{org_pk}/security-events/

`GET /api/support/organizations/{org_pk}/security-events/`

## Request

- Base URL: `https://app.pixiebrix.com`
- URL: `https://app.pixiebrix.com/api/support/organizations/{org_pk}/security-events/`
- Auth: none declared

Return an organization's security events (newest first) with the same category/severity/action/destination rollups as the Admin Console report, scoped to `<org_pk>` in the path. Supports the `category`/`rule_type`/`severity`/`action`/`destination`/`precision`/`user`/`groups`/`start`/`end`/`limit` facets. Gated on the Support auth group, not the customer's org role; not gated on the activity-tracking flag (data captured while it was on stays readable after it is turned off).

## Path parameters

- `org_pk` string, required

## Query parameters

- `user` string, uuid
- `groups` string[]
- `start` string, date-time
- `end` string, date-time
- `limit` integer
- `rule_type` string
- `category` string
- `severity` 'info' | 'low' | 'medium' | 'high' | 'critical'
- `action` string
- `destination` string
- `precision` string

## Response `200`

- SecurityEventsResponse
  - `organization` string, uuid, required
  - `start` string, date-time, required
  - `end` string, date-time, required
  - `events` object[], required
    - `rule_type` string, nullable, required
    - `id` string, uuid, required
    - `occurred_at` string, date-time, required
    - `user` string, uuid, required
    - `email` string, nullable, required
    - `policy_id` string, uuid, nullable, required
    - `policy_version` integer, nullable, required
    - `category` string, nullable, required
    - `severity` string, nullable, required
    - `message` string, nullable, required
    - `action` string, nullable, required
    - `outcome` string, nullable, required
    - `intervention_response` string, nullable, required
    - `no_response` boolean, nullable, required
    - `justification` string, nullable, required
    - `reason_code` string, nullable, required
    - `destination` string, nullable, required
    - `files` object[], nullable, required
      - `name` string, nullable, required
      - `size` integer, nullable, required
      - `type` string, nullable, required
    - `categories` string[], nullable, required
    - `terms` string[], nullable, required
    - `kind` string, nullable, required
    - `identifier` string, nullable, required
    - `entry_type` string, nullable, required
    - `match_level` string, nullable, required
    - `record_id` string, nullable, required
    - `precision` string, nullable, required
    - `vector` string, nullable, required
    - `url` string, required
    - `domain` string, required
    - `trace_id` string, uuid, required
    - `span_id` string, uuid, nullable, required
    - `task_name` string, nullable, required
    - `alert_status` string, nullable, required
    - `alert_recipients` string[], required
  - `events_truncated` boolean, required
  - `by_category` object[], required
    - `category` string, nullable, required
    - `count` integer, required
  - `by_severity` object[], required
    - `severity` string, nullable, required
    - `count` integer, required
  - `by_action` object[], required
    - `action` string, nullable, required
    - `count` integer, required
  - `by_destination` object[], required
    - `destination` string, required
    - `count` integer, required

## Changes

- **2026-10-07** `bde42d847d17`: 3 info
  - added the new optional `query` request parameter `rule_type`
  - added the required property `events/items/rule_type` to the response with the `200` status (media type: application/json; version=2.0)
  - added the required property `events/items/rule_type` to the response with the `200` status (media type: application/vnd.pixiebrix.api+json; version=2.0)
- **2026-09-30** `bcc966c3991c`: 2 info
  - added the required property `events/items/vector` to the response with the `200` status (media type: application/json; version=2.0)
  - added the required property `events/items/vector` to the response with the `200` status (media type: application/vnd.pixiebrix.api+json; version=2.0)
- **2026-09-24** `709cc2f61a8a`: 1 info
  - added the new enum value `info` to the `query` request parameter `severity`
- **2026-09-24** `c932af1dd0fb`: 2 info
  - added the required property `events/items/no_response` to the response with the `200` status (media type: application/json; version=2.0)
  - added the required property `events/items/no_response` to the response with the `200` status (media type: application/vnd.pixiebrix.api+json; version=2.0)
- …earlier changes not shown

[Operation history](https://skmtc.dev/pixiebrix/apis/pixiebrix-api/changes/api/support/organizations/:org_pk/security-events/get.md)

---

[API](https://skmtc.dev/pixiebrix/apis/pixiebrix-api.md) - [All operations](https://skmtc.dev/pixiebrix/apis/pixiebrix-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pixiebrix/apis/pixiebrix-api/revisions/b5614ae64ccc?raw)