---
title: "Read the credential audit trail"
method: GET
path: "/credential-events"
tags: ["Credentials"]
---

# Read the credential audit trail

`GET /credential-events`

## Request

- Base URL: `https://api.primitive.dev/v1`
- URL: `https://api.primitive.dev/v1/credential-events`
- Auth: HTTP bearer

Credential events (created, rotated, edited, revoked, used with a step-up, policy changes), newest first, with a cursor. format=csv returns the same page as CSV. Needs the organization's credential features to be enabled; while they are not, this answers 404 feature_disabled.

Person only: a dashboard session. The person's role must hold credential_events:read. API keys, agent connection keys and agents are refused.

## Query parameters

- `cursor` string
- `limit` integer
- `actor_id` string
- `credential_id` string
- `event_type` string
- `since` string, date-time
- `until` string, date-time
- `format` 'json' | 'csv'

## Response `200`

Success

- object
  - `success` true, required
  - `data` CredentialsListCredentialEventsResult, required
    - `items` object[], required
      - `id` string, required
      - `occurred_at` string, date-time, required
      - `event_type` string, required
      - `credential_kind` string, nullable, required
      - `credential_id` string, nullable, required
      - `credential_prefix` string, nullable, required
      - `actor_kind` string, nullable, required
      - `actor_id` string, nullable, required
      - `grant_ref` string, nullable, required
      - `catalog_version` string, nullable, required
      - `request_id` string, nullable, required
      - `details` object, required
    - `next_cursor` string, nullable, required

## Other responses

- `400`: Invalid request parameters
- `401`: Invalid or missing API key
- `403`: Authenticated caller lacks permission for the operation
- `404`: Resource not found
- `429`: Rate limit exceeded. The `ratelimit-*` headers describe the limiter that rejected this request, with its own limit and window, not the API budget that successful responses report. A limiter that reports only a wait sends `Retry-After` alone.

---

[API](https://skmtc.dev/primitive/apis/primitive-api.md) - [All operations](https://skmtc.dev/primitive/apis/primitive-api/llms.txt) - [OpenAPI document](https://skmtc.dev/primitive/apis/primitive-api/revisions/bce409c97acb?raw)