---
title: "List Security Events"
method: GET
path: "/logs/v1/security-events"
tags: ["Security Events"]
---

# List Security Events

`GET /logs/v1/security-events`

Returns a paginated list of security events in OCSF format for the authenticated organization. Requires Command Center access.

## Query parameters

- `limit` integer
- `cursor` string
- `since` string
- `class_uid` integer
- `severity_id` integer

## Response `200`

successful

- SecurityEventsResponse
  - `data` SecurityEventObject[]
    - `class_uid` integer — OCSF event class identifier
    - `class_name` string — OCSF event class name
    - `activity_id` integer — OCSF activity identifier
    - `activity_name` string — OCSF activity name
    - `category_uid` integer — OCSF category identifier
    - `category_name` string — OCSF category name
    - `severity_id` integer — OCSF severity identifier
    - `severity` string — OCSF severity label
    - `type_uid` integer — OCSF event type identifier
    - `time` integer — Event timestamp as Unix epoch
    - `metadata` object
      - `version` string — OCSF schema version
      - `product` object
        - `vendor_name` string
        - `name` string
  - `meta` object
    - `next_cursor` string, nullable — Cursor for fetching the next page of results
    - `has_more` boolean — Whether more results are available
    - `count` integer — Number of events in this response

## Other responses

- `400` — bad request - invalid cursor
- `403` — forbidden - no Command Center Standard

---

[API](https://skmtc.dev/proof/apis/proof-business-api-specification.md) · [All operations](https://skmtc.dev/proof/apis/proof-business-api-specification/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/proof/proof-business-api-specification/revisions/1adaa0ea25cd/schema)