---
title: "List audit events"
method: GET
path: "/orgs/{orgName}/events"
tags: ["Events"]
---

# List audit events

`GET /orgs/{orgName}/events`

## Request

- Base URL: `https://api.signadot.com/api/v2`
- URL: `https://api.signadot.com/api/v2/orgs/{orgName}/events`
- Auth: API key in header `signadot-api-key`

List audit events for the org, newest first. Each event carries the authentication method (auth) and, when resolvable, the principal who acted. Time window defaults to the last 24h; event types default to all.

## Path parameters

- `orgName` string, required

## Query parameters

- `startTime` string
- `endTime` string
- `type` string[]
- `filters` string
- `limit` integer
- `cursor` string
- `principalKind` string
- `principalId` string
- `authMethod` string

## Response `200`

OK

- ListEventsResponse
  - `events` EventQueryResult[]
    - `auth` EventAuthContext
      - `apiKeyMasked` string: present when method == "api_key"
      - `method` string: "jwt" | "api_key" | "system"
    - `cursor` string
    - `data` unknown
    - `id` string
    - `onBehalfOf` EventPrincipal
      - `kind` string: "User" | "ServiceAccount"
      - `name` string: user email or SA name (display)
      - `publicId` string
    - `principal` EventPrincipal
      - `kind` string: "User" | "ServiceAccount"
      - `name` string: user email or SA name (display)
      - `publicId` string
    - `timestamp` string
    - `type` string

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `404`: Not Found

## Changes

- **2026-07-21** `ec90662095fb`: 1 info
  - added the new optional `query` request parameter `cursor`
- **2026-06-16** `40d6198d7957`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/signadot/apis/signadot-api/changes/orgs/:orgName/events/get.md)

---

[API](https://skmtc.dev/signadot/apis/signadot-api.md) - [All operations](https://skmtc.dev/signadot/apis/signadot-api/llms.txt) - [OpenAPI document](https://skmtc.dev/signadot/apis/signadot-api/revisions/5e80b0f9c718?raw)