List Data Audit Events

ID for the audit event. Use this to uniquely identify a specific audit record.

ID for the request that caused the event. Use to correlate multiple audit events triggered by a single API request.

ID for the session in which the request was sent. Present when a session context is available.

Member who sent the request. Depending on actorType, this may be a user ID or a service account ID. For users this is their email address.

Type of member who sent the request.

Type of access for the request.

IP Address of the client that made the request.

HTTP Origin request header (including scheme, hostname, and port) of the request. Present only for browser-originated requests. Absent for server-to-server API calls.

Authentication mode the actor used. OKTA_JWT: Federated identity via Okta SSO. SERVICE_ACCOUNT_JWT: Service account JWT (machine-to-machine). PAT_JWT: Personal Access Token issued as a JWT. API_KEY: Static API key.

ID of the JWT token (the jti claim). Identifies the specific token used for this request.

User context embedded in the bearer token. Present when a bearer token encodes additional user context.

Correlation ID supplied by the caller, so you can find audit events by the request ID your own systems already use. Opaque to Skyflow: recorded as sent and never interpreted. Distinct from traceID, which is Skyflow's own internal trace. Capped at 128 characters.

Resources with the specified parent account ID.

Resources with the specified workspace ID.

Resources with the specified vault ID.

Resources with a specified ID. If a resource matches at least one ID, the associated event is returned. Format is a comma-separated list of "<resourceType>/<resourceID>". For example, "VAULT/12345, USER/67890".

Email of the end user on whose behalf the caller made the request, from the ctx.email claim of the bearer token.