--- title: "List organization events" method: GET path: "/orgs/{org_slug}/events" tags: ["events"] --- # List organization events `GET /orgs/{org_slug}/events` ## Request - Base URL: `https://api.socket.dev/v0` - URL: `https://api.socket.dev/v0/orgs/{org_slug}/events` - Auth: one of: - HTTP bearer - HTTP basic List events for an organization. Events are records of actions taken across Socket products, such as firewall decisions and CLI/SDK actions. The maximum date range per request is 365 days. When more results are available, the response body's "endCursor" property contains the cursor to pass as the "startAfterCursor" query parameter to retrieve the next page. This endpoint consumes 10 units of your quota. This endpoint requires the following org token scopes: - telemetry-events:list ## Path parameters - `org_slug` string, required ## Query parameters - `per_page` integer - `date` string - `range` string - `startAfterCursor` string - `sort` string - `search` string - `filters.alertAction` string - `filters.alertAction.notIn` string - `filters.artifactName` string - `filters.artifactName.notIn` string - `filters.artifactNamespace` string - `filters.artifactNamespace.notIn` string - `filters.artifactPurl` string - `filters.artifactPurl.notIn` string - `filters.artifactType` string - `filters.artifactType.notIn` string - `filters.artifactVersion` string - `filters.artifactVersion.notIn` string - `filters.clientAction` string - `filters.clientAction.notIn` string - `filters.clientMachineId` string - `filters.clientMachineId.notIn` string - `filters.clientProductName` string - `filters.clientProductName.notIn` string - `filters.clientUserAgent` string - `filters.clientUserAgent.notIn` string - `filters.eventCategory` string - `filters.eventCategory.notIn` string - `filters.eventCreatedAt.eq` string - `filters.eventCreatedAt.lt` string - `filters.eventCreatedAt.lte` string - `filters.eventCreatedAt.gt` string - `filters.eventCreatedAt.gte` string - `filters.eventLevel` string - `filters.eventLevel.notIn` string - `filters.eventSource` string - `filters.eventSource.notIn` string - `filters.eventType` string - `filters.eventType.notIn` string - `filters.httpRequestRemoteIp` string - `filters.httpRequestRemoteIp.notIn` string - `filters.repoFullName` string - `filters.repoFullName.notIn` string - `filters.repoSlug` string - `filters.repoSlug.notIn` string ## Response `200` The paginated array of event items for the organization and related metadata. - object - `endCursor` string, nullable, required - `items` object[], required - `eventId` string, required - `eventSource` string, required - `eventLevel` string, required - `eventCategory` string, required - `eventType` string, required - `eventCreatedAt` string, required - `eventReceivedAt` string, nullable, required - `eventExtraData` object, nullable, required - `organizationId` string, required - `organizationSlug` string, required - `repoId` string, nullable, required - `repoSlug` string, nullable, required - `repoFullName` string, nullable, required - `branch` string, nullable, required - `clientProductName` string, nullable, required - `clientProductVersion` string, nullable, required - `clientAction` string, nullable, required - `alertAction` string, nullable, required - `clientMachineId` string, nullable, required - `clientUserAgent` string, nullable, required - `httpRequestRemoteIp` string, nullable, required - `artifactType` string, nullable, required - `artifactNamespace` string, nullable, required - `artifactName` string, nullable, required - `artifactVersion` string, nullable, required - `artifactPurl` string, nullable, required - `artifactInputPurl` string, nullable, required - `userId` string, nullable, required - `userEmail` string, nullable, required - `httpRequestPath` string, nullable, required - `httpRequestMethod` string, nullable, required - `httpResponseStatusCode` integer, nullable, required - `meta` object, required - `organizationId` string, required - `queryStartTimestamp` number, required - `startDateInclusive` string, required - `endDateInclusive` string, required - `filters` object, required - `alertAction` string[]: Comma-separated list of alert actions (one of "error", "warn", "monitor", "ignore"). Filters on the policy-decided alert_action column. - `alertAction.notIn` string[]: Comma-separated list of alert actions (one of "error", "warn", "monitor", "ignore"). Filters on the policy-decided alert_action column. - `artifactName` string[]: Name of artifact - `artifactName.notIn` string[]: Name of artifact - `artifactNamespace` string[]: Filter by artifact namespace - `artifactNamespace.notIn` string[]: Filter by artifact namespace - `artifactPurl` string[]: Filter by artifact purl (matches on purl without version) - `artifactPurl.notIn` string[]: Filter by artifact purl (matches on purl without version) - `artifactType` string[]: Comma-separated list of artifact types (e.g. "npm", "pypi", "gem", "maven", "golang", etc.) that should be included - `artifactType.notIn` string[]: Comma-separated list of artifact types (e.g. "npm", "pypi", "gem", "maven", "golang", etc.) that should be excluded - `artifactVersion` string[]: Filter by artifact version - `artifactVersion.notIn` string[]: Filter by artifact version - `clientAction` string[]: Comma-separated list of client actions (e.g., "install", "scan", "block") - `clientAction.notIn` string[]: Comma-separated list of client actions (e.g., "install", "scan", "block") - `clientMachineId` string[]: Comma-separated list of client machine IDs for exact matching - `clientMachineId.notIn` string[]: Comma-separated list of client machine IDs for exact matching - `clientProductName` string[]: Comma-separated list of client product names (e.g., "socket-cli", "socket-firewall") - `clientProductName.notIn` string[]: Comma-separated list of client product names (e.g., "socket-cli", "socket-firewall") - `clientUserAgent` string[]: Comma-separated list of HTTP request user-agent header values for exact matching - `clientUserAgent.notIn` string[]: Comma-separated list of HTTP request user-agent header values for exact matching - `eventCategory` string[]: Comma-separated list of event categories (e.g., "audit", "analytics", "debug") - `eventCategory.notIn` string[]: Comma-separated list of event categories (e.g., "audit", "analytics", "debug") - `eventCreatedAt.eq` string[]: Event created at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `eventCreatedAt.lt` string[]: Event created at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `eventCreatedAt.lte` string[]: Event created at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `eventCreatedAt.gt` string[]: Event created at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `eventCreatedAt.gte` string[]: Event created at (YYYY-MM-DD HH:MM:SS in UTC time zone) - `eventLevel` string[]: Comma-separated list of event levels ("trace", "debug", "info", "warn", "error", "fatal") - `eventLevel.notIn` string[]: Comma-separated list of event levels ("trace", "debug", "info", "warn", "error", "fatal") - `eventSource` string[]: Comma-separated list of event sources (e.g., "api-v0", "socket-cli", "socket-firewall") - `eventSource.notIn` string[]: Comma-separated list of event sources (e.g., "api-v0", "socket-cli", "socket-firewall") - `eventType` string[]: Comma-separated list of event types (e.g., "show_ide_text_decoration", "firewall_package_download") - `eventType.notIn` string[]: Comma-separated list of event types (e.g., "show_ide_text_decoration", "firewall_package_download") - `httpRequestRemoteIp` string[]: Comma-separated list of client IP addresses (HTTP request remote IPs) for exact matching - `httpRequestRemoteIp.notIn` string[]: Comma-separated list of client IP addresses (HTTP request remote IPs) for exact matching - `repoFullName` string[]: Comma-separated list of repo full names that should be included - `repoFullName.notIn` string[]: Comma-separated list of repo full names that should be excluded - `repoSlug` string[]: Comma-separated list of repo slugs that should be included - `repoSlug.notIn` string[]: Comma-separated list of repo slugs that should be excluded - `searchKeywords` string[], required: Search keywords - `sort` string[], required: Sort type (eventCreatedAt) ## Other responses - `400`: Bad request - `401`: Unauthorized - `403`: Insufficient max_quota for API method - `404`: Resource not found - `429`: Insufficient quota for API route ## Changes - **2026-11-03** `5ad8bf36b1e7`: 1 info - endpoint added [Operation history](https://skmtc.dev/socket-dev/apis/socket/changes/orgs/:org_slug/events/get.md) --- [API](https://skmtc.dev/socket-dev/apis/socket.md) - [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) - [OpenAPI document](https://skmtc.dev/socket-dev/apis/socket/revisions/5ad8bf36b1e7?raw)