List audit events

GET

/audit-events

List audit events for the organization.

Authorization

ApiKeyAuth

headerAuthorizationBearer <token>

Bearer token authentication. Send an API key (a saai_api_-prefixed token) as Authorization: Bearer <token>.

Required permission

view_audit

Query Parameters

action?array<>

action_not?array<>

mcp_id?array<>

mcp_id_not?array<>

agent_instance_id?array<>

agent_instance_id_not?array<>

agent_slug?array<string>

agent_slug_not?array<string>

user_id?array<>

user_id_not?array<>

scope?string

own returns only the caller's own records, even when they may see the whole organization. all, the default, returns everything the caller may see. It never widens what the caller may see.

Value in"all""own"

user_group?array<string>

user_group_not?array<string>

agent_tag_id?array<>

resource_tag_id?array<>

connection_id?string

Formatuuid

policy_id?string

Formatuuid

autonomous?boolean

Only events by autonomous agents when true, only by user-bound agents when false. Events with no recorded mode never match.

start_time?string

Inclusive lower bound; events with a timestamp >= start_time. Defaults to 30 days ago when omitted.

Formatdate-time

end_time?string

Exclusive upper bound; events with a timestamp < end_time. Defaults to now when omitted.

Formatdate-time

cursor?string

Formatuuid

limit?integer

Formatint32

Range1 <= value <= 100

Default20

Response Body

The request has succeeded.

application/json

response

items*array<>

next_cursor?uuid

Formatuuid

Example Request

curl -X GET 'https://your-org.aisecurity.services.us.connect.secureauth.com/api/v1/audit-events'

Example Request

curl -X GET 'https://your-org.aisecurity.services.us.connect.secureauth.com/api/v1/audit-events'

Example ResponseSchema

{
  "items": [
    {
      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
      "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b",
      "action": "mcp.created",
      "actor_type": "user",
      "actor_id": "04f37679-bfbf-4906-b749-01756515cecf",
      "actor_display_name": "string",
      "resource_type": "mcp",
      "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",
      "resource_display_name": "string",
      "resources": {
        "mcp_id": "92dad337-069f-4a18-a93d-2e7f16082ffb",
        "mcp_display_name": "string",
        "agent_instance_id": "e6b55a46-e2a1-4495-b96e-367af02e9908",
        "agent_instance_display_name": "string",
        "agent_slug": "string",
        "autonomous": true,
        "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5",
        "user_display_name": "string",
        "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9",
        "policy_id": "ee9b03e0-6495-427a-85a5-34444d24ae04",
        "policy_display_name": "string",
        "dlp_rule_id": "e090a7ce-e55c-4dad-9728-ac5d9a88f84d",
        "dlp_rule_display_name": "string",
        "rate_limit_rule_id": "bf0cd7b5-1b50-4cec-8854-fe1ecbf87d0d",
        "rate_limit_rule_display_name": "string",
        "tag_id": "39c8a0b3-fbe8-4801-95bf-e8a0792edf1d",
        "tag_display_name": "string",
        "tool_key": "string"
      },
      "context": {
        "device": "string",
        "os": "string",
        "browser": "string",
        "ip": "string",
        "city": "string",
        "country": "string",
        "user_agent": "string",
        "trace_id": "string"
      },
      "changes": [
        {
          "type": "create",
          "path": "string",
          "from": null,
          "to": null
        }
      ],
      "payload": {
        "display_name": "string",
        "slug": "string",
        "origin": "catalog"
      },
      "created_at": "2019-08-24T14:15:22Z"
    }
  ],
  "next_cursor": "a7ec8888-a9c3-4732-a281-9a08510f220b"
}

{  "items": [    {      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",      "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b",      "action": "mcp.created",      "actor_type": "user",      "actor_id": "04f37679-bfbf-4906-b749-01756515cecf",      "actor_display_name": "string",      "resource_type": "mcp",      "resource_id": "4d5215ed-38bb-48ed-879a-fdb9ca58522f",      "resource_display_name": "string",      "resources": {        "mcp_id": "92dad337-069f-4a18-a93d-2e7f16082ffb",        "mcp_display_name": "string",        "agent_instance_id": "e6b55a46-e2a1-4495-b96e-367af02e9908",        "agent_instance_display_name": "string",        "agent_slug": "string",        "autonomous": true,        "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5",        "user_display_name": "string",        "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9",        "policy_id": "ee9b03e0-6495-427a-85a5-34444d24ae04",        "policy_display_name": "string",        "dlp_rule_id": "e090a7ce-e55c-4dad-9728-ac5d9a88f84d",        "dlp_rule_display_name": "string",        "rate_limit_rule_id": "bf0cd7b5-1b50-4cec-8854-fe1ecbf87d0d",        "rate_limit_rule_display_name": "string",        "tag_id": "39c8a0b3-fbe8-4801-95bf-e8a0792edf1d",        "tag_display_name": "string",        "tool_key": "string"      },      "context": {        "device": "string",        "os": "string",        "browser": "string",        "ip": "string",        "city": "string",        "country": "string",        "user_agent": "string",        "trace_id": "string"      },      "changes": [        {          "type": "create",          "path": "string",          "from": null,          "to": null        }      ],      "payload": {        "display_name": "string",        "slug": "string",        "origin": "catalog"      },      "created_at": "2019-08-24T14:15:22Z"    }  ],  "next_cursor": "a7ec8888-a9c3-4732-a281-9a08510f220b"}

List audit events

AuthorizationCopy Anchor Link

Query ParametersCopy Anchor Link

Response BodyCopy Anchor Link

Authorization

Query Parameters

Response Body