OpenPostWorkspaces
List permission-safe instance audit evidence
Projects consequential evidence across the instance without exposing Workspace content, emails, secrets, credentials, invitation links, or provider payloads. Requires an unscoped instance-administrator browser session.
GET
/admin/audit-eventsAuthorization
bearerAuth AuthorizationBearer <token>
In: header
Query Parameters
organization_id?string
Restrict evidence to one Organization
workspace_id?string
Restrict evidence to one Workspace
actor_user_id?string
Restrict evidence to one opaque actor user ID
action?string
Restrict evidence to one exact domain action
Length
length <= 100resource_type?string
Restrict evidence to one resource type
Value in
- "provider"
- "policy"
- "domain"
- "session"
- "identity"
- "reauthentication"
- "identity_configuration"
- "organization"
- "workspace"
- "workspace_member"
- "workspace_invitation"
- "organization_ownership_transfer"
- "impersonation"
- "billing"
- "mcp_tool_call"
- "publication"
- "publication_authorization"
- "provider_write"
result?string
Restrict evidence to one result
Value in
- "succeeded"
- "failed"
- "pending"
from?string
Inclusive RFC 3339 start time
before?string
Exclusive RFC 3339 end time
cursor?string
Opaque cursor for stable older-page pagination
limit?integer
Maximum events to return
Format
int64Range
1 <= value <= 200Default
50Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
curl -X GET "https://example.com/admin/audit-events"{ "$schema": "https://example.com/api/v1/schemas/AuditPage.json", "items": [ { "action": "string", "actor_user_id": "string", "changed_fields": [ { "current": "string", "field": "string", "previous": "string" } ], "effective_actor_user_id": "string", "id": "string", "occurred_at": "2019-08-24T14:15:22Z", "resource": { "id": "string", "organization_id": "string", "type": "string", "workspace_id": "string" }, "result": "string", "source": "string" } ], "next_cursor": "string"}