Audit log

List audit events

Audit events of the workspace, newest first. This endpoint is append-only and high volume, so it paginates by cursor rather than by offset: pass `nextCursor` back as `cursor`, and drive the loop with `hasMore` rather than comparing an offset to `total`. The cursor is opaque — do not parse it or build one yourself.

Required scope audit_log:read

get/audit-log

Authorizations

Authorizationstringrequired

Authorization header carrying a workspace API key, as “Bearer kbn_live_…”. The X-Api-Key header is accepted equivalently.

Query parameters

fromstring<date-time>

Keep only events at or after this instant.

tostring<date-time>

Keep only events at or before this instant.

actorIdstring<uuid>

Keep only events performed by this actor.

categorystring

Keep only events of this category.

actionsstring[]

Keep only these actions. Repeatable.

resourceTypestring

Keep only events targeting this kind of resource.

resourceIdstring<uuid>

Keep only events targeting this resource.

querystring

Free-text search across the events.

limitinteger

Page size, capped at 200.

max: 200

cursorstring

Opaque cursor returned by the previous page.

Response200 · application/json

A page of audit events.

dataany[]required

The page of events.

totalintegerrequired

Total number of events matching your filters.

nextCursorstring | null

Opaque cursor for the next page. Absent on the last page.

hasMorebooleanrequired

Whether another page follows.