Audit feed

# New administrators and revoked keys in the last 7 days
curl -sS -G https://app.syntic.ai/v1/organizations/audit_events \
  -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
  -H "syntic-beta: admin-2026-11-01" \
  --data-urlencode "starting_at=$(date -u -d '7 days ago' +%Y-%m-%dT%H:%M:%SZ)" \
  --data-urlencode "actions[]=member.change_role" \
  --data-urlencode "actions[]=api_key.revoked"

// Run every minute; ship new events to your log pipeline
import { readFile, writeFile } from 'node:fs/promises'
 
const cursorFile = './syntic-audit.cursor'
let after = await readFile(cursorFile, 'utf8').catch(() => '')
const qs = new URLSearchParams({ order: 'asc', limit: '1000', ...(after && { after_id: after }) })
const res = await fetch(`https://app.syntic.ai/v1/organizations/audit_events?${qs}`, {
  headers: { Authorization: `Bearer ${process.env.SYNTIC_ADMIN_KEY}`, 'syntic-beta': 'admin-2026-11-01' },
})
const page = await res.json()
for (const ev of page.data) process.stdout.write(JSON.stringify(ev) + '\n')
if (page.last_id) await writeFile(cursorFile, page.last_id)

import json, os, pathlib, requests
 
H = {"Authorization": f"Bearer {os.environ['SYNTIC_ADMIN_KEY']}", "syntic-beta": "admin-2026-11-01"}
cursor = pathlib.Path("syntic-audit.cursor")
params = {"order": "asc", "limit": 1000}
if cursor.exists():
    params["after_id"] = cursor.read_text().strip()
 
while True:
    page = requests.get("https://app.syntic.ai/v1/organizations/audit_events", headers=H, params=params).json()
    for ev in page["data"]:
        print(json.dumps(ev))          # or send to your SIEM
    if page["data"]:
        cursor.write_text(page["last_id"])
        params["after_id"] = page["last_id"]
    if not page["has_more"]:
        break