List audit events
⚠️
Preview — this feature is being built; the design below is the spec.
GET https://app.syntic.ai/v1/organizations/audit_eventsRead the organization’s audit log: who did what, to which resource, when and from where. To stream into a SIEM, poll with order=asc and after_id set to the last event stored; events never change once written, so the cursor neither misses nor repeats events. The key’s creator needs audit-log access in the Console.
For how this fits into a full workflow, see Audit feed.
Headers
| Header | Required | Value |
|---|---|---|
Authorization | Yes | Bearer <admin key>: an Admin API key (sk_admin_...). Inference keys are refused with 403 admin_key_required. See Admin API keys. |
syntic-beta | Yes, while in preview | admin-2026-11-01. Without it the call fails with 400 beta_required. See Versioning. |
Query parameters
| Parameter | Type | Default | Description |
|---|---|---|---|
starting_at | RFC 3339 time | 24 hours ago | Window start. |
ending_at | RFC 3339 time | now | Window end. |
actions[] | string | Exact names such as api_key.revoked, or a prefix such as member.*. Repeatable. | |
actor_id | string | One member, admin key or service account. | |
resource_type | string | One kind of resource. | |
resource_id | string | One resource. | |
limit | integer | 100 | 1 to 1,000. |
after_id | string | Events after this id. | |
order | string | asc | asc or desc. |
Response
200 OK, Content-Type: application/json
{
"data": [
{
"id": "evt_01JCE4G6J8L0N2Q4S6U8",
"type": "audit_event",
"action": "api_key.revoked",
"occurred_at": "2026-11-05T09:58:12Z",
"actor": {
"kind": "user",
"id": "user_01J9Y0A2C4E6G8J0L2N4",
"email": "dana@example.com"
},
"resource": {
"type": "api_key",
"id": "apikey_01JB7C9E1G3J5L7N9Q1S",
"name": "billing-worker-prod"
},
"workspace_id": "wrkspc_01JC0A2C4E6G8J0L2N4Q",
"ip_address": "198.51.100.23",
"user_agent": "Mozilla/5.0 ...",
"request_id": "req_4a0e8c1d2b3f4a5e6c7d8e9f",
"details": {
"prefix": "sk_live_3f9c"
}
}
],
"has_more": true,
"first_id": "evt_01JCE4G6J8L0N2Q4S6U8",
"last_id": "evt_01JCE4K2M4P6R8T0V2X4"
}| Field | Type | Description |
|---|---|---|
action | string | Dotted action name; see Audit logs. |
actor.kind | string | user, admin_key, api_key, service_account, directory_sync or system. |
resource.name | string | The resource’s name when the event happened. |
details | object | Action-specific context; never secrets or prompt content. |
Examples
curl -sS "https://app.syntic.ai/v1/organizations/audit_events?actions%5B%5D=member.%2A&actions%5B%5D=api_key.revoked&order=asc&limit=500" \
-H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
-H "syntic-beta: admin-2026-11-01"Errors
Errors use the error envelope and carry a request_id. Codes specific to this operation:
| Status | type | code | When |
|---|---|---|---|
| 400 | invalid_request_error | beta_required | The syntic-beta header is missing. |
| 400 | invalid_request_error | invalid_time_range | Reversed window or older than retention (1 year by default). |
| 400 | invalid_request_error | invalid_action_filter | Malformed action pattern. |
| 403 | permission_error | role_required | The admin key’s creator does not have the role this needs. |
| 401 | authentication_error | invalid_api_key | The admin key is missing, unknown, revoked or expired. |
| 403 | permission_error | admin_key_required | An inference key was used. |
| 429 | rate_limit_error | rate_limited | Too many requests; wait for Retry-After. See Rate-limit headers. |
Related
Was this page helpful?