API referenceAdmin APISecurity & dataAudit feedList audit events

List audit events

⚠️
Preview — this feature is being built; the design below is the spec.
GET https://app.syntic.ai/v1/organizations/audit_events

Read the organization’s audit log: who did what, to which resource, when and from where. To stream into a SIEM, poll with order=asc and after_id set to the last event stored; events never change once written, so the cursor neither misses nor repeats events. The key’s creator needs audit-log access in the Console.

For how this fits into a full workflow, see Audit feed.

Headers

HeaderRequiredValue
AuthorizationYesBearer <admin key>: an Admin API key (sk_admin_...). Inference keys are refused with 403 admin_key_required. See Admin API keys.
syntic-betaYes, while in previewadmin-2026-11-01. Without it the call fails with 400 beta_required. See Versioning.

Query parameters

ParameterTypeDefaultDescription
starting_atRFC 3339 time24 hours agoWindow start.
ending_atRFC 3339 timenowWindow end.
actions[]stringExact names such as api_key.revoked, or a prefix such as member.*. Repeatable.
actor_idstringOne member, admin key or service account.
resource_typestringOne kind of resource.
resource_idstringOne resource.
limitinteger1001 to 1,000.
after_idstringEvents after this id.
orderstringascasc or desc.

Response

200 OK, Content-Type: application/json

{
  "data": [
    {
      "id": "evt_01JCE4G6J8L0N2Q4S6U8",
      "type": "audit_event",
      "action": "api_key.revoked",
      "occurred_at": "2026-11-05T09:58:12Z",
      "actor": {
        "kind": "user",
        "id": "user_01J9Y0A2C4E6G8J0L2N4",
        "email": "dana@example.com"
      },
      "resource": {
        "type": "api_key",
        "id": "apikey_01JB7C9E1G3J5L7N9Q1S",
        "name": "billing-worker-prod"
      },
      "workspace_id": "wrkspc_01JC0A2C4E6G8J0L2N4Q",
      "ip_address": "198.51.100.23",
      "user_agent": "Mozilla/5.0 ...",
      "request_id": "req_4a0e8c1d2b3f4a5e6c7d8e9f",
      "details": {
        "prefix": "sk_live_3f9c"
      }
    }
  ],
  "has_more": true,
  "first_id": "evt_01JCE4G6J8L0N2Q4S6U8",
  "last_id": "evt_01JCE4K2M4P6R8T0V2X4"
}
FieldTypeDescription
actionstringDotted action name; see Audit logs.
actor.kindstringuser, admin_key, api_key, service_account, directory_sync or system.
resource.namestringThe resource’s name when the event happened.
detailsobjectAction-specific context; never secrets or prompt content.

Examples

curl -sS "https://app.syntic.ai/v1/organizations/audit_events?actions%5B%5D=member.%2A&actions%5B%5D=api_key.revoked&order=asc&limit=500" \
  -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
  -H "syntic-beta: admin-2026-11-01"

Errors

Errors use the error envelope and carry a request_id. Codes specific to this operation:

StatustypecodeWhen
400invalid_request_errorbeta_requiredThe syntic-beta header is missing.
400invalid_request_errorinvalid_time_rangeReversed window or older than retention (1 year by default).
400invalid_request_errorinvalid_action_filterMalformed action pattern.
403permission_errorrole_requiredThe admin key’s creator does not have the role this needs.
401authentication_errorinvalid_api_keyThe admin key is missing, unknown, revoked or expired.
403permission_erroradmin_key_requiredAn inference key was used.
429rate_limit_errorrate_limitedToo many requests; wait for Retry-After. See Rate-limit headers.
Was this page helpful?