API referenceAdmin APISecurity & dataAudit feedGet an audit event

Get an audit event

⚠️
Preview — this feature is being built; the design below is the spec.
GET https://app.syntic.ai/v1/organizations/audit_events/{event_id}

Return one audit event with its full detail, including the before and after values of a settings change.

For how this fits into a full workflow, see Audit logs.

Headers

HeaderRequiredValue
AuthorizationYesBearer <admin key>: an Admin API key (sk_admin_...). Inference keys are refused with 403 admin_key_required. See Admin API keys.
syntic-betaYes, while in previewadmin-2026-11-01. Without it the call fails with 400 beta_required. See Versioning.

Path parameters

ParameterTypeDescription
event_idstringThe event id, starting with aud_.

Response

200 OK, Content-Type: application/json

{
  "id": "aud_01JDAB3C5E7G9J1L3N5Q",
  "type": "audit_event",
  "action": "api_key.updated",
  "actor": {
    "type": "user",
    "id": "user_01J9X1B3D5F7H9K1M3P5",
    "email": "owner@example.com",
    "ip": "203.0.113.24",
    "via": "console"
  },
  "target": {
    "type": "api_key",
    "id": "apikey_01JA0B2D4F6H8K0M2P4R"
  },
  "changes": {
    "status": {
      "from": "active",
      "to": "inactive"
    }
  },
  "workspace_id": "wrkspc_01JC0A2C4E6G8J0L2N4Q",
  "occurred_at": "2026-11-05T10:00:00Z",
  "request_id": "req_01JDAB3C5E7G9J1L3N5Q"
}
FieldTypeDescription
actorobjectWho did it: a member, a service account or syntic for automatic actions, with source IP and surface (console, admin_api, scim).
changesobjectField-by-field before and after values. Secrets are never included.

Examples

curl -sS "https://app.syntic.ai/v1/organizations/audit_events/event_id" \
  -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
  -H "syntic-beta: admin-2026-11-01"

Errors

Errors use the error envelope and carry a request_id. Codes specific to this operation:

StatustypecodeWhen
400invalid_request_errorbeta_requiredThe syntic-beta header is missing.
404not_found_erroraudit_event_not_foundNo event with this id, or it is older than the 400-day retention.
401authentication_errorinvalid_api_keyThe admin key is missing, unknown, revoked or expired.
403permission_erroradmin_key_requiredAn inference key was used.
429rate_limit_errorrate_limitedToo many requests; wait for Retry-After. See Rate-limit headers.
Was this page helpful?