Get an audit event
⚠️
Preview — this feature is being built; the design below is the spec.
GET https://app.syntic.ai/v1/organizations/audit_events/{event_id}Return one audit event with its full detail, including the before and after values of a settings change.
For how this fits into a full workflow, see Audit logs.
Headers
| Header | Required | Value |
|---|---|---|
Authorization | Yes | Bearer <admin key>: an Admin API key (sk_admin_...). Inference keys are refused with 403 admin_key_required. See Admin API keys. |
syntic-beta | Yes, while in preview | admin-2026-11-01. Without it the call fails with 400 beta_required. See Versioning. |
Path parameters
| Parameter | Type | Description |
|---|---|---|
event_id | string | The event id, starting with aud_. |
Response
200 OK, Content-Type: application/json
{
"id": "aud_01JDAB3C5E7G9J1L3N5Q",
"type": "audit_event",
"action": "api_key.updated",
"actor": {
"type": "user",
"id": "user_01J9X1B3D5F7H9K1M3P5",
"email": "owner@example.com",
"ip": "203.0.113.24",
"via": "console"
},
"target": {
"type": "api_key",
"id": "apikey_01JA0B2D4F6H8K0M2P4R"
},
"changes": {
"status": {
"from": "active",
"to": "inactive"
}
},
"workspace_id": "wrkspc_01JC0A2C4E6G8J0L2N4Q",
"occurred_at": "2026-11-05T10:00:00Z",
"request_id": "req_01JDAB3C5E7G9J1L3N5Q"
}| Field | Type | Description |
|---|---|---|
actor | object | Who did it: a member, a service account or syntic for automatic actions, with source IP and surface (console, admin_api, scim). |
changes | object | Field-by-field before and after values. Secrets are never included. |
Examples
curl -sS "https://app.syntic.ai/v1/organizations/audit_events/event_id" \
-H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
-H "syntic-beta: admin-2026-11-01"Errors
Errors use the error envelope and carry a request_id. Codes specific to this operation:
| Status | type | code | When |
|---|---|---|---|
| 400 | invalid_request_error | beta_required | The syntic-beta header is missing. |
| 404 | not_found_error | audit_event_not_found | No event with this id, or it is older than the 400-day retention. |
| 401 | authentication_error | invalid_api_key | The admin key is missing, unknown, revoked or expired. |
| 403 | permission_error | admin_key_required | An inference key was used. |
| 429 | rate_limit_error | rate_limited | Too many requests; wait for Retry-After. See Rate-limit headers. |
Was this page helpful?