List activities
⚠️
Preview — this feature is being built; the design below is the spec.
GET https://app.syntic.ai/v1/compliance/activitiesReturn a time-ordered feed of what members did across every Syntic product the organization uses, for eDiscovery, insider-risk tools and security monitoring. Unlike the audit feed, which covers administrative changes, this feed includes everyday use: messages sent, files uploaded, Syntic Code sessions and agent runs. Content is not included; fetch it with the chat, project or code-session calls.
For how this fits into a full workflow, see Compliance API.
Headers
| Header | Required | Value |
|---|---|---|
Authorization | Yes | Bearer <admin key>: an Admin API key (sk_admin_...) that carries the compliance:read scope (plus compliance:write for deletions and holds). Enterprise plans only. See Compliance API. |
syntic-beta | Yes, while in preview | compliance-2026-12-01. Without it the call fails with 400 beta_required. See Versioning. |
Query parameters
| Parameter | Type | Default | Description |
|---|---|---|---|
starting_at | string | Required. RFC 3339. | |
ending_at | string | now | |
product | string | Comma-separated products. | |
action | string | Comma-separated action names; a trailing * matches a prefix, for example chat.*. | |
user_id | string | One member. | |
limit | integer | 100 | 1 to 1,000. |
after_id | string | Next page. |
Response
200 OK, Content-Type: application/json
{
"data": [
{
"id": "act_01JCR4S6U8W0Y2A4C6E8",
"type": "activity",
"product": "chat",
"action": "chat.message_sent",
"actor": {
"type": "user",
"id": "user_01J9Y0A2C4E6G8J0L2N4",
"email": "dana@example.com"
},
"resource": {
"type": "chat",
"id": "chat_01JCV7V9X1Z3B5D7F9H1"
},
"ip": "203.0.113.24",
"user_agent": "Syntic Desktop 2.4.1 (macOS 15.1)",
"occurred_at": "2026-11-05T10:00:00Z"
}
],
"has_more": false,
"first_id": "act_01JCR4S6U8W0Y2A4C6E8",
"last_id": "act_01JCR4S6U8W0Y2A4C6E8"
}| Field | Type | Description |
|---|---|---|
product | string | api, console, chat, code, agents or admin. |
action | string | A dotted name such as chat.file_uploaded, code.session_started or api_key.created. The full list is on the Compliance API page. |
actor | object | Member, service account or syntic. |
resource | object | What was acted on. |
has_more | boolean | true when another page exists after this one. |
first_id | string or null | Pass as before_id to go back a page. |
last_id | string or null | Pass as after_id to get the next page. |
Examples
curl -sS "https://app.syntic.ai/v1/compliance/activities?starting_at=2026-11-01T00:00:00Z&product=chat,code&limit=500" \
-H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
-H "syntic-beta: compliance-2026-12-01"Errors
Errors use the error envelope and carry a request_id. Codes specific to this operation:
| Status | type | code | When |
|---|---|---|---|
| 400 | invalid_request_error | beta_required | The syntic-beta header is missing. |
| 401 | authentication_error | invalid_api_key | The admin key is missing, unknown, revoked or expired. |
| 403 | permission_error | admin_key_required | An inference key was used. |
| 403 | permission_error | scope_missing | The admin key lacks the compliance:read (or, for writes, compliance:write) scope. |
| 429 | rate_limit_error | rate_limited | Too many requests; wait for Retry-After. See Rate-limit headers. |
Was this page helpful?