API referenceCompliance APIActivitiesList activities

List activities

⚠️
Preview — this feature is being built; the design below is the spec.
GET https://app.syntic.ai/v1/compliance/activities

Return a time-ordered feed of what members did across every Syntic product the organization uses, for eDiscovery, insider-risk tools and security monitoring. Unlike the audit feed, which covers administrative changes, this feed includes everyday use: messages sent, files uploaded, Syntic Code sessions and agent runs. Content is not included; fetch it with the chat, project or code-session calls.

For how this fits into a full workflow, see Compliance API.

Headers

HeaderRequiredValue
AuthorizationYesBearer <admin key>: an Admin API key (sk_admin_...) that carries the compliance:read scope (plus compliance:write for deletions and holds). Enterprise plans only. See Compliance API.
syntic-betaYes, while in previewcompliance-2026-12-01. Without it the call fails with 400 beta_required. See Versioning.

Query parameters

ParameterTypeDefaultDescription
starting_atstringRequired. RFC 3339.
ending_atstringnow
productstringComma-separated products.
actionstringComma-separated action names; a trailing * matches a prefix, for example chat.*.
user_idstringOne member.
limitinteger1001 to 1,000.
after_idstringNext page.

Response

200 OK, Content-Type: application/json

{
  "data": [
    {
      "id": "act_01JCR4S6U8W0Y2A4C6E8",
      "type": "activity",
      "product": "chat",
      "action": "chat.message_sent",
      "actor": {
        "type": "user",
        "id": "user_01J9Y0A2C4E6G8J0L2N4",
        "email": "dana@example.com"
      },
      "resource": {
        "type": "chat",
        "id": "chat_01JCV7V9X1Z3B5D7F9H1"
      },
      "ip": "203.0.113.24",
      "user_agent": "Syntic Desktop 2.4.1 (macOS 15.1)",
      "occurred_at": "2026-11-05T10:00:00Z"
    }
  ],
  "has_more": false,
  "first_id": "act_01JCR4S6U8W0Y2A4C6E8",
  "last_id": "act_01JCR4S6U8W0Y2A4C6E8"
}
FieldTypeDescription
productstringapi, console, chat, code, agents or admin.
actionstringA dotted name such as chat.file_uploaded, code.session_started or api_key.created. The full list is on the Compliance API page.
actorobjectMember, service account or syntic.
resourceobjectWhat was acted on.
has_morebooleantrue when another page exists after this one.
first_idstring or nullPass as before_id to go back a page.
last_idstring or nullPass as after_id to get the next page.

Examples

curl -sS "https://app.syntic.ai/v1/compliance/activities?starting_at=2026-11-01T00:00:00Z&product=chat,code&limit=500" \
  -H "Authorization: Bearer $SYNTIC_ADMIN_KEY" \
  -H "syntic-beta: compliance-2026-12-01"

Errors

Errors use the error envelope and carry a request_id. Codes specific to this operation:

StatustypecodeWhen
400invalid_request_errorbeta_requiredThe syntic-beta header is missing.
401authentication_errorinvalid_api_keyThe admin key is missing, unknown, revoked or expired.
403permission_erroradmin_key_requiredAn inference key was used.
403permission_errorscope_missingThe admin key lacks the compliance:read (or, for writes, compliance:write) scope.
429rate_limit_errorrate_limitedToo many requests; wait for Retry-After. See Rate-limit headers.
Was this page helpful?