The audit event object

⚠️

Preview — this feature is being built; the design below is the spec.

The audit_event object as the API returns it. Every field below appears in every response that returns this object; fields with no value are null rather than missing.

Example

{
  "id": "evt_01JCE4G6J8L0N2Q4S6U8",
  "type": "audit_event",
  "action": "api_key.revoked",
  "occurred_at": "2026-11-05T09:58:12Z",
  "actor": {
    "kind": "user",
    "id": "user_01J9Y0A2C4E6G8J0L2N4",
    "email": "dana@example.com"
  },
  "resource": {
    "type": "api_key",
    "id": "apikey_01JB7C9E1G3J5L7N9Q1S",
    "name": "billing-worker-prod"
  },
  "workspace_id": "wrkspc_01JC0A2C4E6G8J0L2N4Q",
  "ip_address": "198.51.100.23",
  "user_agent": "Mozilla/5.0 ...",
  "request_id": "req_4a0e8c1d2b3f4a5e6c7d8e9f",
  "details": {
    "prefix": "sk_live_3f9c"
  }
}

Fields

Field	Type	Description
`id`	string	Unique id of this object.
`type`	string	The object type, always `audit_event`.
`action`	string	Dotted action name; see Audit logs.
`occurred_at`	string	See the endpoint pages below.
`actor`	object	Who did it: a member, a service account or `syntic` for automatic actions, with source IP and surface (`console`, `admin_api`, `scim`).
`resource`	object	Nested detail; see the endpoint pages below.
`workspace_id`	string	The workspace it belongs to.
`ip_address`	string	See the endpoint pages below.
`user_agent`	string	See the endpoint pages below.
`request_id`	string	See the endpoint pages below.
`details`	object	Action-specific context; never secrets or prompt content.

Returned by

api_key batch

Was this page helpful?