get
https://api.conveyor.com/api/v2/audit_events/
Export audit events with optional filters, sorting and pagination.
Recent Requests
Log in to see full request history
| Time | Status | User Agent | |
|---|---|---|---|
Retrieving recent requests… | |||
Loading…
See Audit Logs for what's recorded.
Authentication
- API key: send it in the
X-API-KEYheader. The key needs the Audit permission, which only Superadmins and Conveyor Admins can grant. A key without it gets a403. - OAuth (AI Connector): Superadmins and Conveyor Admins see their organization's events. Other users get an empty list, not an error.
Filtering
- Filters combine. List filters take comma-separated values and match any of them.
- Values are matched exactly. An unrecognized value returns no events rather than an error; a malformed date or timestamp returns a
400. start_dateandend_datecover whole UTC days. Ifend_dateis beforestart_date, the two are swapped.sincetakes an exact ISO 8601 timestamp and can be combined with the date filters.
| Filter | Values |
|---|---|
category | authentication, user, membership, role, invitation, permission_grant, api_key, integration, webhook, organization, program_setting, collaboration_group, product_line, document, folder, trust_center, topic, curated_qa, external_source |
action_type | <record>.created, .updated, .deleted or .restored, e.g. role.updated or document.deleted. Sign-ins are user.logged_in, user.logged_out and user.login_failed. |
subject_type | The record's type, e.g. Auth::User, Auth::Role, ApiKey, Exchange::Document, Topic or Vsa::Question |
actor_type | user, api_key, saml (SSO and SCIM) or conveyor_support |
source | ui, api_key, oauth, saml, scim, admin_console or console |
Responses show the stored actor type (Auth::User, ExternalUser, PreviewUser, SlackIntegration::User, ApiKey or Auth::SamlConfiguration) or conveyor_support. To filter, use the four actor_type values above.
Polling for new events
To stream your audit log into a SIEM such as Splunk:
- Store the
created_atof the newest event you've received. - On each poll, request
since=<that time minus one minute>&per_page=1000, then page through untilpageequalstotal_pages. Results are oldest first. - Skip events whose
idyou've already stored. The one-minute overlap deliberately returns a few repeats, so an event written mid-poll isn't missed.
URL-encode a + in a timezone offset as %2B. The API allows 2,000 requests per 5 minutes.