Fetch audit logs

Fetches tenant-level audit log entries using a stateless cursor-based approach. Designed for clients that need to continuously stream or replay audit activity without missing or duplicating records.

Call patterns

Initial call (no cursor)

Omit the cursor field and supply optional filters. The server freezes those filters into an opaque cursor token returned as nextCursor.

• Open-tail stream (createdAfter only, no createdBefore): each subsequent poll advances the upper bound forward in real time, delivering new events as they are committed. The window from createdAfter to now must not exceed 90 days at the time of the initial call.
• Fixed window (createdAfter + createdBefore): the cursor exhausts once all matching rows in the range have been delivered (hasMore: false).
• Start from now (neither date supplied): stream begins at the current time, delivering only events that occur going forward.

Subsequent calls (with cursor)

Pass only the cursor field from the previous response's nextCursor. Do not include any filters or dates — they are already frozen inside the cursor. To change filters, start a new stream by making a fresh initial call without a cursor.

Polling

• hasMore: true — a full page was returned; call again immediately with nextCursor to retrieve the next page.
• hasMore: false — the stream is caught up; wait before polling again, then retry with nextCursor.
• Always preserve nextCursor, even when data is empty. Discarding it loses your position in the stream.

Date rules

• Accepted format: ISO 8601 with explicit UTC offset, e.g. 2026-06-01T00:00:00Z.
• createdAfter cannot be in the future.
• createdAfter cannot be older than 1 year (the audit log retention window).
• createdBefore requires createdAfter. If createdBefore is in the future it is silently clamped to now.
• createdBefore must be after createdAfter (after clamping).
• The window between createdAfter and createdBefore (or now for open tails) must not exceed 90 days.

Ordering and safe upper bound

Results are returned in ascending order by event ID (i.e. chronological order). A 5-second lag is applied to the upper time bound so that in-flight transactions have time to commit before the cursor reaches them, preventing gaps in the stream.

Headers

Parameters

Request Body

{}

Responses

200 - A page of audit log entries with cursor state.

{
  "data": [
    {
      "eventId": 1035,
      "actor": {
        "id": 3,
        "email": "admin@example.com",
        "displayName": "John Doe"
      },
      "event": "Create User",
      "description": "User created: jane@example.com",
      "timestamp": "2026-01-15T08:12:04Z"
    },
    {
      "eventId": 1042,
      "actor": {
        "id": 3,
        "email": "admin@example.com",
        "displayName": "John Doe"
      },
      "event": "Create Project",
      "description": "Project created: Regression Suite",
      "timestamp": "2026-01-15T10:30:00Z"
    }
  ],
  "nextCursor": "eyJ2IjoxLCJsYXN0SWQiOjEwNDIsImZyb21FcG9jaE1zIjoxNzQ4NzM5MjAwMDAwLCJ0b0Vwb2NoTXMiOm51bGx9",
  "hasMore": true
}

400 - Bad Request — invalid filter value or constraint violation.

{
  "error": "Do not send filters or dates with a cursor. To change filters, start a new sync without a cursor."
}

403 - Forbidden — caller does not have Tenant Admin privileges.

{
  "error": "User do not have authorization to access this feature."
}

500 - Internal Server Error

No response sample available