Audit log API

The full audit log, for a SIEM. Needs Enterprise. Every request sends a token in the Authorization: Bearer header; see Get started with the API.

List audit events

GET /api/admin/audit-logs

Returns audit events matching the filters, newest first, one page at a time. To read every event as it happens, use the audit feed instead.

Permission: Monitoring: Audit log (audit:read)
Plan: Enterprise
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`search`	query	string	Matches whole words in the target name, description and actor email, or any part of the target name or actor email (when the term has 3 letters or digits in a row).
`event_type`	query	string	Comma-separated event types. A value without a dot matches a whole category: `file,user.created` matches every `file.*` event and `user.created`.
`severity`	query	string: `info`, `warn`	Only events with this severity.
`outcome`	query	string: `success`, `failure`	Only events with this outcome.
`actor_id`	query	string	Only events by this actor (`actor.id`).
`target_type`	query	string	Only events on this kind of target (`target.type`), such as `file`.
`from`	query	string (date-time)	Only events at or after this time (RFC 3339).
`to`	query	string (date-time)	Only events at or before this time (RFC 3339).
`cursor`	query	string	The `next_cursor` of the previous page. Leave out for the newest events.
`limit`	query	integer	Most events per page. Larger values return 200. Default `50`. Minimum 1. Maximum 200.

Response 200

Success.

data is AuditEventPage.

{
  "success": true,
  "data": {
    "entries": [
      {
        "id": 48214,
        "event_id": "9a1d7e40-2c3b-4f58-8d6e-0b7c1a2f3e45",
        "timestamp": "2026-10-02T14:05:42.508000Z",
        "event_type": "auth.signed_in",
        "category": "auth",
        "outcome": "failure",
        "reason": "wrong_password",
        "severity": "warn",
        "description": "Sign-in failed",
        "actor": {
          "type": "user",
          "id": "6b1f0c2e-4d3a-4e5b-9c8d-7a6f5e4d3c2b",
          "email": "anna@example.com"
        },
        "target": {
          "type": "user",
          "id": "6b1f0c2e-4d3a-4e5b-9c8d-7a6f5e4d3c2b",
          "name": "anna@example.com"
        },
        "client_ip": "198.51.100.7",
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5)",
        "request_id": "c81e728d9d4c2f636f067f89cc14862c",
        "metadata": {
          "method": "password"
        }
      },
      {
        "id": 48213,
        "event_id": "3f6c2a1e-8b4d-4c7a-9e21-5d0f7b6a9c34",
        "timestamp": "2026-10-02T14:03:11.120000Z",
        "event_type": "file.downloaded",
        "category": "file",
        "outcome": "success",
        "severity": "info",
        "description": "File downloaded",
        "actor": {
          "type": "external",
          "email": "bob@example.com"
        },
        "target": {
          "type": "file",
          "id": "kT9xQ2aZ",
          "name": "Q4 invoices.pdf"
        },
        "domain": "files.example.com",
        "client_ip": "203.0.113.24",
        "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
        "request_id": "a3f8b2c1d4e5f60718293a4b5c6d7e8f",
        "metadata": {
          "via": "link",
          "size_bytes": 2483021,
          "owner_email": "anna@example.com"
        }
      }
    ],
    "next_cursor": "2026-10-02T14:03:11.12Z,48213",
    "has_more": true
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.” “Invalid ‘from’ date: must be RFC3339 (e.g. 2026-07-12T00:00:00Z)” “Invalid ‘to’ date: must be RFC3339 (e.g. 2026-07-12T23:59:59Z)”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed. Also returned when the license doesn’t include audit logs.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.” “This feature is available on the Enterprise plan.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Export audit events

GET /api/admin/audit-logs/export

Downloads every audit event matching the filters as NDJSON, newest first, with no limit on the number of events. Each export is itself recorded in the audit log as audit.exported.

Permission: Monitoring: Audit log (audit:read)
Plan: Enterprise
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`search`	query	string	Matches whole words in the target name, description and actor email, or any part of the target name or actor email (when the term has 3 letters or digits in a row).
`event_type`	query	string	Comma-separated event types. A value without a dot matches a whole category: `file,user.created` matches every `file.*` event and `user.created`.
`severity`	query	string: `info`, `warn`	Only events with this severity.
`outcome`	query	string: `success`, `failure`	Only events with this outcome.
`actor_id`	query	string	Only events by this actor (`actor.id`).
`target_type`	query	string	Only events on this kind of target (`target.type`), such as `file`.
`from`	query	string (date-time)	Only events at or after this time (RFC 3339).
`to`	query	string (date-time)	Only events at or before this time (RFC 3339).

Response 200

The events, as a download named audit-logs.ndjson. One JSON record per line. If the export fails after it started, the last line is {"error":"export_incomplete","message":"This export is incomplete. Try exporting again."}.

data is AuditEvent.

"{\"id\":48214,\"event_id\":\"9a1d7e40-2c3b-4f58-8d6e-0b7c1a2f3e45\",\"timestamp\":\"2026-10-02T14:05:42.508000Z\",\"event_type\":\"auth.signed_in\",\"category\":\"auth\",\"outcome\":\"failure\",\"reason\":\"wrong_password\",\"severity\":\"warn\",\"description\":\"Sign-in failed\",\"actor\":{\"type\":\"user\",\"id\":\"6b1f0c2e-4d3a-4e5b-9c8d-7a6f5e4d3c2b\",\"email\":\"anna@example.com\"},\"target\":{\"type\":\"user\",\"id\":\"6b1f0c2e-4d3a-4e5b-9c8d-7a6f5e4d3c2b\",\"name\":\"anna@example.com\"},\"client_ip\":\"198.51.100.7\",\"user_agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5)\",\"request_id\":\"c81e728d9d4c2f636f067f89cc14862c\",\"metadata\":{\"method\":\"password\"}}\n{\"id\":48213,\"event_id\":\"3f6c2a1e-8b4d-4c7a-9e21-5d0f7b6a9c34\",\"timestamp\":\"2026-10-02T14:03:11.120000Z\",\"event_type\":\"file.downloaded\",\"category\":\"file\",\"outcome\":\"success\",\"severity\":\"info\",\"description\":\"File downloaded\",\"actor\":{\"type\":\"external\",\"email\":\"bob@example.com\"},\"target\":{\"type\":\"file\",\"id\":\"kT9xQ2aZ\",\"name\":\"Q4 invoices.pdf\"},\"domain\":\"files.example.com\",\"client_ip\":\"203.0.113.24\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"request_id\":\"a3f8b2c1d4e5f60718293a4b5c6d7e8f\",\"metadata\":{\"via\":\"link\",\"size_bytes\":2483021,\"owner_email\":\"anna@example.com\"}}\n"

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.” “Invalid ‘from’ date: must be RFC3339 (e.g. 2026-07-12T00:00:00Z)” “Invalid ‘to’ date: must be RFC3339 (e.g. 2026-07-12T23:59:59Z)”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed. Also returned when the license doesn’t include audit logs.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.” “This feature is available on the Enterprise plan.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Count audit events by category

GET /api/admin/audit-logs/stats

Returns how many audit events each category had in the last 24 hours, most first.

Permission: Monitoring: Audit log (audit:read)
Plan: Enterprise
Service account tokens only, without Dew-Act-As.

Response 200

Success.

data is array of AuditCategoryCount.

{
  "success": true,
  "data": [
    {
      "category": "file",
      "count": 412
    },
    {
      "category": "auth",
      "count": 96
    },
    {
      "category": "file_request",
      "count": 37
    }
  ]
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed. Also returned when the license doesn’t include audit logs.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.” “This feature is available on the Enterprise plan.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

Read the audit feed

GET /api/admin/audit-logs/feed

Returns every audit event with an id above after_id, oldest first, for a SIEM to collect. Store next_after_id and send it as after_id on the next call; poll again right away while has_more is true. The feed never skips an event: no event appears later with an id below one you have already read. Reading the feed is not recorded in the audit log.

Permission: Monitoring: Audit log (audit:read)
Plan: Enterprise
Service account tokens only, without Dew-Act-As.

Parameters

Name	In	Type	Description
`after_id`	query	integer (int64)	Return events with an `id` above this. Start at 0, then send the `next_after_id` of the previous response. Default `0`. Minimum 0.
`limit`	query	integer	Most events to return. Default `500`. Minimum 1. Maximum 1000.

Response 200

Success.

data is AuditFeedPage.

{
  "success": true,
  "data": {
    "entries": [
      {
        "id": 48213,
        "event_id": "3f6c2a1e-8b4d-4c7a-9e21-5d0f7b6a9c34",
        "timestamp": "2026-10-02T14:03:11.120000Z",
        "event_type": "file.downloaded",
        "category": "file",
        "outcome": "success",
        "severity": "info",
        "description": "File downloaded",
        "actor": {
          "type": "external",
          "email": "bob@example.com"
        },
        "target": {
          "type": "file",
          "id": "kT9xQ2aZ",
          "name": "Q4 invoices.pdf"
        },
        "domain": "files.example.com",
        "client_ip": "203.0.113.24",
        "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)",
        "request_id": "a3f8b2c1d4e5f60718293a4b5c6d7e8f",
        "metadata": {
          "via": "link",
          "size_bytes": 2483021,
          "owner_email": "anna@example.com"
        }
      },
      {
        "id": 48214,
        "event_id": "9a1d7e40-2c3b-4f58-8d6e-0b7c1a2f3e45",
        "timestamp": "2026-10-02T14:05:42.508000Z",
        "event_type": "auth.signed_in",
        "category": "auth",
        "outcome": "failure",
        "reason": "wrong_password",
        "severity": "warn",
        "description": "Sign-in failed",
        "actor": {
          "type": "user",
          "id": "6b1f0c2e-4d3a-4e5b-9c8d-7a6f5e4d3c2b",
          "email": "anna@example.com"
        },
        "target": {
          "type": "user",
          "id": "6b1f0c2e-4d3a-4e5b-9c8d-7a6f5e4d3c2b",
          "name": "anna@example.com"
        },
        "client_ip": "198.51.100.7",
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5)",
        "request_id": "c81e728d9d4c2f636f067f89cc14862c",
        "metadata": {
          "method": "password"
        }
      }
    ],
    "next_after_id": 48214,
    "has_more": false
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.” “after_id must be a whole number of 0 or more.” “limit must be between 1 and 1000.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed. Also returned when the license doesn’t include audit logs.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.” “This feature is available on the Enterprise plan.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.

List audit event types

GET /api/admin/audit-logs/event-types

Returns every event type the audit log can hold, with its category, severity and labels, and the list of categories. Use it to set up parsers and filters.

Permission: Monitoring: Audit log (audit:read)
Plan: Enterprise
Service account tokens only, without Dew-Act-As.

Response 200

Success.

data fields:

Field	Type	Description
`categories` (required)	array of AuditCategory
`event_types` (required)	array of AuditEventType

{
  "success": true,
  "data": {
    "categories": [
      {
        "category": "auth",
        "label": "Sign-in"
      },
      {
        "category": "file",
        "label": "Files and links"
      }
    ],
    "event_types": [
      {
        "event_type": "auth.signed_in",
        "category": "auth",
        "severity": "info",
        "label": "Signed in",
        "failure_label": "Sign-in failed"
      },
      {
        "event_type": "file.downloaded",
        "category": "file",
        "severity": "info",
        "label": "File downloaded"
      }
    ]
  }
}

Errors

Status	When	Example message
400	The request is invalid; `message` says what to change.	“Dew-Act-As can’t be used for admin actions.”
401	The token is missing, wrong, revoked or expired.
403	The token lacks the permission, is a personal token, or the caller’s network is not allowed. Also returned when the license doesn’t include audit logs.	“This API token doesn’t have permission for this action.” “Personal API tokens can’t be used for admin actions.” “Admin access is not allowed from this network.” “This feature is available on the Enterprise plan.”
500	Something failed on the server. `error` is an error code and `ref` a reference to quote to your admin, who can find it in the system logs.