List audit records

Stored audit records for the key’s own environment, newest first, in the v1 export shape (anlyon.audit.v1). Enterprise edition and Team plan; answers 404 where audit streaming is not included. Needs audit:read, which no key receives by default. Deduplicate on id.

GET/api/v2/audit/events

Authorization

AuthorizationBearer token (Anlyon API key) · headerrequired

Workspace API key sent as Authorization: Bearer <key>.

better-auth.session_tokenAPI key · cookierequired

Browser session used by dashboard-only operations.

Query parameters

fromstring<date-time>

tostring<date-time>

environmentIdstring<uuid>

Ignored for an environment-scoped key

typestring

Comma-separated event types or prefixes, for example approval.*,policy.updated.

max length 1000

categoryAuditCategory

Allowed:approvalinvocationpolicyactionaccessenvironmentconnectionlimitaudit

actionstring

A governed action's name or id. Matches records that name it.

max length 200

endUserIdstring

Records of acts for this end user (or its erased~ hash).

max length 160

limitinteger

min 1 · max 200 · default: 50

beforeinteger

The sequence of the last record on the previous page.

min 1

Header parameters

X-Request-Idstring

Optional caller correlation ID. Unsafe or oversized values are replaced.

max length 128

Responses

200

Audit records, newest first.

successbooleanrequired

Allowed:true

dataAuditEvent[]required

Show properties

Array of AuditEvent

schemastringrequired

Allowed:anlyon.audit.v1

idstringrequired

sequenceintegerrequired

typestringrequired

categoryAuditCategoryrequired

Allowed:approvalinvocationpolicyactionaccessenvironmentconnectionlimitaudit

occurredAtstring<date-time>required

workspaceIdstring<uuid>required

environmentIdstring<uuid> | nullrequired

Null for workspace-level records such as members and keys.

actorAuditActorrequired

Show properties

typestringrequired

Allowed:userapi_keyoauth_clientassistantpolicysystem

idstring | nullrequired

User id

onBehalfOfstring | null

For an OAuth client

resourceobject | nullrequired

Show properties

typestringrequired

idstringrequired

outcomestring | nullrequired

dataobjectrequired

Type-specific detail. Invocation records carry a receipt; approval records carry the policy decision.

contextobject | nullrequired

Show properties

requestIdstring

ipstring

userAgentstring

testboolean

Present only on a test event.

Allowed:true

backfilledboolean

Present only on a record created from history by the one-time backfill

Allowed:true

endUserIdstring

Present only on a record of an act for one of your end users. erased~<hash> once that end user is erased.

paginationobjectrequired

Show properties

nextBeforeinteger | nullrequired

Pass as before for the next page. Null on the last page.

400

Bad Request - Invalid input data

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

How to get past this error, for a person or an agent. Present on refusals with a known next step, such as a missing scope or role, a plan or billing limit, a halted environment, or a missing secret, connected account, OAuth app or end-user header. Absent when there is no fix to give. Kept in production responses, unlike details.

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

401

Unauthorized - Invalid or missing API key

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

403

Authenticated credential lacks the required scope or workspace access.

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

404

Not Found - Resource does not exist

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

429

Too Many Requests - Rate limit exceeded. A workspace's API requests are limited per minute and per UTC clock hour by plan; Retry-After says when to try again, and an hourly refusal names the limit and when the count resets. Successful responses carry the same limits in X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset (the minute) and X-RateLimit-Limit-Hour, X-RateLimit-Remaining-Hour, X-RateLimit-Reset-Hour (the hour).

successbooleanrequired

requestIdstringrequired

Correlation ID matching the X-Request-Id response header.

errorobjectrequired

Show properties

codestring

messagestring

detailsobject

fixErrorFix

Show properties

summarystringrequired

One sentence that says what to do.

commandstring

An exact anlyon CLI command that fixes it. Absent when no command does.

urlstring<uri>

An absolute console link where a person fixes it.

docsstring<uri>

A docs page that explains it.

Try it

Server

Base URLCustom base URLOverrides the selected server when set.

Authorization

Bearer token (Anlyon API key)Remember on this deviceInclude my values in samples

Parameters

X-Request-IdheaderOptional caller correlation ID. Unsafe or oversized values are replaced.fromquerytoqueryenvironmentIdqueryIgnored for an environment-scoped keytypequeryComma-separated event types or prefixes, for example `approval.*,policy.updated`.categoryqueryactionqueryA governed action's name or id. Matches records that name it.endUserIdqueryRecords of acts for this end user (or its erased~ hash).limitquerybeforequeryThe `sequence` of the last record on the previous page.

Request

curl -X GET 'https://api.anlyon.com/api/v2/audit/events' \
  -H 'Authorization: Bearer YOUR_TOKEN'

const response = await fetch("https://api.anlyon.com/api/v2/audit/events", {
  method: "GET",
  headers: {
    "Authorization": "Bearer YOUR_TOKEN"
  }
});

import requests

response = requests.get(
    "https://api.anlyon.com/api/v2/audit/events",
    headers={
        "Authorization": "Bearer YOUR_TOKEN"
    },
)

Response

{
  "success": true,
  "data": [
    {
      "schema": "anlyon.audit.v1",
      "id": "aud_V1StGXR8Z5jdHi6BmyT4a9Qe",
      "sequence": 1042,
      "type": "approval.vote",
      "category": "approval",
      "occurredAt": "2019-08-24T14:15:22Z",
      "workspaceId": "ef0efa32-d1c1-43d4-a5e2-fe7b4f00403c",
      "environmentId": "19f5cc2e-7657-437a-9268-83cd3d563563",
      "actor": {
        "type": "user",
        "id": "string",
        "onBehalfOf": "string"
      },
      "resource": {
        "type": "approval",
        "id": "apr_123"
      },
      "outcome": "approve",
      "data": {},
      "context": {
        "requestId": "string",
        "ip": "string",
        "userAgent": "string"
      },
      "test": true,
      "backfilled": true,
      "endUserId": "string"
    }
  ],
  "pagination": {
    "nextBefore": 0
  }
}

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {
      "url": "Invalid URL format"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "AUTHENTICATION_ERROR",
    "message": "Invalid or missing API key"
  }
}

{
  "success": false,
  "requestId": "req_0123456789abcdef0123456789abcdef",
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "Invalid request data",
    "details": {},
    "fix": {
      "summary": "Log in again and approve the anlyon:secrets consent group, which grants secrets:write.",
      "command": "anlyon auth login --scope anlyon:secrets",
      "url": "https://console.anlyon.com/settings/api-keys",
      "docs": "https://docs.anlyon.com/cli/authentication"
    }
  }
}

{
  "success": false,
  "error": {
    "code": "NOT_FOUND",
    "message": "Resource not found"
  }
}

{
  "success": false,
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded. Please try again later."
  }
}