List audit event rows

Módulo Settings

GET/audit-eventsauditEvents.list

An append-only compliance audit event, retained 7 years. Returns a cursor page of audit event rows the caller may see. The default order is `id` ascending. Supports sparse fieldsets and the filter grammar.

Requiere la capacidad audit.log.read.
Alcances de OAuth: audit.
Paginación por cursor: se aplican limit, cursor, fields, sort y filter.
Estados de error: 400, 401, 429. Los errores son detalles de problema RFC 9457.

Parámetros de ruta y de consulta

auditEvents.list: Parámetros de ruta y de consulta
Campo	Tipo	Obligatorio	Descripción
limit	Limit	No	Page size. Default 50, maximum 200.Restricciones: range 1 to 200
cursor	Cursor	No	Opaque cursor from `next_cursor` of the previous page.Restricciones: length 1 to any
fields	Fields	No	Sparse fieldset: a comma-separated list of top-level fields to return. `id` is always returned.Restricciones: pattern ^[a-z_][a-z0-9_](,[a-z_][a-z0-9_])*$
sort	Sort	No	Sort keys, comma-separated; a leading `-` sorts descending. Without `sort`, the documented default order applies (coded lists sort in numeric code order).Restricciones: pattern ^-?[a-z_][a-z0-9_](,-?[a-z_][a-z0-9_])*$
filter	Filter	No	Filter grammar `filter[field][op]=value`. Operators: eq, ne, lt, lte, gt, gte, in (comma-separated values), is_null (true or false) and contains. Conditions combine with AND.

Respuesta 200: una página de AuditEvent

auditEvents.list: AuditEvent
Campo	Tipo	Obligatorio	Descripción
id	string (uuid)	Sí	Identifier of the audit event.
org_id	string (uuid)	Sí	Identifier of the owning organization, derived from the parent row and never accepted from the caller.
created_at	string (date-time)	Sí	When the row was created.
created_by	string (uuid) \| null	Sí	Identifier of the person who created the row; null when a seed, platform or system process created it.
updated_at	string (date-time)	Sí	When the row was last updated.
updated_by	string (uuid) \| null	Sí	Identifier of the person who last updated the row; null when a seed, platform or system process updated it.
action	string	Sí	Action.Restricciones: pattern ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$
diff	object	Sí	Redacted audit diff.
actor_kind	"Person" \| "Service" \| "System"	Sí	Who acted.
actor_person_id	string (uuid) \| null	Sí	Identifier of the person who acted, when a person acted.
subject_table	string	Sí	Table of the row acted on.Restricciones: length 1 to 300
subject_id	string (uuid) \| null	Sí	Identifier of the row acted on.
actor_ip	string \| null	Sí	Client IP address of the request. Removed at redaction.Restricciones: length 1 to 300
user_agent	string \| null	Sí	Client user agent of the request. Removed at redaction.Restricciones: length 1 to 2000
request_id	string \| null	Sí	API request id, for correlating with logs.Restricciones: length 1 to 300
redacted_at	string (date-time) \| null	Sí	When personal data in the event was redacted.

{
  "data": [
    {
      "id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
      "org_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
      "created_at": "2026-10-08T14:30:00Z",
      "created_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
      "updated_at": "2026-10-08T14:30:00Z",
      "updated_by": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
      "action": "purchase_order.approved",
      "diff": {
        "type": "doc"
      },
      "actor_kind": "Person",
      "actor_person_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
      "subject_table": "purchase_orders",
      "subject_id": "0192f1e2-7c3a-7b4d-9e8f-1a2b3c4d5e6f",
      "actor_ip": "203.0.113.24",
      "user_agent": "Mozilla/5.0",
      "request_id": "req_01J9Z6",
      "redacted_at": "2026-10-08T14:30:00Z"
    }
  ],
  "next_cursor": null
}

Ejemplos de código

curl -X GET "$XOS_BASE_URL/audit-events" \
  -H "Authorization: Bearer $XOS_API_KEY"

for await (const row of xos.auditEvents.listAll()) {
  console.log(row);
}

for row in xos.audit_events.list_all():
    print(row)

xos audit-events list --all