Skip to main content
GET
List Audit Events
string
Filter by action type: incident.acknowledge, incident.snooze, approval.approve, approval.reject, runbook.create, runbook.update, runbook.delete, remediation.execute, config.update
string
Filter by user who performed the action
string
Filter by affected resource (e.g., INC-20260319-001)
string
Filter events from a given ISO 8601 date
string
Filter events up to a given ISO 8601 date
integer
default:"1"
Page number
integer
default:"50"
Items per page (maximum 200)

Authorizations

Authorization
string
header
required

Bearer token issued by the operator. Format: Authorization: Bearer <token>.

Query Parameters

action
string

Filter by action type.

Example:

"approval.approve"

user
string

Filter by user.

resource
string

Filter by affected resource.

since
string<date-time>

ISO 8601 timestamp lower bound.

until
string<date-time>

ISO 8601 timestamp upper bound.

page
integer
default:1

Page number.

pageSize
integer
default:50

Items per page (max 200).

Required range: x <= 200

Response

Paginated audit log

apiVersion
string
Example:

"v1"

kind
string
Example:

"AuditLogList"

metadata
object
items
object[]