Skip to main content
GET
Error

Authorizations

​
Authorization
string
header
required

API token obtained from the Tokens endpoint or CLI device login. Include as Authorization: Bearer <token>. Requests made with a managed CLI session also include X-Strix-Workspace: <organization_id> to pin a process to the workspace it started in; recovery endpoints report the current workspace after a concurrent switch.

Query Parameters

​
page
integer
default:1

Page number of the result set. The first page is 1.

Required range: x >= 1
​
limit
integer
default:50

Maximum number of events per page. The default is 50 and the maximum is 1000.

Required range: 1 <= x <= 1000
​
action
string

Return only events with this action name, for example scan.created.

​
resource_type
string

Return only events about this resource type, for example scan or vulnerability.

​
actor_id
string

Return only events performed by this actor (user or token) ID.

​
date_from
string<date-time>

Return only events that occurred at or after this time (ISO 8601).

​
date_to
string

Plain YYYY-MM-DD values include the full UTC day. Full ISO datetimes are exact upper bounds.

​
format
enum<string>
default:json

Response format. json returns a paginated JSON page. The other values return a file export of matching events.

Available options:
json,
csv,
ndjson,
jsonl,
snowflake,
splunk
​
all
boolean
default:false

When true with an export format, stream all matching audit events instead of a single page.

Response

Audit events or an audit export.

​
data
object[]
required
​
pagination
object
required