Skip to main content
GET
Preview. This endpoint is available to organisations with the audit log. Organisations that do not record audit events receive 409 recording_disabled.
Returns your organisation’s audit events in the order Wordsmith recorded them, oldest first. It is built for security tools such as Microsoft Sentinel and Splunk, which poll it every few minutes and keep the next_cursor of each page.
  1. Make the first request with start_time, or with no parameters to start at the oldest event still kept.
  2. Store next_cursor from every response, including an empty one.
  3. While has_more is true, request again at once with that cursor.
  4. When has_more is false, wait for your polling interval, then request again with the stored cursor.
Each event is delivered at least once. If a request fails or your tool crashes before it stores the cursor, the next request returns some events again, so deduplicate by event_id. Events can arrive out of occurred_at order: a sign-in event can be recorded minutes or hours after it happened, and it is then returned after events that occurred later. Order and resume by the cursor, never by occurred_at.

​
Authentication

Send an API key with the audit:read scope, or a full-access key, as a bearer token in the Authorization header. The key’s owner must be allowed to export the audit log; this is checked on every request, so a key stops working when its owner loses that permission. An OAuth access token with audit:read also works for organisations in the OAuth pilot. The cursor belongs to your organisation, not to the key, so you can rotate the key and carry on from the same cursor.

​
Query parameters

​
string
The next_cursor from the previous response. When it is present, start_time and end_time are ignored.
​
string
RFC 3339 timestamp with a time zone, such as 2026-10-22T14:00:00Z. Without a cursor, start at events recorded at or after this time.
​
string
RFC 3339 timestamp with a time zone. Without a cursor, stop at events recorded at or before this time. The next_cursor of the last page then continues after the window.
​
integer
default:"100"
Events per page, from 1 to 100.
​
string
Comma-separated categories to return: authentication, identity_management, access, credentials, tool_execution, internal_tool_execution, audit_access and configuration. Defaults to every category except internal_tool_execution, the calls the Wordsmith agent makes to its own tools.

​
Response

​
array
The events, oldest first. A page can hold fewer than limit events, or none, while has_more is true: the request stops after reading a bounded part of the feed.
​
string
Always present. Store it and send it with the next request, even when data is empty.
​
boolean
true when more events may be ready now. Request again at once.
Each event is a stream envelope (stream_schema_version 1). Every key is always present, and a field with no value is null:

​
Freshness and rate limits

The feed is read up to two minutes behind the current time, so an event reaches this endpoint up to two minutes after it is recorded. A cursor never expires: every event your organisation’s audit log keeps stays readable. Each API key, or each OAuth app and user, can make 60 requests a minute to this endpoint. These requests do not count towards your organisation’s API request limit.

​
Errors