Skip to content
DocumentationAPI ReferenceChangelog
API ReferenceTalon Studio v1.0.2-beta

Audit

Read the organisation audit log.

List audit log

GET/api/v1/audit-logsaudit:read

List the organisation audit log, newest first, with cursor paging for archival. Not available on the Community Edition: audit:read needs the administer capability, so it counts as a write scope and needs an Enterprise licence.

Query parameters
limitinteger · optional
1–2,000, default 200. A non-integer, zero or negative value falls back to the default rather than erroring; a larger value is clamped to 2,000.
sincestring (date-time) · optional
Only entries created at or after this time. An unparseable date is ignored.
untilstring (date-time) · optional
Only entries created at or before this time.
cursorstring (date-time) · optional
The previous page's nextCursor; returns only entries strictly older than it.
Response
idstring (UUID)
actionstring
<prefix>.<verb>, e.g. deployment.pushed or api.detection.proposed.
categorystring
account | workspace | detection | deployment | change_request | config | threat | connection | agent | soc | other — derived from the action's prefix.
statusstring
success | failed
messagestring
metadataobject
actorNamestring · nullable
Null for actions with no user, such as a service token's writes.
actorEmailstring · nullable
targetNamestring · nullable
The target user, for account actions such as role changes.
targetEmailstring · nullable
ipAddressstring · nullable
userAgentstring · nullable
createdAtstring (ISO 8601)
Returned as { data: [...], nextCursor }. nextCursor is the oldest createdAt on the page — pass it back as cursor for the next page — or null when the page wasn't full. Actions taken through the API are logged as api.detection.proposed, api.detection.edit_proposed, api.alert.dismissed, api.case.promoted, api.card.created and api.search.executed, with the token id in metadata; their category is other.
Org-scoped, admin-only
audit:read needs an org-scoped token — a workspace-bound token is refused with 403 "Audit log access requires an org-scoped token". Only an admin can grant it, and a personal token keeps it only while its owner is still an admin.
Request
curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/audit-logs?limit=200&since=2026-09-01T00:00:00Z"
Response
{
  "data": [
    {
      "id": "3f2504e0-4f89-41d3-9a0c-0305e82c3301",
      "action": "deployment.pushed",
      "category": "deployment",
      "status": "success",
      "message": "Pushed deployment artifact to SIEM target",
      "metadata": { "workspaceId": "d41f…", "targetId": "8f3c…" },
      "actorName": "Jane Doe",
      "actorEmail": "jane.doe@example.com",
      "targetName": null,
      "targetEmail": null,
      "ipAddress": "203.0.113.10",
      "userAgent": "Mozilla/5.0 …",
      "createdAt": "2026-06-30T14:22:10.000Z"
    }
  ],
  "nextCursor": null
}