Audit log and live streams
The append-only audit trail, its sinks and schedules, and the scan event streams.
| Method | Path | Needs | Returns |
|---|---|---|---|
| GET | /organizations/current/audit?action=&targetType=&actorUserId=&since= | audit.read | newest first, cursor paginated |
| GET | /organizations/current/audit/actions | audit.read | the distinct actions recorded, for filters |
| GET | /organizations/current/audit/sinks | audit.read | SIEM sinks the trail streams to |
| GET | /organizations/current/audit/export-schedules | audit.read | scheduled exports |
| POST | /scans/:scanId/stream-token | scan.read | 201 { token, expiresAt }, two minutes, bound to the scan |
| GET | /scans/:scanId/events?token= | the stream token | server-sent events: status, step, finding, done |
Owners and admins read the audit trail; it is tenant-scoped and kept for four hundred days. Streams carry the same frames as the free-scan stream, so one reader serves both.
Something here wrong, missing or out of date? Tell us and we will fix the page.