List Audit log events
Retrieve the authenticated account’s own Audit log events, newest first, in cursor-paginated pages. Intended for pulling the Audit log into a SIEM.
Pagination is cursor-based: read meta.next_page_url and replay it verbatim to fetch the next page. next_page_url is null on the last or empty page. The time window and cursor must be held constant across pages; the recommended way to guarantee this is to replay the returned next_page_url unchanged.
No field filters are exposed: callers pull the full time window and filter on their own side (the SIEM).
Validation errors (missing or invalid start_date or end_date, a window wider than 30 days, a malformed cursor, or a window change mid-pagination) return 400.
Rate limits (per account): 10 requests per second, 120 per minute, and 40,000 per day. A 429 means a limit was exceeded; back off and retry. For ongoing ingestion, poll on a steady cadence (for example, every few minutes) rather than in a tight loop.
Backfilling vs incremental pulls: a single request covers at most 30 days. To backfill more history, issue successive requests over adjacent windows of up to 30 days. For incremental pulls, set start_date to just after the newest timestamp you have already stored, then follow next_page_url until it is null.
Authentication
Bearer authentication of the form Bearer <token>, where token is your auth token.
Query parameters
Start of the time window (inclusive), ISO 8601. The window (end_date - start_date) may not exceed 30 days.
End of the time window (inclusive), ISO 8601. When omitted it defaults to the request time (UTC); the resolved value is reflected in next_page_url, so replay the returned next_page_url verbatim to keep the window fixed across pages.
Maximum events per page. Out-of-range or non-integer values are rejected with 400; the applied limit is not echoed in the response.
Opaque base64-encoded pagination cursor from a previous response's meta.next_page_url. Treat it as an opaque token, not an id. The time window and cursor must be held constant across pages: replay the returned next_page_url unchanged.
Response
A cursor-paginated page of Audit log events
The page of Audit log events (at most limit items)