Skip to main content
GET
cURL

Authorizations

Authorization
string
header
required

Your API key, sent as Authorization: Bearer <key>. A key is nrk_live_ or nrk_test_, a 26-character key id, _ and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace.

assess creates and reads assessments, records outcomes and reports key usage. investigate reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy history scope also permits account exports, submitted identifiers and enforcement reports. delete permits account and assessment deletion.

evidence or detailed adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. exports permits exports with the underlying account or audit scope. audit reads audit events and usage reads usage. audit_manage manages audit streams and retention, and includes audit-read and export authority.

webhooks manages webhook endpoints. integrations manages hosted auth-provider integrations. management manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions.

settings reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires settings and policy_publish together, or the legacy management scope.

groups creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment.

members reads the workspace directory. members_manage also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. management does not grant team access. API keys cannot change owners or accept invitations.

A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403.

Path Parameters

workspace_id
string
required

The workspace id. A workspace the acting user is not an active member of answers 404, as do another workspace than an API key's own, a malformed id and a test environment's id. The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID.

Pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$

Query Parameters

limit
integer
default:20

Events per page.

Required range: 1 <= x <= 100
cursor
string

next_cursor from the previous page, unchanged; keep every filter unchanged.

Required string length: 1 - 256
Pattern: ^[A-Za-z0-9_-]+$
environment
enum<string>

Affected scope. API keys can request only their own environment. Omit to read the scopes the caller is allowed.

Available options:
live,
test,
workspace
action
string

Exact action, such as key.created or account.deleted.

Required string length: 1 - 64
Pattern: ^[!-~]+$
actor
string

Exact external user id, public API key id or console credential id.

Required string length: 1 - 256
Pattern: ^[!-~]+$
target_type
string

Exact target kind, such as key, member, setting or workspace.

Required string length: 1 - 256
Pattern: ^[!-~]+$
target_id
string

Public target identifier. Audit targets exclude subject identifiers.

Required string length: 1 - 128
Pattern: ^[!-~]+$
outcome
enum<string>

Exact outcome.

Available options:
succeeded,
denied
since
string<date-time>

Inclusive creation timestamp in RFC3339 format.

until
string<date-time>

Exclusive creation timestamp in RFC3339 format; must follow since when both are supplied.

Response

One page of the workspace's audit log, newest first.

GET /v1/workspaces/{workspace_id}/audit: one page of the workspace's audit log, both environments, newest first. Events are kept for as long as the workspace exists and are deleted with it. next_cursor is present only when another page exists.

workspace_id
string
required

The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID.

Pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$
items
Audit event · object[]
required
Maximum array length: 100
next_cursor
string

Opaque cursor for the next page, MAC'd by the server and bound to the workspace it was issued for. Pass it back unchanged as cursor; a tampered, foreign or expired cursor answers 400 invalid_cursor.

Required string length: 1 - 256
Pattern: ^[A-Za-z0-9_-]+$