> ## Documentation Index > Fetch the complete documentation index at: https://docs.noresponse.org/llms.txt > Use this file to discover all available pages before exploring further. # List a workspace's audit log > Read audit events within your current environment permissions. Filters apply before pagination. ## OpenAPI ````yaml /openapi.json get /v1/workspaces/{workspace_id}/audit openapi: 3.1.0 info: title: NoResponse API version: '1' description: >- The NoResponse API assesses an account creation, login or purchase and answers with the account's one current risk: a 0 to 100 score, a decision for the flow (`allow`, `step_up`, `review` or `block`), the reasons behind it and the decision for each flow. The assessment's own facts, such as its status, confidence and incomplete sources, sit under `detail`. Authenticate every request with your API key as `Authorization: Bearer nrk_...`. Call the API only from your backend. Guides, SDKs and webhook verification are at [docs.noresponse.org](https://docs.noresponse.org/). Every error is an RFC 9457 problem document; see [Errors](https://docs.noresponse.org/reference/errors). servers: - url: https://api.noresponse.org description: Production security: - tenantBearer: [] tags: - name: assess x-displayName: Assessments x-group: Assessments description: Create, read and list assessments, and report outcomes. - name: accounts x-displayName: Accounts x-group: Accounts description: >- Each of your accounts holds one current risk, and its assessments are its history. - name: usage x-displayName: Key usage x-group: Key usage description: >- Report usage of the API keys that your account creation gate issued, so a shared or stolen key raises its account's risk. - name: keys x-displayName: API keys x-group: API keys description: >- Rotate your own API key and, with the `management` scope, create, list and revoke the keys of its environment. - name: settings x-displayName: Settings x-group: Settings description: >- Read and preview environment settings, run evaluations, and publish reviewed policy with separate permissions. - name: lists x-displayName: Lists x-group: Lists description: >- Preview, allow or block accounts that use an email or email domain. Publishing changes requires policy authority. - name: integrations x-displayName: Integrations x-group: Integrations description: >- Hosted endpoints that answer your WorkOS, Auth0 or Supabase sign-up and sign-in hooks. - name: webhooks x-displayName: Webhooks x-group: Webhooks description: Your webhook endpoints, and the signed events NoResponse sends to them. - name: workspaces x-displayName: Workspaces x-group: Workspaces description: >- Manage non-owner team access, read usage and audit events, configure audit streams, and export retained account or audit data. - name: requests x-displayName: Request diagnostics x-group: Request diagnostics description: Search retained request attempts and summarize their status and latency. - name: groups x-displayName: Groups x-group: Groups description: >- Screen a group's people: create the group, upload its list of people, start screenings and record a decision on each person. - name: reviews x-displayName: Reviews x-group: Reviews description: >- Investigate accounts with assignments, comments, linked evidence, saved filters and recorded resolutions. paths: /v1/workspaces/{workspace_id}/audit: get: tags: - workspaces summary: List a workspace's audit log description: >- Read audit events within your current environment permissions. Filters apply before pagination. operationId: listAuditEvents parameters: - $ref: '#/components/parameters/WorkspaceId' - name: limit in: query required: false description: Events per page. schema: type: integer minimum: 1 maximum: 100 default: 20 - name: cursor in: query required: false description: >- next_cursor from the previous page, unchanged; keep every filter unchanged. schema: type: string minLength: 1 maxLength: 256 pattern: ^[A-Za-z0-9_-]+$ not: pattern: \n - name: environment in: query required: false description: >- Affected scope. API keys can request only their own environment. Omit to read the scopes the caller is allowed. schema: type: string enum: - live - test - workspace - name: action in: query required: false description: Exact action, such as key.created or account.deleted. schema: type: string minLength: 1 maxLength: 64 pattern: ^[!-~]+$ - name: actor in: query required: false description: Exact external user id, public API key id or console credential id. schema: type: string minLength: 1 maxLength: 256 pattern: ^[!-~]+$ - name: target_type in: query required: false description: Exact target kind, such as key, member, setting or workspace. schema: type: string minLength: 1 maxLength: 256 pattern: ^[!-~]+$ - name: target_id in: query required: false description: Public target identifier. Audit targets exclude subject identifiers. schema: type: string minLength: 1 maxLength: 128 pattern: ^[!-~]+$ - name: outcome in: query required: false description: Exact outcome. schema: type: string enum: - succeeded - denied - name: since in: query required: false description: Inclusive creation timestamp in RFC3339 format. schema: type: string format: date-time - name: until in: query required: false description: >- Exclusive creation timestamp in RFC3339 format; must follow since when both are supplied. schema: type: string format: date-time responses: '200': $ref: '#/components/responses/AuditEventListed' '400': $ref: '#/components/responses/InvalidAuditEventsRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/ControlForbidden' '404': $ref: '#/components/responses/WorkspaceNotFound' '503': $ref: '#/components/responses/ServiceUnavailable' security: - tenantBearer: [] x-codeSamples: - lang: curl label: cURL source: | curl --request GET \ --url 'https://api.noresponse.org/v1/workspaces/tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM/audit?limit=20' \ --header "Authorization: Bearer $NORESPONSE_API_KEY" - lang: typescript label: TypeScript source: | import { NoResponse } from "@noresponse/node"; const noResponse = new NoResponse({ apiKey: process.env["NORESPONSE_API_KEY"] ?? "", }); async function run() { const result = await noResponse.audit.list({ workspaceId: "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", }); for await (const page of result) { console.log(page); } } run(); - lang: python label: Python source: | from noresponse import NoResponse import os with NoResponse( api_key=os.getenv("NORESPONSE_API_KEY", ""), ) as no_response: res = no_response.audit.list(workspace_id="tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", limit=20) while res is not None: # Handle items res = res.next() - lang: go label: Go source: "package main\n\nimport(\n\t\"context\"\n\t\"os\"\n\tnoresponse \"github.com/noresponsehq/go/v12\"\n\t\"github.com/noresponsehq/go/v12/models/operations\"\n\t\"log\"\n)\n\nfunc main() {\n ctx := context.Background()\n\n s := noresponse.New(\n noresponse.WithSecurity(os.Getenv(\"NORESPONSE_API_KEY\")),\n )\n\n res, err := s.Audit.List(ctx, operations.ListAuditEventsRequest{\n WorkspaceID: \"tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM\",\n })\n if err != nil {\n log.Fatal(err)\n }\n if res != nil {\n for {\n // handle items\n\n res, err = res.Next()\n\n if err != nil {\n // handle error\n }\n\n if res == nil {\n break\n }\n }\n }\n}\n" - lang: java label: Java source: | package hello.world; import java.lang.Exception; import org.noresponse.NoResponse; import org.noresponse.models.errors.AuthenticationException; import org.noresponse.models.errors.BadRequestException; import org.noresponse.models.errors.ConflictException; import org.noresponse.models.errors.NotFoundException; import org.noresponse.models.errors.PermissionDeniedException; import org.noresponse.models.errors.RateLimitException; import org.noresponse.models.operations.ListAuditEventsRequest; import org.noresponse.models.operations.ListAuditEventsResponse; public class Application { public static void main(String[] args) throws Exception { NoResponse sdk = NoResponse.builder() .apiKey(System.getenv().getOrDefault("NORESPONSE_API_KEY", "")) .build(); ListAuditEventsRequest req = ListAuditEventsRequest.builder() .workspaceId("tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM") .build(); sdk.audit().list() .request(req) .callAsStream() .forEach((ListAuditEventsResponse item) -> { // handle page }); } } - lang: csharp label: C# source: > using NoResponse; using NoResponse.Models.Operations; using NoResponse.Models.Shared; using System; var sdk = new NoResponseClient(apiKey: Environment.GetEnvironmentVariable("NORESPONSE_API_KEY")); ListAuditEventsRequest req = new ListAuditEventsRequest() { WorkspaceId = "tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM", }; ListAuditEventsResponse? res = await sdk.Audit.ListAsync(req); while(res != null) { // handle items res = await res.Next!(); } - lang: php label: PHP source: | setSecurity( getenv('NORESPONSE_API_KEY') ?: '' ) ->build(); $request = new Operations\ListAuditEventsRequest( workspaceId: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM', ); $responses = $sdk->audit->list( request: $request ); foreach ($responses as $response) { $result = $response->result; // handle response } - lang: ruby label: Ruby source: | require 'noresponse' Models = ::NoResponse::Models s = ::NoResponse::NoResponseClient.new( api_key: ENV.fetch('NORESPONSE_API_KEY', '') ) req = Models::Operations::ListAuditEventsRequest.new( workspace_id: 'tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM' ) res = s.audit.list(request: req) unless res.nil? # handle response end components: parameters: WorkspaceId: name: workspace_id in: path required: true schema: type: string pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$ description: >- The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID. description: >- The workspace id. A workspace the acting user is not an active member of answers 404, as do another workspace than an API key's own, a malformed id and a test environment's id. responses: AuditEventListed: description: One page of the workspace's audit log, newest first. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/json: schema: $ref: '#/components/schemas/AuditEventList' examples: page: value: workspace_id: tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM items: - id: aud_01JA2ZG7H8J9K0M1N2P3Q4R5S6 workspace_id: tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM environment: test action: webhook_endpoint.created outcome: succeeded actor: type: api_key key_id: 01JA2ZF6G7H8J9K0M1N2P3Q4R5 target: type: webhook_endpoint id: whe_01JA2ZD0E1F2G3H4J5K6M7N8P9 created_at: '2026-10-23T09:20:00.000Z' - id: aud_01JA2ZF6G7H8J9K0M1N2P3Q4R5 workspace_id: tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM environment: live action: member.removed outcome: denied actor: type: user external_user_id: auth0|65f1c2d3e4 console_credential_id: 01JA2Z8K6Q4V7W9XBCDEFGHJKM target: type: member id: mem_01JA2Z8K6Q4V7W9XBCDEFGHJKM created_at: '2026-10-23T09:15:00.000Z' - id: aud_01JA2ZE5F6G7H8J9K0M1N2P3Q4 workspace_id: tnt_01JA2Z8K6Q4V7W9XBCDEFGHJKM environment: live action: member.role_changed outcome: succeeded actor: type: user external_user_id: user_2EXAMPLE console_credential_id: 01JA2Z8K6Q4V7W9XBCDEFGHJKM target: type: member id: mem_01JA2ZB4C5D6E7F8G9H0JKMNPQ detail: role: admin created_at: '2026-10-23T09:10:00.000Z' next_cursor: AQAAAABpAAAAAAYV2Q InvalidAuditEventsRequest: description: >- A query parameter is unknown, repeated or out of range, the time interval is invalid, the cursor fails authentication or belongs to another workspace or filter, the cursor has expired, or a console credential named no valid NR-Acting-User. invalid_params names offending parameters without their values. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - invalid_request - invalid_cursor Unauthorized: description: No API key, or one that is malformed, unknown, revoked or expired. headers: Cache-Control: schema: type: string const: no-store required: true WWW-Authenticate: schema: type: string const: Bearer realm="noresponse-assessments" required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - unauthorized ControlForbidden: description: >- workspace_forbidden: an API key without the management scope, or any API key on a route other than the key, settings and list routes. role_forbidden: a console credential's acting user is an active member whose role does not grant the operation. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - workspace_forbidden - role_forbidden WorkspaceNotFound: description: >- No such workspace, member, invite, key or environment for the caller. A workspace the acting user is not an active member of answers this too, as do another workspace and the other environment to an API key, so no answer shows which workspaces exist. headers: Cache-Control: schema: type: string const: no-store required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - not_found ServiceUnavailable: description: >- The assessment could not be admitted at all (overload, shutdown or a dependency down). An assessment that was admitted answers partial or pending instead of 503. headers: Cache-Control: schema: type: string const: no-store required: true Retry-After: description: >- Whole seconds to wait before polling or retrying. Required on 202, 429 and 503. schema: type: string pattern: >- ^(?:[1-9]|[1-9][0-9]|[1-9][0-9]{2}|[12][0-9]{3}|3[0-5][0-9]{2}|3600)$ description: Whole decimal seconds; wait at least this long. required: true X-Request-ID: description: The request correlation id, 32 lowercase hexadecimal characters. schema: type: string pattern: ^[0-9a-f]{32}$ not: pattern: \n required: true content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - service_unavailable schemas: AuditEventList: title: Audit event list description: >- GET /v1/workspaces/{workspace_id}/audit: one page of the workspace's audit log, both environments, newest first. Events are kept for as long as the workspace exists and are deleted with it. next_cursor is present only when another page exists. type: object additionalProperties: false required: - workspace_id - items properties: workspace_id: type: string pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$ description: >- The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID. items: type: array maxItems: 100 items: title: Audit event description: >- One privileged workspace action with its actor, target, outcome and time. Successful data changes commit their audit evidence atomically. Sensitive exports record access before returning bytes. Details exclude secrets and subject identifiers. type: object additionalProperties: false required: - id - workspace_id - environment - action - outcome - actor - target - created_at properties: id: type: string pattern: ^aud_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- Opaque, server-assigned event id: aud_ and a 26-character ULID. workspace_id: type: string pattern: ^[A-Za-z0-9][A-Za-z0-9_.-]{0,122}$ description: >- The workspace id, which is also its live environment's workspace id; the test environment's is the same id with:test appended. A workspace created through the API is tnt_ and a 26-character ULID. environment: enum: - live - test description: >- The affected live or test environment. Workspace-wide changes keep live here for compatibility; affected_environment identifies their workspace scope explicitly. action: type: string maxLength: 64 pattern: ^[a-z_]+(\.[a-z_]+)+$ description: >- What happened, as resource.verb: workspace.created, member.role_changed, member.removed, invite.created, invite.revoked, invite.accepted, key.rotated, webhook_endpoint.created, webhook_endpoint.deleted, webhook_endpoint.secret_rotated, integration.created, integration.deleted, integration.secret_rotated, list_entry.created, list_entry.deleted, webhook_endpoint.test_sent, webhook_endpoint.verification_requested, webhook_endpoint.delivery_replayed, assessment.created, assessment.outcome_recorded, assessment.deleted, account.outcome_recorded, account.enforcement_recorded, account.deleted, account.exported. A change with no finer name carries the permission it used, such as keys.live.write. A member's read of raw evidence is breach_records.read or review_locations.read, with the assessment and counts and no value. New actions may appear; treat an unknown one as a change to its target. outcome: enum: - succeeded - denied description: >- succeeded: the change took effect. denied: an active member's role did not allow it, and nothing changed. actor: anyOf: - type: object additionalProperties: false required: - type - external_user_id - console_credential_id properties: type: const: user external_user_id: type: string minLength: 1 maxLength: 256 pattern: ^[!-~]{1,256}$ description: >- The user's id at the identity provider the console signs people in with: 1 to 256 printable ASCII characters with no space, compared exactly. console_credential_id: type: string pattern: ^[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- The public id of the console credential the user acted through. principal_id: type: string pattern: ^mem_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- Stable workspace principal id, retained across identity-provider subject migration. Absent for older events. - type: object additionalProperties: false required: - type - key_id properties: type: const: api_key key_id: type: string minLength: 1 maxLength: 128 pattern: ^[!-~]{1,128}$ description: >- The public id of the workspace API key that made the change. target: type: object additionalProperties: false required: - type properties: type: enum: - workspace - member - invite - key - setting - webhook_endpoint - integration - billing - review description: The kind of resource the change acted on. id: type: string minLength: 1 maxLength: 128 pattern: ^[!-~]{1,128}$ description: The resource's id, when it has one. detail: type: object additionalProperties: type: string maxLength: 128 pattern: ^[ -~]*$ description: >- At most 8 short facts about the change, keyed by lowercase names: the role a member was given or accepted (role), the invite an accepted member used (invite_id), the key that replaced a rotated one (new_key_id), the assessment a member's change acted on (assessment_id). Absent when there are none. created_at: type: string format: date-time affected_environment: enum: - live - test - workspace description: >- The affected scope, independent of the tenant partition storing the event. Workspace-wide membership and invitation changes use workspace. request_id: type: string minLength: 1 maxLength: 128 pattern: ^[!-~]{1,128}$ description: >- Validated request correlation id, also returned in X-Request-ID, linking this event to request diagnostics. Absent on historical events without correlation. $defs: audit_event_id: type: string pattern: ^aud_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- Opaque, server-assigned event id: aud_ and a 26-character ULID. user_actor: type: object additionalProperties: false required: - type - external_user_id - console_credential_id properties: type: const: user external_user_id: type: string minLength: 1 maxLength: 256 pattern: ^[!-~]{1,256}$ description: >- The user's id at the identity provider the console signs people in with: 1 to 256 printable ASCII characters with no space, compared exactly. console_credential_id: type: string pattern: ^[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- The public id of the console credential the user acted through. principal_id: type: string pattern: ^mem_[0-7][0-9A-HJKMNP-TV-Z]{25}$ description: >- Stable workspace principal id, retained across identity-provider subject migration. Absent for older events. key_actor: type: object additionalProperties: false required: - type - key_id properties: type: const: api_key key_id: type: string minLength: 1 maxLength: 128 pattern: ^[!-~]{1,128}$ description: >- The public id of the workspace API key that made the change. next_cursor: type: string minLength: 1 maxLength: 256 pattern: ^[A-Za-z0-9_-]+$ description: >- Opaque cursor for the next page, MAC'd by the server and bound to the workspace it was issued for. Pass it back unchanged as cursor; a tampered, foreign or expired cursor answers 400 invalid_cursor. Problem: title: Problem details error description: >- RFC 9457 problem-details error body returned by every non-2xx API response, extended with a stable machine code and request id. type: object additionalProperties: false required: - type - title - status - detail - code - request_id properties: type: type: string format: uri-reference title: type: string status: type: integer minimum: 400 maximum: 599 detail: type: string instance: type: string format: uri-reference code: type: string request_id: type: string minLength: 1 invalid_params: type: array items: type: object additionalProperties: false required: - field - reason properties: field: type: string minLength: 1 reason: type: string minLength: 1 example: type: string minLength: 1 securitySchemes: tenantBearer: type: http scheme: bearer description: >- Your API key, sent as `Authorization: Bearer `. A key is `nrk_live_` or `nrk_test_`, a 26-character key id, `_` and a 43-character secret. Account, audit and usage data stay within the key's environment. Dedicated team scopes apply across the workspace. `assess` creates and reads assessments, records outcomes and reports key usage. `investigate` reads accounts, assessment history and request diagnostics without export or enforcement access. The legacy `history` scope also permits account exports, submitted identifiers and enforcement reports. `delete` permits account and assessment deletion. `evidence` or `detailed` adds detailed merged evidence and submitted identifiers where the operation permits them. Neither grants access to the underlying resource alone. `exports` permits exports with the underlying account or audit scope. `audit` reads audit events and `usage` reads usage. `audit_manage` manages audit streams and retention, and includes audit-read and export authority. `webhooks` manages webhook endpoints. `integrations` manages hosted auth-provider integrations. `management` manages keys, settings, lists, reviews and policy evaluations in the key's environment. New keys cannot exceed the issuer's effective permissions. `settings` reads configuration, previews policy and list changes, runs evaluations and changes retention. Publishing decision policy or changing lists requires `settings` and `policy_publish` together, or the legacy `management` scope. `groups` creates and reads groups, adds people, starts and cancels screenings and records decisions on people, in the key's environment. `members` reads the workspace directory. `members_manage` also administers non-owner members and invitations. These scopes require a live key issued by a current owner with access to both environments. They grant access across the workspace. `management` does not grant team access. API keys cannot change owners or accept invitations. A missing, unknown, revoked or expired key answers 401. A valid key without a required scope answers 403. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.