Audit events and security anomalies

Audit events use developer credentials and a workspace filter. Security anomalies use the affected application user’s token. These APIs have different authorization boundaries.

API conventions · All endpoints · Schemas

/e/v1/developer/audit/

Read workspace audit events.

Authentication: X-Developer-Token with the scope shown below, an active SyAuth plan, and access to the resource. Dashboard requests use your signed-in account.

GET

Required developer-token scope: read_audit.

Required workspace_id UUID. Optional event_type, severity (info/warn/error), actor_id, actor_type, target_id, ip_address, from/to ISO timestamps. limit defaults 50, bounded 1..100; cursor is the last item’s created_at timestamp. Returns results, next_cursor and limit. Read-only endpoint; invalid optional timestamps are ignored by the implementation.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
query	workspace_id	not supplied
query	event_type	not supplied
query	severity	not supplied
query	actor_id	not supplied
query	actor_type	not supplied
query	target_id	not supplied
query	ip_address	not supplied
query	from	not supplied
query	to	not supplied
query	cursor	not supplied
query	limit	DEFAULT_PAGE_SIZE

Related schemas: AuditEvent.

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "results": [
    {
      "id": "11111111-1111-4111-8111-111111111111",
      "workspace_id": "EXAMPLE_WORKSPACE_ID",
      "event_type": "login_success",
      "severity": "info",
      "actor_type": "developer",
      "actor_id": "EXAMPLE_ACTOR_ID",
      "actor_email": "EXAMPLE_ACTOR_EMAIL",
      "target_type": "EXAMPLE_TARGET_TYPE",
      "target_id": "EXAMPLE_TARGET_ID",
      "oauth_client_id": "EXAMPLE_OAUTH_CLIENT_ID",
      "ip_address": "EXAMPLE_IP_ADDRESS",
      "user_agent": "EXAMPLE_USER_AGENT",
      "request_id": "EXAMPLE_REQUEST_ID",
      "message": "EXAMPLE_MESSAGE",
      "metadata": {},
      "created_at": "2026-10-26T12:00:00Z"
    }
  ],
  "next_cursor": null,
  "limit": 1
}

400 — json

{
  "error": "workspace_id is required"
}

403 — json

{
  "error": "Forbidden"
}

404 — json

{
  "error": "Workspace not found"
}

/e/v1/user/security/anomalies/

Read recent application-user security anomalies.

Availability note: standalone access with the credential described below has a known authentication limitation. Check integration availability before relying on this operation. If it returns an unexpected 401, contact support with the endpoint and sanitized response.

Authentication: application-user token in Authorization: Bearer APPLICATION_TOKEN.

GET

Optional limit integer, default 50, clamped 1..200. Returns results; authenticated user only.

Request fields (combine with the requirements and schema above):

Location	Field	Fallback when absent
query	limit	50

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "results": [
    {
      "id": "11111111-1111-4111-8111-111111111111",
      "kind": "EXAMPLE_KIND",
      "severity": "EXAMPLE_SEVERITY",
      "ip_address": "EXAMPLE_IP_ADDRESS",
      "country": "EXAMPLE_COUNTRY",
      "city": "EXAMPLE_CITY",
      "user_agent": "EXAMPLE_USER_AGENT",
      "message": "EXAMPLE_MESSAGE",
      "metadata": {},
      "session_id": "EXAMPLE_SESSION_ID",
      "notified_at": "EXAMPLE_NOTIFIED_AT",
      "acknowledged_at": "EXAMPLE_ACKNOWLEDGED_AT",
      "created_at": "EXAMPLE_CREATED_AT"
    }
  ]
}

/e/v1/user/security/anomalies/{anomaly_id}/ack/

Acknowledge an anomaly belonging to the current user.

Availability note: standalone access with the credential described below has a known authentication limitation. Check integration availability before relying on this operation. If it returns an unexpected 401, contact support with the endpoint and sanitized response.

Authentication: application-user token in Authorization: Bearer APPLICATION_TOKEN.

POST

No body. Returns the updated anomaly; not found or not owned returns 404.

Path parameters: anomaly_id (uuid, required).

Success and error response examples

Illustrative values; conditional branches are alternatives. Fields vary with the operation and account configuration.

200 — json

{
  "id": "11111111-1111-4111-8111-111111111111",
  "kind": "EXAMPLE_KIND",
  "severity": "EXAMPLE_SEVERITY",
  "ip_address": "EXAMPLE_IP_ADDRESS",
  "country": "EXAMPLE_COUNTRY",
  "city": "EXAMPLE_CITY",
  "user_agent": "EXAMPLE_USER_AGENT",
  "message": "EXAMPLE_MESSAGE",
  "metadata": {},
  "session_id": "EXAMPLE_SESSION_ID",
  "notified_at": "EXAMPLE_NOTIFIED_AT",
  "acknowledged_at": "EXAMPLE_ACKNOWLEDGED_AT",
  "created_at": "EXAMPLE_CREATED_AT"
}

404 — json

{
  "error": "Not found"
}