List audit events.
const url = 'https://api.siteqwality.com/v1/audit-events?actor_type=session';const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://api.siteqwality.com/v1/audit-events?actor_type=session' \ --header 'Authorization: Bearer <token>'Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Query Parameters
Section titled “Query Parameters ”Who performed an audited action. Mirrors customer_audit_log.actor_type.
An action and its dot-children: http.job matches http.job.regions, not http.jobs.
RFC 3339; events at or after it, within the last 90 days.
RFC 3339; events at or before it.
1 to 200, default 50.
next_cursor from the previous page.
Responses
Section titled “ Responses ”The audit log, newest first. Keys need the read:audit scope
{"data": [...], "next_cursor": ...}; the /v1 shaping keeps it as is.
object
One row in the customer audit-log list response. request_ip is
stringified for JSON transport (Postgres INET round-trips as
IpNetwork).
object
The API key that acted, when actor_type is api_key. Null on rows
written before attribution landed (2026-08-06).
The key’s friendly name at read time (keys are revoked, never deleted, so this resolves for historical rows too).
Staff user id when the action was performed under impersonation.
The acting user’s email: the person behind a session, an AI assistant or a partner action (or the user staff impersonated).
mcp when the change came through the MCP server (an AI assistant’s
tool call), whatever credential it used.
The MCP tool that made the change, when via is mcp.
On an oauth.authorize row: whether the member allowed the app.
On an oauth.authorize row: the scopes the member granted.
The observed configuration around one successful mutation. Missing sides mean create or delete.
object
object
object
Times to run through every level again after the first pass.
object
What happens when the repeats are used up, or no level reaches anyone.
The policy escalate_to_policy runs once; null otherwise.
object
object
object
Weekly layers only: weekday of the handoff, 0 = Sunday .. 6 = Saturday,
interpreted together with handoff_time in the schedule’s timezone.
The layer’s own IANA zone for handoffs and restrictions; absent means the schedule’s.
Windows the layer covers; empty means always.
A window a layer covers, repeated every day or every week in the layer’s zone. A window that runs past midnight (or past the end of the week) carries on into the next day.
object
Weekly only: the weekday the window opens, 0 = Sunday .. 6 = Saturday.
HH:MM, 24-hour local time.
1 to 1440 for daily windows, 1 to 10080 for weekly ones.
The current version’s number (1 until the layer is edited). Set by the edit and versions routes.
When the current version took over. Set by the edit and versions routes.
object
object
object
object
Whether a failing monitor opens an incident on its service.
Deprecated and unused: every failure joins the service’s open auto incident.
A failure this many minutes after a resolved auto incident’s last alert reopens it; 0 never does.
Whether an auto-created incident resolves itself once every monitor recovers.
When the service was switched off; while set its monitors open no auto incidents.
Prefills Publish and words auto-published incidents.
object
The public title; auto-published incidents never show the monitor’s name.
The first public update when the incident is published.
The public “Resolved” update.
The team that owns the service; filter the list with team.
Free-form labels; filter the list with tag.
Who is on call for this service; without it, the escalation policy’s first level.
The roll-up of incidents, monitors, maintenance and on call. On the list and get routes.
object
The worst of incident and monitor state. Maintenance never changes it.
A maintenance window naming this service is running now. It holds paging, never the status.
Linked monitors failing now; paused ones are left out.
When the newest incident on the service opened.
The service’s on-call schedule, else every user and schedule on the policy’s first level.
One person on call for a service right now.
object
The schedule that puts them on call; absent for a user named on the policy directly.
When the schedule hands off; absent for a direct user or past 90 days.
object
object
object
The settings as the configuration audit records them.
object
object
object
Times to run through every level again after the first pass.
object
What happens when the repeats are used up, or no level reaches anyone.
The policy escalate_to_policy runs once; null otherwise.
object
object
object
Weekly layers only: weekday of the handoff, 0 = Sunday .. 6 = Saturday,
interpreted together with handoff_time in the schedule’s timezone.
The layer’s own IANA zone for handoffs and restrictions; absent means the schedule’s.
Windows the layer covers; empty means always.
A window a layer covers, repeated every day or every week in the layer’s zone. A window that runs past midnight (or past the end of the week) carries on into the next day.
object
Weekly only: the weekday the window opens, 0 = Sunday .. 6 = Saturday.
HH:MM, 24-hour local time.
1 to 1440 for daily windows, 1 to 10080 for weekly ones.
The current version’s number (1 until the layer is edited). Set by the edit and versions routes.
When the current version took over. Set by the edit and versions routes.
object
object
object
object
Whether a failing monitor opens an incident on its service.
Deprecated and unused: every failure joins the service’s open auto incident.
A failure this many minutes after a resolved auto incident’s last alert reopens it; 0 never does.
Whether an auto-created incident resolves itself once every monitor recovers.
When the service was switched off; while set its monitors open no auto incidents.
Prefills Publish and words auto-published incidents.
object
The public title; auto-published incidents never show the monitor’s name.
The first public update when the incident is published.
The public “Resolved” update.
The team that owns the service; filter the list with team.
Free-form labels; filter the list with tag.
Who is on call for this service; without it, the escalation policy’s first level.
The roll-up of incidents, monitors, maintenance and on call. On the list and get routes.
object
The worst of incident and monitor state. Maintenance never changes it.
A maintenance window naming this service is running now. It holds paging, never the status.
Linked monitors failing now; paused ones are left out.
When the newest incident on the service opened.
The service’s on-call schedule, else every user and schedule on the policy’s first level.
One person on call for a service right now.
object
The schedule that puts them on call; absent for a user named on the policy directly.
When the schedule hands off; absent for a direct user or past 90 days.
object
object
object
The settings as the configuration audit records them.
object
Send back as cursor for the next page; null on the last one.
Example
{ "data": [ { "configuration_change": { "before": { "settings": { "on_exhausted": "notify_owners" }, "kind": "escalation_policy" }, "after": { "settings": { "on_exhausted": "notify_owners" }, "kind": "escalation_policy" } } } ]}Invalid filter, limit or cursor
An RFC 9457 problem, the body of every /v1 error.
object
https://docs.siteqwality.com/errors/ and the failure’s code, such as not_found.
urn:uuid: and the request id.
The invalid fields, when the request body was refused.
One validation failure; pointer is an RFC 6901 pointer into the request body.
object
Example generated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "instance": "example", "errors": [ { "pointer": "example", "detail": "example" } ]}Missing or invalid credentials
An RFC 9457 problem, the body of every /v1 error.
object
https://docs.siteqwality.com/errors/ and the failure’s code, such as not_found.
urn:uuid: and the request id.
The invalid fields, when the request body was refused.
One validation failure; pointer is an RFC 6901 pointer into the request body.
object
Example generated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "instance": "example", "errors": [ { "pointer": "example", "detail": "example" } ]}The key or member may not do this, or lacks the scope it needs
An RFC 9457 problem, the body of every /v1 error.
object
https://docs.siteqwality.com/errors/ and the failure’s code, such as not_found.
urn:uuid: and the request id.
The invalid fields, when the request body was refused.
One validation failure; pointer is an RFC 6901 pointer into the request body.
object
Example generated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "instance": "example", "errors": [ { "pointer": "example", "detail": "example" } ]}Too many requests; wait for the time in Retry-After
An RFC 9457 problem, the body of every /v1 error.
object
https://docs.siteqwality.com/errors/ and the failure’s code, such as not_found.
urn:uuid: and the request id.
The invalid fields, when the request body was refused.
One validation failure; pointer is an RFC 6901 pointer into the request body.
object
Example generated
{ "type": "example", "title": "example", "status": 1, "detail": "example", "instance": "example", "errors": [ { "pointer": "example", "detail": "example" } ]}