Skip to content
Holst
English
РусскийEnglish
Esc
↑↓navigate↵open⌘Jpreview

Get audit events

Returns a list of audit events for an organization. Requires a personal access token with the organization:audit_events_read scope. The token owner must be an administrator of the organization.

GET/v1/organizations/{organizationId}/audit_events
Authorization
AuthorizationBearer token (holst_pat_...) · headerrequired

Holst personal access token sent in the Authorization header using the Bearer holst_pat_... format.

Path parameters
organizationIdstring<uuid>required

ID of the organization for which to return audit events.

Query parameters
actionTypesstring[]

Audit action types to include. Separate multiple values with commas. All action types are returned when this parameter is omitted.

startTimestring<date-time>

Earliest event time to include, in RFC 3339 format. The boundary is inclusive. When omitted, no lower time boundary is applied.

endTimestring<date-time>

Latest event time to include, in RFC 3339 format. The boundary is inclusive and must not be earlier than startTime. When omitted, no upper time boundary is applied. For a stable finite export in ascending order, set endTime and keep it unchanged on every page.

pageSizeinteger

Maximum number of events per page.

min 1 · max 1000 · default: 100
orderstring

Sort direction by occurredAt, then by id.

default: "desc"
Allowed:ascdesc
cursorstring

Pagination cursor from nextCursor in a previous response. The cursor is opaque, marks a position only, and does not preserve query parameters. Keep the same filters and sort order when retrieving the next page. Changing them can cause events to be skipped or repeated.

Responses
200

A page of organization audit events.

auditEventsAuditEvent[]required

Audit events in the requested sort order.

Show properties
Array of AuditEvent
idstringrequired
occurredAtstring<date-time>required
actionAuditEventActionrequired
Show properties
typestringrequired

Extensible identifier of the action.

detailsobjectrequired

Action-specific metadata whose fields depend on action.type.

actorAuditEventActorrequired
Show properties
typestringrequired

Actor type: user, anonymous, system, or unknown.

idstringrequired
namestring
emailstring
contextAuditEventContextrequired
Show properties
requestIdstring
sessionIdstring
requestIpstring
scopeAuditEventScoperequired
Show properties
organizationIdstringrequired
workspaceIdstring
workspaceNamestring
channelIdstring
entityAuditEventEntityrequired
Show properties
typestring

Entity type: channel, workspace, organization, or user.

subtypestring
idstring
namestring
emailstring
nextCursorstring

Cursor for retrieving the next page. Omitted when there are no more events.

400

The request is invalid.

errCodestringrequired

Machine-readable error code.

msgstringrequired

Human-readable error message.

varsobject | nullrequired

Structured values associated with the error, or null.

401

Authentication credentials are missing or invalid.

errCodestringrequired

Machine-readable error code.

msgstringrequired

Human-readable error message.

varsobject | nullrequired

Structured values associated with the error, or null.

403

The authenticated client does not have permission to perform the operation.

errCodestringrequired

Machine-readable error code.

msgstringrequired

Human-readable error message.

varsobject | nullrequired

Structured values associated with the error, or null.

429

The authenticated user has exceeded the request rate limit.

errCodestringrequired

Machine-readable error code.

msgstringrequired

Human-readable error message.

varsobject | nullrequired

Structured values associated with the error, or null.

500

An unexpected error occurred while processing the request.

errCodestringrequired

Machine-readable error code.

msgstringrequired

Human-readable error message.

varsobject | nullrequired

Structured values associated with the error, or null.

Request
curl -X GET "https://api.holst.so/v1/organizations/497f6eca-6276-4993-bfeb-53cbbbba6f08/audit_events" \
  -H "Authorization: Bearer YOUR_TOKEN"
Response
{
  "auditEvents": [
    {
      "id": "46b44beb-b585-4598-a241-6bacea128799",
      "occurredAt": "2026-08-31T09:20:35.213Z",
      "action": {
        "type": "workspace_create",
        "details": {
          "fields": {
            "name": "Marketing"
          }
        }
      },
      "actor": {
        "type": "user",
        "id": "87736cf6-ca84-4519-8fc2-81c815b76c63",
        "name": "Ivan Petrov",
        "email": "ivan@example.com"
      },
      "context": {
        "requestId": "4f7f8a01-3a71-42f9-b7b2-71dca2cb55c8",
        "sessionId": "c192570a-3c98-464f-9e78-0cee7fddc864",
        "requestIp": "203.0.113.10"
      },
      "scope": {
        "organizationId": "d311fcba-32ba-417c-aabb-221a819f2ea4",
        "workspaceId": "069018a1-f7ae-42f7-adc7-d6684364abca",
        "workspaceName": "Marketing"
      },
      "entity": {
        "type": "workspace",
        "id": "069018a1-f7ae-42f7-adc7-d6684364abca",
        "name": "Marketing"
      }
    }
  ]
}