curl --request GET \
--url https://api.openworklabs.com/v1/audit/operations \
--header 'x-api-key: <api-key>'import requests
url = "https://api.openworklabs.com/v1/audit/operations"
headers = {"x-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.openworklabs.com/v1/audit/operations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.openworklabs.com/v1/audit/operations",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.openworklabs.com/v1/audit/operations"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.openworklabs.com/v1/audit/operations")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.openworklabs.com/v1/audit/operations")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"operations": [
{
"id": "<string>",
"kind": "<string>",
"scope": "<string>",
"action": "<string>",
"initiatingActor": {
"type": "user",
"id": "<string>",
"memberId": "<string>",
"credentialId": "<string>"
},
"origin": "api",
"originTrust": "authenticated",
"startedAt": "2023-11-07T05:31:56Z",
"outcome": "running",
"eventCount": 0,
"logicalBytes": 0,
"resources": [
{
"type": "<string>",
"id": "<string>",
"relationship": "target",
"label": "<string>"
}
]
}
],
"nextCursor": "<string>",
"snapshotAt": "2023-11-07T05:31:56Z"
}{
"error": "audit_invalid_query"
}{
"error": "unauthorized"
}{
"error": "forbidden",
"message": "<string>"
}{
"error": "organization_not_found"
}{
"error": "audit_cursor_expired"
}{
"error": "audit_unavailable"
}List retained audit operations
Organization administrator access to currently captured, retained audit history only; this is not coverage of every cloud action. Requires deployment visibility. Legacy arbitrary payloads are preserved separately and are not backfilled or returned. One operation may contain multiple child events. Visibility is independent of capture entitlement. No duration, charge or continuous-drain guarantee is made. Default limit 50, maximum 100. Cursors are signed, organization/filter/mode scoped and expire 24 hours after the first page (not renewed). Repeat the same filters; limit may change. snapshotAt freezes the page set: events recorded after it are excluded, including later children of an existing operation. Events are ordered by their time-ordered IDs; there is no per-organization sequence. Exports leave out the last few seconds so in-flight writes cannot land behind a page already read. Start a new snapshot to see newer events. This is not a lossless-drain or retention protection guarantee. Time filters are inclusive operation-start bounds (ISO date or offset date-time; date-only means UTC midnight). actorId is the initiating user ID; outcome is the current OPERATION outcome, not an event outcome. action matches an exact stable action of any child event within the snapshot. searchId is an exact case-sensitive ID match (1..255 characters, no controls), not free-text search: operation ID OR any canonical retained child event ID, child envelope requestId or child resource reference ID, scoped to this organization and operation within the snapshot. Legacy payloads are not searched. All other filters are AND combined with searchId. Resource filters match stored references within the snapshot, without live-resource joins; resourceType requires resourceId. Operation outcome/count/byte projections remain current rather than historical as-of-snapshot values. Newest operations first, ordered by server first-recorded time then ID. Summary action and resources describe the FIRST event only (at most 256 stored references), not all affected resources. Expand events for complete evidence; X-Audit-Resource-Scope is first_event.
curl --request GET \
--url https://api.openworklabs.com/v1/audit/operations \
--header 'x-api-key: <api-key>'import requests
url = "https://api.openworklabs.com/v1/audit/operations"
headers = {"x-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.openworklabs.com/v1/audit/operations', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.openworklabs.com/v1/audit/operations",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.openworklabs.com/v1/audit/operations"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.openworklabs.com/v1/audit/operations")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.openworklabs.com/v1/audit/operations")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"operations": [
{
"id": "<string>",
"kind": "<string>",
"scope": "<string>",
"action": "<string>",
"initiatingActor": {
"type": "user",
"id": "<string>",
"memberId": "<string>",
"credentialId": "<string>"
},
"origin": "api",
"originTrust": "authenticated",
"startedAt": "2023-11-07T05:31:56Z",
"outcome": "running",
"eventCount": 0,
"logicalBytes": 0,
"resources": [
{
"type": "<string>",
"id": "<string>",
"relationship": "target",
"label": "<string>"
}
]
}
],
"nextCursor": "<string>",
"snapshotAt": "2023-11-07T05:31:56Z"
}{
"error": "audit_invalid_query"
}{
"error": "unauthorized"
}{
"error": "forbidden",
"message": "<string>"
}{
"error": "organization_not_found"
}{
"error": "audit_cursor_expired"
}{
"error": "audit_unavailable"
}Authorizations
Organization API key passed as the x-api-key header. The raw key is the header value; do not prefix it with Bearer.
Query Parameters
Maximum rows in this page.
1 <= x <= 100Opaque nextCursor from the prior page of the same query and mode.
4096Inclusive operation-start bound; date-only is UTC midnight. from must not exceed to.
Inclusive operation-start bound; date-only is UTC midnight. from must not exceed to.
Initiating user ID, not a delegated event actor or membership ID.
^usr_[0-7][0-9a-hjkmnp-tv-z]{25}$Exact stable action of any child event within the snapshot.
1 - 128^[a-z][a-z0-9_.-]*$Current operation outcome; not an individual event outcome.
running, succeeded, failed, partial, unknown Stored operation origin.
api, cloud_ui, mcp, scheduler, webhook, platform_admin Exact case-sensitive operation, child event, child request or stored child resource reference ID within the snapshot; OR across ID kinds, AND with other filters. Not free-text or legacy payload search.
1 - 255^[^\u0000-\u001f\u007f-\u009f]+$Exact case-sensitive stored reference ID from any child within the snapshot.
1 - 255Optional stored reference type; requires resourceId.
1 - 64^[a-z][a-z0-9_.-]*$Response
One bounded summary per operation.
Show child attributes
Show child attributes
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$Was this page helpful?