curl --request GET \
--url https://api.openworklabs.com/v1/audit/operations/{operationId}/events \
--header 'x-api-key: <api-key>'import requests
url = "https://api.openworklabs.com/v1/audit/operations/{operationId}/events"
headers = {"x-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.openworklabs.com/v1/audit/operations/{operationId}/events', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.openworklabs.com/v1/audit/operations/{operationId}/events",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.openworklabs.com/v1/audit/operations/{operationId}/events"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.openworklabs.com/v1/audit/operations/{operationId}/events")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.openworklabs.com/v1/audit/operations/{operationId}/events")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"events": [
{
"schemaVersion": 2,
"id": "<string>",
"organizationId": "<string>",
"operationId": "<string>",
"operation": {
"kind": "<string>",
"scope": "<string>",
"origin": "api",
"originTrust": "authenticated",
"initiatingActor": {
"type": "user",
"id": "<string>",
"memberId": "<string>",
"credentialId": "<string>"
},
"startedAt": "2023-11-07T05:31:56Z"
},
"actor": {
"type": "user",
"id": "<string>",
"memberId": "<string>",
"credentialId": "<string>"
},
"action": "<string>",
"category": "change",
"outcome": "succeeded",
"occurredAt": "2023-11-07T05:31:56Z",
"recordedAt": "2023-11-07T05:31:56Z",
"requestId": "<string>",
"resources": [
{
"type": "<string>",
"id": "<string>",
"relationship": "target",
"label": "<string>"
}
],
"logicalBytes": 0,
"jobRunId": "<string>",
"causedByEventId": "<string>",
"changes": {
"before": {},
"after": {},
"changedFields": [
"<string>"
]
},
"reasonCode": "<string>",
"http": {
"method": "<string>",
"route": "<string>",
"status": 349
}
}
],
"nextCursor": "<string>",
"snapshotAt": "2023-11-07T05:31:56Z"
}{
"error": "audit_invalid_query"
}{
"error": "unauthorized"
}{
"error": "forbidden",
"message": "<string>"
}{
"error": "organization_not_found"
}{
"error": "audit_cursor_expired"
}{
"error": "audit_unavailable"
}List retained operation events
Organization administrator access to currently captured, retained audit history only; this is not coverage of every cloud action. Requires deployment visibility. Legacy arbitrary payloads are preserved separately and are not backfilled or returned. One operation may contain multiple child events. Visibility is independent of capture entitlement. No duration, charge or continuous-drain guarantee is made. Default limit 50, maximum 100. Cursors are signed, organization/filter/mode scoped and expire 24 hours after the first page (not renewed). Repeat the same filters; limit may change. snapshotAt freezes the page set: events recorded after it are excluded, including later children of an existing operation. Events are ordered by their time-ordered IDs; there is no per-organization sequence. Exports leave out the last few seconds so in-flight writes cannot land behind a page already read. Start a new snapshot to see newer events. This is not a lossless-drain or retention protection guarantee. Events are in ascending event ID (recording time) order and carry complete versioned envelopes. Missing or foreign retained operations return the same 404.
curl --request GET \
--url https://api.openworklabs.com/v1/audit/operations/{operationId}/events \
--header 'x-api-key: <api-key>'import requests
url = "https://api.openworklabs.com/v1/audit/operations/{operationId}/events"
headers = {"x-api-key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'x-api-key': '<api-key>'}};
fetch('https://api.openworklabs.com/v1/audit/operations/{operationId}/events', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.openworklabs.com/v1/audit/operations/{operationId}/events",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"x-api-key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.openworklabs.com/v1/audit/operations/{operationId}/events"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("x-api-key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.openworklabs.com/v1/audit/operations/{operationId}/events")
.header("x-api-key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.openworklabs.com/v1/audit/operations/{operationId}/events")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["x-api-key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"events": [
{
"schemaVersion": 2,
"id": "<string>",
"organizationId": "<string>",
"operationId": "<string>",
"operation": {
"kind": "<string>",
"scope": "<string>",
"origin": "api",
"originTrust": "authenticated",
"initiatingActor": {
"type": "user",
"id": "<string>",
"memberId": "<string>",
"credentialId": "<string>"
},
"startedAt": "2023-11-07T05:31:56Z"
},
"actor": {
"type": "user",
"id": "<string>",
"memberId": "<string>",
"credentialId": "<string>"
},
"action": "<string>",
"category": "change",
"outcome": "succeeded",
"occurredAt": "2023-11-07T05:31:56Z",
"recordedAt": "2023-11-07T05:31:56Z",
"requestId": "<string>",
"resources": [
{
"type": "<string>",
"id": "<string>",
"relationship": "target",
"label": "<string>"
}
],
"logicalBytes": 0,
"jobRunId": "<string>",
"causedByEventId": "<string>",
"changes": {
"before": {},
"after": {},
"changedFields": [
"<string>"
]
},
"reasonCode": "<string>",
"http": {
"method": "<string>",
"route": "<string>",
"status": 349
}
}
],
"nextCursor": "<string>",
"snapshotAt": "2023-11-07T05:31:56Z"
}{
"error": "audit_invalid_query"
}{
"error": "unauthorized"
}{
"error": "forbidden",
"message": "<string>"
}{
"error": "organization_not_found"
}{
"error": "audit_cursor_expired"
}{
"error": "audit_unavailable"
}Authorizations
Organization API key passed as the x-api-key header. The raw key is the header value; do not prefix it with Bearer.
Path Parameters
^aop_[0-7][0-9a-hjkmnp-tv-z]{25}$Query Parameters
Maximum rows in this page.
1 <= x <= 100Opaque nextCursor from the prior page of the same query and mode.
4096Response
A bounded ascending page of event envelopes.
Show child attributes
Show child attributes
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$Was this page helpful?