Account Audit Log
Account-scoped audit trail — actions taken on the account's resources (endpoints, domains, certificates, firewall, billing, …), newest first. This is distinct from the user-scoped Activity Log and Sessions: personal-auth event types (auth = logins/MFA, security = password/session changes) are excluded here — they belong to the per-user login-history surfaces.
When an active account is set, results cover all members' actions on that account's resources, so the actor (actor) is included on every row.
Entitlement
The account audit log is a paid feature, gated by the account_audit_log entitlement. If your plan does not include it the endpoint returns 403 Forbidden.
Query parameters
page int
1-based page number. Values below 1 are clamped to
1. Default 1.page_size int
Items per page. Must be 1–100; anything outside that range falls back to
25.type string
Filter by exact
event_type (e.g. endpoint, domain, billing). The personal-auth types auth and security are always excluded regardless of this filter.from date
Inclusive lower bound,
YYYY-MM-DD. Ignored if not parseable in that format.to date
Upper bound,
YYYY-MM-DD. Inclusive of the whole day (matched as < to + 1 day). Ignored if not parseable.search string
Free-text substring match against the event
description.format string
Set to
csv to stream all matching rows (same filters, ignores pagination) as a CSV download instead of the JSON page.Response (200 OK)
entries object[]
The audit events for this page (see fields below). Always present (empty array when none).
page int
The page that was returned.
page_size int
The effective page size.
total int
Total number of matching events across all pages.
Event object
id int64
Event ID. Events are ordered by this field, descending (newest first).
event_type string
Category of the event (e.g.
endpoint, domain, billing).description string
Human-readable description of what happened.
actor string
Username of the member who performed the action. Empty string if unresolved.
auth_method string
How the actor was authenticated (e.g. session, API key). Empty string when unset.
ip_address string
Source IP of the action. Empty string when unset.
device string
Device / user-agent summary. Empty string when unset.
location string
Geo location of the source IP. Empty string when unset.
location_detail string
Finer-grained location detail. Empty string when unset.
created_at datetime
When the event occurred, formatted as
YYYY-MM-DDThh:mm:ssZ.Errors
401 Unauthorized
Missing auth.
403 Forbidden
Your role lacks read permission on account settings, or your plan does not include the
account_audit_log entitlement.Request
curl -X GET "https://api.ngris.com/v1/account/audit-log?page=1&page_size=25&type=endpoint" \
-H "X-API-KEY: <your_api_key>"
Request — CSV export
curl -X GET "https://api.ngris.com/v1/account/audit-log?format=csv&from=2026-04-01&to=2026-04-30" \
-H "X-API-KEY: <your_api_key>" \
-o account_audit_log.csv
Response — 200 OK
{
"entries": [
{
"id": 90217,
"event_type": "endpoint",
"description": "Deleted endpoint prod-api",
"actor": "jane",
"auth_method": "session",
"ip_address": "203.0.113.50",
"device": "Chrome on macOS",
"location": "Vilnius, LT",
"location_detail": "Vilniaus apskritis",
"created_at": "2026-04-29T13:00:05Z"
}
],
"page": 1,
"page_size": 25,
"total": 1
}