Account Audit Log

GET /v1/account/audit-log

Account-scoped audit trail — actions taken on the account's resources (endpoints, domains, certificates, firewall, billing, …), newest first. This is distinct from the user-scoped Activity Log and Sessions: personal-auth event types (auth = logins/MFA, security = password/session changes) are excluded here — they belong to the per-user login-history surfaces.

When an active account is set, results cover all members' actions on that account's resources, so the actor (actor) is included on every row.

Entitlement

The account audit log is gated by the account_audit_log entitlement, which every current plan includes. How long entries are kept depends on the plan: GET /v1/account/plan returns it as plan_limits.audit_log_retention_days (-1 = forever). If your plan does not include it the endpoint returns 403 Forbidden.

Query parameters

page int
1-based page number. Values below 1 are clamped to 1. Default 1.
page_size int
Items per page. Must be 1–100; anything outside that range falls back to 25.
type string
Filter by exact event_type (e.g. endpoint, domain, billing). The personal-auth types auth and security are always excluded regardless of this filter.
from date
Inclusive lower bound, YYYY-MM-DD. Ignored if not parseable in that format.
to date
Upper bound, YYYY-MM-DD. Inclusive of the whole day (matched as < to + 1 day). Ignored if not parseable.
search string
Free-text substring match against the event description.
format string
Set to csv to stream all matching rows (same filters, ignores pagination) as a CSV download instead of the JSON page.

Response (200 OK)

entries object[]
The audit events for this page (see fields below). Always present (empty array when none).
page int
The page that was returned.
page_size int
The effective page size.
total int
Total number of matching events across all pages.

Event object

event_type string
Category of the event (e.g. endpoint, domain, billing).
description string
Human-readable description of what happened.
actor string
Username of the member who performed the action. Empty string if unresolved.
auth_method string
How the actor was authenticated (e.g. session, API key). Empty string when unset.
ip_address string
Source IP of the action. Empty string when unset.
device string
Device / user-agent summary. Empty string when unset.
location string
Geo location of the source IP. Empty string when unset.
location_detail string
Finer-grained location detail. Empty string when unset.
created_at datetime
When the event occurred, formatted as YYYY-MM-DDThh:mm:ssZ. Events are returned newest first.

Deprecated: until the sunset each event also carries a legacy integer id. Audit events have no public id; don't use it.

Errors

401 Unauthorized
Missing auth.
403 Forbidden
Your role lacks read permission on account settings, or your plan does not include the account_audit_log entitlement.
Request
curl -X GET "https://api.ngris.com/v1/account/audit-log?page=1&page_size=25&type=endpoint" \ -H "X-API-KEY: <your_api_key>"
Request — CSV export
curl -X GET "https://api.ngris.com/v1/account/audit-log?format=csv&from=2026-04-01&to=2026-04-30" \ -H "X-API-KEY: <your_api_key>" \ -o account_audit_log.csv
Response — 200 OK
{ "entries": [ { "event_type": "endpoint", "description": "Deleted endpoint prod-api", "actor": "jane", "auth_method": "session", "ip_address": "203.0.113.50", "device": "Chrome on macOS", "location": "Vilnius, LT", "location_detail": "Vilniaus apskritis", "created_at": "2026-04-29T13:00:05Z" } ], "page": 1, "page_size": 25, "total": 1 }
Was this helpful?
On this page
Account Audit Log
Was this helpful?
Homepage Docs Dashboard Docs API Docs nvelox Dashboard