Audit service

The Audit API allows you to access comprehensive audit logs from . These logs provide detailed information about actions performed within the platform, including who performed the action, when it occurred, and other relevant details. This information is useful for maintaining security, compliance, and operational oversight. This guide will walk you through the steps to retrieve audit logs using the Audit API. The event types currently supported by the API are listed below. New event types are continually added as more areas of are integrated with the Audit API, and this list will be updated accordingly.

Audit logs contain user identifiers, such as name and email address, to attribute actions to specific users. Only users with the View Audit Events permission can access audit logs. Logs are retained within the platform, and are accessible via and the Audit API for a rolling 90-day period. Events older than 90 days aren’t available via the platform or API, even though underlying audit data may be stored for up to 12 months for operational purposes.

Prerequisites

Before you begin, make sure you have the following:

A account.
Valid API credentials for API access.
An access token with the required privileges (refer to Authentication and Get the access token).

Get the audit logs

Retrieve the audit logs using the Audit API. Base URL: GET /v1/events

Parameters

Name	Description
from	The earliest date and time of audit events to retrieve. The parameter should be in ISO 8601 format, e.g.: `2025-02-20T07:15:15.000-01:00`.
to	The latest date and time of audit events to retrieve. The parameter should be in ISO 8601 format, e.g.: `2025-02-21T07:15:15.000-01:00`.
page	The page number of the retrieved results. The first page is 0.
size	The number of records per page, from 1 to 100.

Example response

A successful response returns a 200 OK status code and a JSON body containing the audit logs, as in the following example:

{
  "page": 1,
  "results": [
    {
      "actorEmail": "user123@abc.com",
      "actorId": "string",
      "additionalInfo": "string",
      "eventDescription": "User logged in",
      "eventId": "123e4567-e89b-12d3-a456-426614174000",
      "eventName": "hub_user_login",
      "eventProjectId": "4cfcf46e-5bb1-4887-8772-d1c0eeb0cfef",
      "eventSource": "secrets-reference",
      "eventSubjectId": "C67A9A1A-5A49-4EBF-8222-0C6DCC572505",
      "eventSubjectName": "my-first-secret",
      "eventSubjectType": "USER",
      "eventTimestamp": "2025-01-30T00:30:12Z",
      "eventType": "LOGIN"
    }
  ],
  "size": 50,
  "total": 472
}

Audit event types

The following tables list the event types currently supported by the Audit API. Events are grouped by scope, and then by the product area that they relate to.

Scope - Account

Account

Event name	Description
Account name changed	Account name changed.
Account created	Account created.
Invite created	User invitation created and sent to the user.
Invite redeemed	User redeemed invitation.
Account user removed	User removed from the account.
Role changed	A user’s account role was changed.

Maia runner

Event name	Description
Agent created	A new agent was added.
Agent removed	An agent was removed.
Agent updated	An existing agent configuration was changed.
Allow List	The allow list was changed.
Agent Action	An agent was restarted, paused, started, or had a credentials refresh.

Custom connector

Event name	Description
Custom Connector created	New Custom connector created.
Custom Connector changed	Custom connector changed.
Custom Connector deleted	Custom connector removed.

Scope - Project

Project

Event name	Description
Project created	New project successfully created.
Project removed	Project removed.
User granted access to project	A user was granted access to a project.
User removed from project	A user was removed from a project.
Role changed	A user’s project role was changed.
Project connection created/updated/deleted	A connection at the project level was created, updated, or deleted. Examples include an SSH tunnel, OAuth configuration, or secret definition.

Project connection audit events are produced for SSH Tunnels, OAuths, and Secret definitions.

Artifacts

Event name	Description
Artifact created	New artifact successfully created.
Artifact disabled	New artifact successfully removed.

Credentials

These events include those for secrets, cloud credentials, and OAuths.

Event name	Description
Credentials created (Secrets/Cloud Credentials/OAuth)	Project credentials created.
Credentials changed in project (Secrets/Cloud Credentials/OAuth)	Credentials changed in project.
Credentials removed from project (Secrets/Cloud Credentials/OAuth)	Credentials removed from project.

Schedules

Event name	Description
Schedule created	New schedule successfully created.
Schedule updated	Schedule settings changed.
Schedule removed	Schedule removed.

Streaming

Event name	Description
Streaming pipeline created	Streaming pipeline created.
Streaming pipeline deleted	Streaming pipeline deleted.
Streaming pipeline started	Streaming pipeline started.
Streaming pipeline stopped	Streaming pipeline stopped.
Streaming pipeline changed	Streaming pipeline configuration changed.
Streaming pipeline snapshot request created	Streaming pipeline snapshot request created.
Streaming pipeline snapshot request deleted	Streaming pipeline snapshot request deleted.
Streaming pipeline email alerts enabled	Streaming pipeline email alerts enabled.
Streaming pipeline email alerts disabled	Streaming pipeline email alerts disabled.

Scope - Environment

Environments

Event name	Description
Environment created	A new environment was successfully created in a project.
Environment connection created/updated/deleted	A connection at the environment level was created, updated, or deleted. Examples include an OAuth configuration or secret definition.
Role changed	A user’s environment role was changed.

Environment connection audit events are produced for OAuths and Secret definitions.

Platform overview

Setup

Getting started

Projects

Custom connectors

Runners

Observability

Git

Connections and credentials

Data ops

Troubleshooting

Videos

Prerequisites

Get the audit logs

Parameters

Example response

Audit event types

Scope - Account

Account

Maia runner

Custom connector

Scope - Project

Project

Artifacts

Credentials

Schedules

Streaming

Scope - Environment

Environments

​Prerequisites

​Get the audit logs

​Parameters

​Example response

​Audit event types

​Scope - Account

​Account

​Maia runner

​Custom connector

​Scope - Project

​Project

​Artifacts

​Credentials

​Schedules

​Streaming

​Scope - Environment

​Environments

Prerequisites

Get the audit logs

Parameters

Example response

Audit event types

Scope - Account

Account

Maia runner

Custom connector

Scope - Project

Project

Artifacts

Credentials

Schedules

Streaming

Scope - Environment

Environments