Query Audit Logs

GET https://app.eraser.io/api/audit-logs

Note – This API endpoint is only available to Enterprise Plan customers.

This endpoint is designed for SIEM integration with platforms like Azure Sentinel, Splunk, Elastic SIEM, and other security monitoring tools.

Returns events in ECS (Elastic Common Schema) format by default, with optional Splunk CIM format support.

Authentication requires a tenant-level audit API key (different from team API tokens). Contact support to obtain your audit API key.

An example cURL request is:

  curl --location 'https://app.eraser.io/api/audit-logs?limit=100'  
  --header 'Authorization: Bearer $YOUR-KEY-HERE'

An example response is:

{
    "events": [
      {
        "id": "a3f9c2e1d8b4",
        "@timestamp": "2026-01-15T14:32:18.000Z",
        "event": {
          "id": "a3f9c2e1d8b4",
          "category": ["authentication"],
          "action": "auth.login",
          "outcome": "success"
        },
        "user": {
          "id": "7k2m9n4p8q1r"
        },
        "eraser": {
          "teamId": "x5y8z3a7b2c6",
          "organizationId": "d9e4f1g6h3j8"
        }
      },
      {
        "id": "b7e2d5f9a1c3",
        "@timestamp": "2026-01-15T14:28:45.000Z",
        "event": {
          "id": "b7e2d5f9a1c3",
          "category": ["file"],
          "action": "data.file.created",
          "outcome": "success"
        },
        "user": {
          "id": "m8n2p5q9r3s7"
        },
        "eraser": {
          "teamId": "x5y8z3a7b2c6",
          "workspaceId": "t4u7v1w6x9y2",
          "organizationId": "d9e4f1g6h3j8",
          "metadata": {
            "fileName": "Architecture Diagram"
          }
        }
      }
    ],
    "nextCursor": "eyJ0aW1lc3RhbXAiOiIyMDI2LTAxLTE1VDE0OjI4OjQ1LjAwMFoiLCJpZCI6ImI3ZTJkNWY5YTFjMyJ9",
    "hasMore": true,
    "serverTime": "2026-01-15T14:35:22.000Z"
}

Query parameters

startTime string query

Start of the time range (inclusive). Must be an RFC3339/ISO 8601 timestamp. Example: `2025-01-01T00:00:00Z`

endTime string query

End of the time range (exclusive). Must be an RFC3339/ISO 8601 timestamp. Example: `2025-01-15T00:00:00Z`

cursor string query

Opaque cursor string for pagination. Use the `nextCursor` value from a previous response to fetch the next page of results.

limit integer query

Maximum number of events to return per request. Defaults to 100. Maximum allowed value is 1000.

eventType string query

Filter events by action type.

auth.login
auth.logout
iam.user.created
iam.user.deleted
iam.user.invited
iam.role.granted
iam.role.revoked
admin.api_key.created
admin.api_key.deleted
admin.settings.changed
admin.integration.connected
admin.integration.disconnected
admin.team.created
admin.team.deleted
data.file.created
data.file.archived
data.file.deleted
data.file.exported
data.file.invite_sent
data.file.visited
data.file.settings.changed

userId string query

Filter events by the ID of the user who performed the action.

format string query

Output format for audit events. - `ecs` (default): Elastic Common Schema format, compatible with Azure Sentinel, Elastic SIEM - `splunk`: Splunk Common Information Model format

ecs
splunk

Responses

200 – Audit events retrieved successfully

events object[] required20 fields

Array of audit events in the requested format

id string required

Unique identifier for the audit event

@timestamp string required

ISO 8601 timestamp when the event occurred

event object required4 fields

id string required

Event identifier (same as top-level id)

category string[] required

ECS event category

authentication
iam
configuration
file

action string required

The specific action that occurred

auth.login
auth.logout
iam.user.created
iam.user.deleted
iam.user.invited
iam.role.granted
iam.role.revoked
admin.api_key.created
admin.api_key.deleted
admin.settings.changed
admin.integration.connected
admin.integration.disconnected
admin.team.created
admin.team.deleted
data.file.created
data.file.archived
data.file.deleted
data.file.exported
data.file.invite_sent
data.file.visited
data.file.settings.changed

outcome string required

Whether the action succeeded or failed

success
failure

organization object 1 fields

Organization/tenant information (for multi-tenant deployments)

id string

Organization identifier

user object 1 fields

The user who performed the action

id string

User identifier

user.target object 1 fields

Target user for IAM events (e.g., user being invited or having role changed)

id string

Target user identifier

url object 1 fields

URL information for the request

path string

URL path of the request

eraser object 4 fields

Eraser-specific event context

teamId string

Team identifier

workspaceId string

Workspace/file identifier

organizationId string

Organization identifier

metadata object

Additional event-specific metadata

nextCursor string

Opaque cursor for fetching the next page. Pass this value as the `cursor` parameter in subsequent requests. Null when there are no more results.

hasMore boolean required

Whether there are more events available beyond this page

serverTime string required

Server timestamp when the response was generated (ISO 8601)

200 response

{
  "events": [
    {
      "id": "abc123xyz",
      "@timestamp": "2025-01-14T12:00:00Z",
      "event": {
        "id": "abc123xyz",
        "category": [
          "authentication"
        ],
        "action": "auth.login",
        "outcome": "success"
      },
      "organization": {
        "id": "string"
      },
      "user": {
        "id": "user_12345"
      },
      "user.target": {
        "id": "user_99999"
      },
      "url": {
        "path": "/api/auth/sign-in"
      },
      "eraser": {
        "teamId": "team_67890",
        "workspaceId": "workspace_11111",
        "organizationId": "string",
        "metadata": {
          "method": "sso",
          "changedFields": [
            "name",
            "defaultWorkspaceAccess"
          ]
        }
      }
    }
  ],
  "nextCursor": "eyJ0aW1lc3RhbXAiOiIyMDI1LTAxLTE0VDEyOjAwOjAwWiIsImlkIjoiYWJjMTIzIn0=",
  "hasMore": true,
  "serverTime": "2025-01-15T10:30:00Z"
}

400 – Invalid request parameters

error string

Human-readable error message

code string

Machine-readable error code

400 response

{
  "error": "string",
  "code": "string"
}

401 – Invalid or missing audit API key

error string

Human-readable error message

code string

Machine-readable error code

401 response

{
  "error": "string",
  "code": "string"
}

500 – Internal server error

error string

Human-readable error message

code string

Machine-readable error code

500 response

{
  "error": "string",
  "code": "string"
}

503 – Audit logging not configured for this deployment

error string

Human-readable error message

code string

Machine-readable error code

503 response

{
  "error": "string",
  "code": "string"
}