This endpoint is designed for SIEM integration with platforms like Azure Sentinel, Splunk, Elastic SIEM, and other security monitoring tools.

Returns events in ECS (Elastic Common Schema) format by default, with optional Splunk CIM format support.

Authentication requires a tenant-level audit API key (different from team API tokens). Contact support to obtain your audit API key.

An example cURL request is:

  curl --location 'https://app.eraser.io/api/audit-logs?limit=100'  
  --header 'Authorization: Bearer $YOUR-KEY-HERE'

An example response is:

{
    "events": [
      {
        "id": "a3f9c2e1d8b4",
        "@timestamp": "2026-01-15T14:32:18.000Z",
        "event": {
          "id": "a3f9c2e1d8b4",
          "category": ["authentication"],
          "action": "auth.login",
          "outcome": "success"
        },
        "user": {
          "id": "7k2m9n4p8q1r"
        },
        "eraser": {
          "teamId": "x5y8z3a7b2c6",
          "organizationId": "d9e4f1g6h3j8"
        }
      },
      {
        "id": "b7e2d5f9a1c3",
        "@timestamp": "2026-01-15T14:28:45.000Z",
        "event": {
          "id": "b7e2d5f9a1c3",
          "category": ["file"],
          "action": "data.file.created",
          "outcome": "success"
        },
        "user": {
          "id": "m8n2p5q9r3s7"
        },
        "eraser": {
          "teamId": "x5y8z3a7b2c6",
          "workspaceId": "t4u7v1w6x9y2",
          "organizationId": "d9e4f1g6h3j8",
          "metadata": {
            "fileName": "Architecture Diagram"
          }
        }
      }
    ],
    "nextCursor": "eyJ0aW1lc3RhbXAiOiIyMDI2LTAxLTE1VDE0OjI4OjQ1LjAwMFoiLCJpZCI6ImI3ZTJkNWY5YTFjMyJ9",
    "hasMore": true,
    "serverTime": "2026-01-15T14:35:22.000Z"
}