API reference/Ops: audit

Count audit events

GET/ops/audit/stats

Counts events in a window of at most 90 days (default the last 7), grouped by action, outcome, actor kind, resource type or UTC day. Filters are the audit list's.

bearer auth

Query parameters

group_bystringrequired

one of "action", "outcome", "actor_kind", "resource_type", "day"

actor_kindstring

user, service, system or anonymous

max length 32

actor_idstring

max length 200

actionstring

max length 200

action_prefixstring

max length 200

resource_typestring

max length 100

org_idstring

max length 200

outcomestring

success, failure or denied

max length 16

fromstring (date-time)

Start, inclusive (RFC 3339); default 7 days before to

tostring (date-time)

End, exclusive (RFC 3339); default now. At most 90 days after from

Responses

200OKapplication/json

fromstring (date-time)required

group_bystringrequired

one of "action", "outcome", "actor_kind", "resource_type", "day"

groupsarray of objectrequired

Largest first, at most 50; every day in order for group_by=day

otherinteger (int64)required

Events in groups beyond the first 50

tostring (date-time)required

totalinteger (int64)required

401Unauthorizedapplication/problem+json

codestringrequired

Stable machine-readable error code

detailstring

Human-readable explanation

errorsarray of object

Field-level validation errors

request_idstring

Correlates with server logs and traces

statusinteger (int64)required

HTTP status code

titlestringrequired

Short summary of the problem type

typestring

URI identifying the problem type

403Forbiddenapplication/problem+json

codestringrequired

Stable machine-readable error code

detailstring

Human-readable explanation

errorsarray of object

Field-level validation errors

request_idstring

Correlates with server logs and traces

statusinteger (int64)required

HTTP status code

titlestringrequired

Short summary of the problem type

typestring

URI identifying the problem type

422Unprocessable Entityapplication/problem+json

codestringrequired

Stable machine-readable error code

detailstring

Human-readable explanation

errorsarray of object

Field-level validation errors

request_idstring

Correlates with server logs and traces

statusinteger (int64)required

HTTP status code

titlestringrequired

Short summary of the problem type

typestring

URI identifying the problem type

500Internal Server Errorapplication/problem+json

codestringrequired

Stable machine-readable error code

detailstring

Human-readable explanation

errorsarray of object

Field-level validation errors

request_idstring

Correlates with server logs and traces

statusinteger (int64)required

HTTP status code

titlestringrequired

Short summary of the problem type

typestring

URI identifying the problem type

Was this page useful?

v0.5

Request

curl -X GET "https://api.example.com/ops/audit/stats?group_by=action" \
  -H "Authorization: Bearer $TOKEN"

req, _ := http.NewRequest("GET", "https://api.example.com/ops/audit/stats?group_by=action", nil)
req.Header.Set("Authorization", "Bearer "+token)
resp, err := http.DefaultClient.Do(req)
if err != nil {
	return err
}
defer resp.Body.Close()

const res = await fetch("https://api.example.com/ops/audit/stats?group_by=action", {
  method: "GET",
  headers: { Authorization: `Bearer ${token}` },
});
const data = await res.json();

Response

{
  "from": "2026-09-15T12:00:00Z",
  "group_by": "action",
  "groups": [
    {
      "count": 1,
      "key": "auth.login.failed"
    }
  ],
  "other": 1,
  "to": "2026-09-15T12:00:00Z",
  "total": 1
}

{
  "code": "project_name_taken",
  "detail": "project name is already taken",
  "errors": [
    {
      "location": "body.name",
      "message": "expected length >= 1"
    }
  ],
  "request_id": "req_9f86d081884c7d65",
  "status": 409,
  "title": "Conflict",
  "type": "string"
}

{
  "code": "project_name_taken",
  "detail": "project name is already taken",
  "errors": [
    {
      "location": "body.name",
      "message": "expected length >= 1"
    }
  ],
  "request_id": "req_9f86d081884c7d65",
  "status": 409,
  "title": "Conflict",
  "type": "string"
}

{
  "code": "project_name_taken",
  "detail": "project name is already taken",
  "errors": [
    {
      "location": "body.name",
      "message": "expected length >= 1"
    }
  ],
  "request_id": "req_9f86d081884c7d65",
  "status": 409,
  "title": "Conflict",
  "type": "string"
}

{
  "code": "project_name_taken",
  "detail": "project name is already taken",
  "errors": [
    {
      "location": "body.name",
      "message": "expected length >= 1"
    }
  ],
  "request_id": "req_9f86d081884c7d65",
  "status": 409,
  "title": "Conflict",
  "type": "string"
}

Base URL: https://api.example.com
Auth: bearer