List Audit Events

curl --request POST \
  --url https://api.codeant.ai/api/audit/events \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "platform": "github",
  "org": "Example-Org"
}
'

{
  "org": "Example-Org",
  "service": "github",
  "base_url_domain": "github.com",
  "start_date": "2026-07-24",
  "end_date": "2026-07-31",
  "retention_days": 180,
  "count": 2,
  "has_more": false,
  "next_cursor": "Y29kZWFudC1hdWRpdC1sb2dzLzIwMjYtMDctMzAvLi4u",
  "events": [
    {
      "event_id": "a3f9c2e1b4d84f7a9c0e5d6b7a8f9012",
      "timestamp": "2026-07-30T09:14:03.512345Z",
      "action": "rbac.role_update",
      "description": "Access control: role update",
      "actor_type": "user",
      "actor_id": "harshit-dubey",
      "actor_email": "admin@example.com",
      "org": "Example-Org",
      "service": "github",
      "base_url_domain": "github.com",
      "source": "ui",
      "target_type": "rbac",
      "target_id": "role_7d2f",
      "target_name": "Security Reviewer",
      "outcome": "success",
      "status_code": 200,
      "method": "POST",
      "path": "/settings/rbac/roles/update",
      "ip": "203.0.113.42",
      "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
      "request_id": "req_01J1ZX2Y3A4B5C6D",
      "changes": {
        "permissions": {
          "before": "read",
          "after": "write"
        }
      },
      "details": {
        "role_name": "Security Reviewer"
      }
    },
    {
      "event_id": "c1a2b3d4e5f60718293a4b5c6d7e8f90",
      "timestamp": "2026-07-30T10:00:00.000000Z",
      "action": "analysis.scan_trigger",
      "description": "Analysis: scan trigger",
      "actor_type": "system",
      "actor_id": "codeant-internal-queue",
      "actor_email": null,
      "org": "Example-Org",
      "service": "github",
      "base_url_domain": "github.com",
      "source": "scheduled_job",
      "target_type": "analysis",
      "target_id": null,
      "target_name": "example-org/payments-api",
      "outcome": "success",
      "status_code": 200,
      "method": "POST",
      "path": "/doAnalysis",
      "ip": "10.0.4.18",
      "user_agent": "python-requests/2.32.0",
      "request_id": "req_01J1ZXB2C3D4E5F6",
      "changes": null,
      "details": {
        "reponame": "example-org/payments-api",
        "branch": "main"
      }
    }
  ]
}

{
  "error": "Invalid `since` — use an ISO 8601 timestamp"
}

{
  "error": "Access token invalid or does not have access to this organization"
}

POST

api

audit

events

curl --request POST \
  --url https://api.codeant.ai/api/audit/events \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "platform": "github",
  "org": "Example-Org"
}
'

{
  "org": "Example-Org",
  "service": "github",
  "base_url_domain": "github.com",
  "start_date": "2026-07-24",
  "end_date": "2026-07-31",
  "retention_days": 180,
  "count": 2,
  "has_more": false,
  "next_cursor": "Y29kZWFudC1hdWRpdC1sb2dzLzIwMjYtMDctMzAvLi4u",
  "events": [
    {
      "event_id": "a3f9c2e1b4d84f7a9c0e5d6b7a8f9012",
      "timestamp": "2026-07-30T09:14:03.512345Z",
      "action": "rbac.role_update",
      "description": "Access control: role update",
      "actor_type": "user",
      "actor_id": "harshit-dubey",
      "actor_email": "admin@example.com",
      "org": "Example-Org",
      "service": "github",
      "base_url_domain": "github.com",
      "source": "ui",
      "target_type": "rbac",
      "target_id": "role_7d2f",
      "target_name": "Security Reviewer",
      "outcome": "success",
      "status_code": 200,
      "method": "POST",
      "path": "/settings/rbac/roles/update",
      "ip": "203.0.113.42",
      "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)",
      "request_id": "req_01J1ZX2Y3A4B5C6D",
      "changes": {
        "permissions": {
          "before": "read",
          "after": "write"
        }
      },
      "details": {
        "role_name": "Security Reviewer"
      }
    },
    {
      "event_id": "c1a2b3d4e5f60718293a4b5c6d7e8f90",
      "timestamp": "2026-07-30T10:00:00.000000Z",
      "action": "analysis.scan_trigger",
      "description": "Analysis: scan trigger",
      "actor_type": "system",
      "actor_id": "codeant-internal-queue",
      "actor_email": null,
      "org": "Example-Org",
      "service": "github",
      "base_url_domain": "github.com",
      "source": "scheduled_job",
      "target_type": "analysis",
      "target_id": null,
      "target_name": "example-org/payments-api",
      "outcome": "success",
      "status_code": 200,
      "method": "POST",
      "path": "/doAnalysis",
      "ip": "10.0.4.18",
      "user_agent": "python-requests/2.32.0",
      "request_id": "req_01J1ZXB2C3D4E5F6",
      "changes": null,
      "details": {
        "reponame": "example-org/payments-api",
        "branch": "main"
      }
    }
  ]
}

{
  "error": "Invalid `since` — use an ISO 8601 timestamp"
}

{
  "error": "Access token invalid or does not have access to this organization"
}

Authorizations

Authorization

string

header

required

CodeAnt API token (cdt_...), created on the Settings → API Tokens page. Pass via Authorization: Bearer <token> header.

Body

application/json

platform

enum<string>

required

Git platform of the organization

Available options:

github,

gitlab,

bitbucket,

azure_devops

org

string

required

Organization / workspace slug

github_base_url

string

Self-hosted instance URL (also gitlab_base_url / bitbucket_base_url / azure_devops_base_url). Defaults to the cloud host.

Example:

"https://github.com"

start_date

string<date>

Inclusive UTC start date. Default: last 7 days; clamped to the 180-day retention window.

end_date

string<date>

Inclusive UTC end date. Default: today.

days

integer

Alternative to explicit dates: lookback window in days (max 180).

since

string<date-time>

Only events STRICTLY AFTER this ISO 8601 timestamp; also defaults the range to [since, today]. Use your last consumed event's timestamp for incremental pulls.

cursor

string

Opaque cursor from a previous response — resume paging after it.

limit

integer

default:100

Events per page.

Required range: x <= 1000

format

enum<string>

default:json

json returns the envelope below; ndjson/csv return the raw file body with paging in X-Next-Cursor / X-Has-More headers. CSV is RFC 4180 (fields with commas, quotes or line breaks are properly quoted).

Available options:

json,

ndjson,

csv

Response

Audit events retrieved successfully. With format: ndjson or csv the body is the raw file instead, and paging moves to the X-Next-Cursor and X-Has-More response headers.

org

string

service

string

base_url_domain

string

start_date

string<date>

end_date

string<date>

retention_days

integer

Example:

180

count

integer

Events in this page

has_more

boolean

True when more pages match — call again with next_cursor

next_cursor

string | null

Opaque cursor for the next page; also a durable resume point

events

object[]

Events in ascending timestamp order (oldest first)

Show child attributes

Get Agent Scan History

⌘I

Analysis

Developer Metrics - Teams

Developer Metrics

Agent Analysis

Audit Logs

Authorizations

Body

Response