Audit trail (SIEM)
GET /v1/audit is a cursor-paged, read-only export of your organization's tamper-evident audit log. It exists so you can pull Strata's administrative record into Splunk, Sentinel, Chronicle or whatever else you already run, on a schedule, without anyone opening the admin UI.
It requires the audit:read scope. Grant it on its own key — a SIEM collector has no reason to also hold chat or files.
Read-only by contract
GET is the only verb. POST, PATCH, PUT and DELETE return 405 with an Allow: GET header. There is no delete or purge capability on this surface and there is not going to be one: a log your collector could edit is not evidence.
Scope
Rows come from the API key's own organization. There is no parameter that widens that, in either direction — a key cannot read another organization's audit log, and cannot be narrowed to less than its own.
Retention
The window is your organization's audit_retention_days (default 365, configurable at Admin → Organization Settings). since can narrow that window and can never widen it: a since that reaches further back than retention is clamped up to the retention floor rather than refused. The window actually served comes back in the retention field of the response, so a collector can record what it was given rather than what it asked for.
Parameters
| Parameter | Type | Notes |
|---|---|---|
limit | integer | Rows per page, maximum 1000. Clamped into range rather than refused. |
cursor | string | The opaque next_cursor from the previous page. A cursor this API did not issue returns 400. |
since | string | Inclusive lower bound (ISO 8601). Clamped up to the retention floor. |
until | string | Inclusive upper bound (ISO 8601). Same strict parsing as since. |
action | string | Exact action match, for example user.disabled. |
action_prefix | string | One prefix, or a comma-separated list — for example session.,user. — matching any action that starts with it. |
actor_user_id | string | Narrow to a single actor by id. Deliberately not by email, because a query string ends up in access logs. |
Pulling on a schedule
Page with cursor until has_more is false. Ordering is created_at DESC, id DESC and is stable, so a walk that resumes from a cursor neither skips nor repeats a row.
For an incremental nightly pull, record the newest created_at you ingested and pass it as since on the next run.
curl -H "Authorization: Bearer sk_strata_live_..." \
"<API_BASE_URL>/v1/audit?since=2026-08-21T00:00:00Z&limit=1000"Errors
Returns 400, 401, 402, 403, 405, 429, 500 and 503 — see Errors for the shape and the meaning of each. A key without audit:read gets 403.
Related
- Audit log — what is recorded, the detail tiers, and retention
- Authentication — scopes and key handling
- Rate limits and budgets