Skip to content
bynhDocs
Log in

List audit events

GET/workspaces/{workspace}/audit-events

Returns the workspace’s audit log, newest first, plus sign-in activity by current members. Uses cursor pagination.

Authentication

Send an API token as a bearer token. This endpoint needs a read token, made by an admin or owner. Create one in My account → API tokens; see scopes and roles.

Authorization: Bearer 42|bynh_pat_•••••••Header

Path parameters

  • workspacestringRequired

    Your workspace slug, e.g. dokan.

Query parameters

  • categoryenum

    Actions starting with this prefix. One of auth, workspace, member, certificate, document, access_request.

  • actionstring

    Exact action, e.g. status.incident_opened or evidence.item_collected (max 64). Use this for prefixes not in category.

  • per_pageintegerdefault 50

    1–100.

  • cursorstring

    meta.next_cursor from the previous page.

Response

200 OK

Laravel cursor-paginated resource: data, links {first: null, last: null, prev, next}, meta {path, per_page, next_cursor, prev_cursor}.

  • idintegerEvent id.
  • actionstringDotted action, e.g. certificate.updated.
  • whostringLocalized actor name (or “bynh”, or the outside person’s email).
  • summarystringLocalized sentence.
  • actor{name, email}|nullMember who did it.
  • actor_emailstring|nullSet for outside actors (e.g. a subscriber).
  • subject{type, id}|nullMorph type (certificate, document, access_request, report, workspace, …) and id.
  • ip_addressstring|nullRequest IP.
  • user_agentstring|nullRequest user agent.
  • metadataobject|nullAction-specific details.
  • created_atstringISO 8601.

Rate limits

This endpoint counts toward your general limit of 120 requests a minute. When you go over, wait for the number of seconds in Retry-After.

Errors

401The token is missing, wrong, revoked or expired.
403The token owner is an editor or viewer: “Only owners and admins can read the audit log.”
404The token belongs to another workspace, or its owner is no longer a member.
422Unknown category, action over 64 characters, or per_page outside 1–100.

Every error is JSON with a message. See Errors.

Next →Export the audit log as CSV
curl "https://api.bynh.io/api/v1/workspaces/dokan/audit-events?category=certificate&per_page=50" \
  -H "Authorization: Bearer $BYNH_TOKEN" \
  -H "Accept: application/json"

Response200 OK

application/json
{
  "data": [
    {
      "id": 90412,
      "action": "certificate.updated",
      "who": "Sara Alqahtani",
      "summary": "Changed the note on ISO/IEC 27001:2022",
      "actor": {
        "name": "Sara Alqahtani",
        "email": "sara@dokan.sa"
      },
      "actor_email": null,
      "subject": {
        "type": "certificate",
        "id": 7
      },
      "ip_address": "212.26.40.18",
      "user_agent": "curl/8.7.1",
      "metadata": {
        "changed": [
          "note"
        ]
      },
      "created_at": "2026-10-01T08:31:44+00:00"
    }
  ],
  "links": {
    "first": null,
    "last": null,
    "prev": null,
    "next": "https://api.bynh.io/api/v1/workspaces/dokan/audit-events?cursor=eyJjcmVhdGVkX2F0IjoiMjAyNi0xMC0wMSAwODozMTo0NCIsImlkIjo5MDQxMiwiX3BvaW50c1RvTmV4dEl0ZW1zIjp0cnVlfQ"
  },
  "meta": {
    "path": "https://api.bynh.io/api/v1/workspaces/dokan/audit-events",
    "per_page": 50,
    "next_cursor": "eyJjcmVhdGVkX2F0IjoiMjAyNi0xMC0wMSAwODozMTo0NCIsImlkIjo5MDQxMiwiX3BvaW50c1RvTmV4dEl0ZW1zIjp0cnVlfQ",
    "prev_cursor": null
  }
}

Examples use Dokan, a sample workspace. Responses are shortened where lists are long.