API documentation | API docs for agents | OpenAPI 3.1
GET /api/v1/audit/events
ark.search_audit_events
Searches the permissioned ARK audit timeline by view, domain, subject, actor, event, provider, trace, team, date range, or text query.
- Availability
- Expanded preview
- Scopes
audit:read- ARK permissions
canViewAuditTimeline- Team visibility
- Not entity-scoped
- Idempotency-Key
- Not required
- Approval
- No MCP approval on REST API-token calls
- Rate limit
- API credential and organization budgets
Parameters
viewqueryAuditViewdomainViewqueryAuditDomainViewqquerystring- min length: 1; max length: 200
fromquerystring- format: date-time
toquerystring- format: date-time
subjectTypequerystring- max length: 100
subjectIdquerystring- max length: 200
actorUserIdquerystring- format: uuid
actorTypequerystring- max length: 100
eventKeyquerystring- max length: 200
eventFamilyquerystring- max length: 100
visibilityClassquerystring- one of: business, security, admin, operational
sourcequerystring- max length: 100
providerquerystring- max length: 100
correlationIdquerystring- max length: 200
transactionIdquerystringidempotencyKeyquerystring- max length: 200
requestIdquerystring- max length: 200
teamIdquerystring- format: uuid
cursorOccurredAtquerystring- format: date-time
cursorIdquerystring- format: uuid
limitqueryinteger- default: 50; min: 1; max: 100
Request body
None.
Example request
Shell
curl 'https://arktms.com/api/v1/audit/events' \
-H "Authorization: Bearer $ARK_API_TOKEN"Success response
Audit events
objectstringrequiredokbooleanrequiredapi_versionstringrequiredrequest_idstringrequireddataobjectrequireddata.viewstringrequiredone of: activity, security, payments, integrations, exports, diagnostics; default: "activity"
data.domainViewstring | nullrequireddata.rowsarray<object>requireddata.nextCursorobject | nullrequiredErrors
HTTP 400- Invalid request
HTTP 401- Authentication required
HTTP 403- Permission, scope, team, or entitlement denied