Export a team’s audit log

Part of Teams, 14 operations. The overview covers keys, scopes and errors.

GET /v1/org/{id}/audit

The team’s audit log, oldest first, as NDJSON (default) or CSV: who, on which device and through which agent, used which credential class for what, and the outcome. Rows are kept for a year. Owners and admins only; a member gets 403 and a caller outside the team 404. At most limit rows per request; when more remain, the x-next-cursor header carries the cursor for the next page. Columns, in CSV order: ts, org_id, actor_user_id, actor_email, device_id, agent, credential_class, credential_ref, action, target, outcome, request_id, ip, ua.

A caller key holding teams:read (Authorization: Bearer sbc_… or x-api-key: sbc_…), or a signed-in session.

Operation id exportTeamAuditLog in Teams.

Path parameters

id string required
The team id (org_…).

Query parameters

format string optional
Attachment format; default ndjson. One of ndjson, csv.
since string (date-time) optional
Rows at or after this time; default a year ago.
until string (date-time) optional
Rows before this time; default now.
cursor string optional
The previous page’s x-next-cursor.
limit integer optional
Rows per page; default 1000, and anything above 5000 is read as 5000.

Response 200

The rows, as an attachment.

application/x-ndjson: string.

text/csv: string.

Errors

Status	Code	What to change
400	`invalid_request`	A parameter or body field is invalid; `param` names it and `issues` lists every problem.
401	`unauthorized`	Send a live caller key or session as `Authorization: Bearer …` or `x-api-key`. No key yet: create one at /account/api, or sign a user in at /auth.md.
403	`insufficient_scope`	The key lacks the scope in `required_scopes`; mint a key that holds it.
404	`not_found`	No such resource on this account; check the id.
503		The audit store is unavailable; retry later.

view .md openapi

Request

curl

curl -sS -X GET "https://superbot.gg/v1/org/$ID/audit" \
  -H "Authorization: Bearer $SUPERBOT_API_KEY"

JavaScript

const id = 'ID';
const res = await fetch(`https://superbot.gg/v1/org/${id}/audit`, {
  method: 'GET',
  headers: {
    Authorization: `Bearer ${process.env.SUPERBOT_API_KEY}`,
  },
});
console.log(res.status, await res.json());

Python

import os
import requests

id = "ID"
res = requests.request(
    "GET",
    f"https://superbot.gg/v1/org/{id}/audit",
    headers={
        "Authorization": f"Bearer {os.environ['SUPERBOT_API_KEY']}",
    },
)
print(res.status_code, res.json())

Response

200 The rows, as an attachment.

application/x-ndjson: string

400 The request is malformed or a parameter is invalid; `param` names the field.

{
  "error": "invalid_request",
  "message": "A parameter or body field is invalid; param names it and issues lists every problem.",
  "doc_url": "https://superbot.gg/developers#errors-invalid_request",
  "request_id": "req_5f1c0a9e2b7d4c3a1e0f9b8d"
}

401 The bearer is missing, malformed or unknown.

{
  "error": "unauthorized",
  "message": "Send a live caller key or session as Authorization: Bearer … or x-api-key. No key yet: create one at /account/api, or sign a user in at /auth.md.",
  "doc_url": "https://superbot.gg/developers#errors-unauthorized",
  "request_id": "req_5f1c0a9e2b7d4c3a1e0f9b8d"
}

403 The key lacks a scope (insufficient_scope), is revoked, or may not call this route.

{
  "error": "insufficient_scope",
  "message": "The key lacks the scope in required_scopes; mint a key that holds it.",
  "doc_url": "https://superbot.gg/developers#errors-insufficient_scope",
  "request_id": "req_5f1c0a9e2b7d4c3a1e0f9b8d"
}

404 No such resource on this account.

{
  "error": "not_found",
  "message": "No such resource on this account; check the id.",
  "doc_url": "https://superbot.gg/developers#errors-not_found",
  "request_id": "req_5f1c0a9e2b7d4c3a1e0f9b8d"
}

503 The audit store is unavailable; retry later.

{
  "error": "insufficient_scope",
  "message": "your-message",
  "doc_url": "https://example.com",
  "request_id": "req_5f1c0a9e2b7d4c3a1e0f9b8d",
  "param": "your-param"
}