> ## Documentation Index
> Fetch the complete documentation index at: https://docs.microsandbox.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# List audit events



## OpenAPI

````yaml /api-reference/openapi.json get /v1/events
openapi: 3.1.0
info:
  title: microsandbox cloud API
  description: >-
    REST API for microsandbox cloud: sandbox and volume lifecycle, organization
    context, quotas, usage, and audit events, authenticated with an organization
    API key.
  version: 0.1.0
servers:
  - url: https://api.microsandbox.dev
security:
  - api_key: []
paths:
  /v1/events:
    get:
      tags:
        - Audit events
      summary: List audit events
      operationId: list_events
      parameters:
        - name: event_type
          in: query
          description: Filter by event type (e.g. "api_key_created").
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: since
          in: query
          description: Only return events at or after this timestamp.
          required: false
          schema:
            type:
              - string
              - 'null'
            format: date-time
        - name: until
          in: query
          description: Only return events at or before this timestamp.
          required: false
          schema:
            type:
              - string
              - 'null'
            format: date-time
        - name: cursor
          in: query
          description: Opaque cursor from a previous response.
          required: false
          schema:
            type:
              - string
              - 'null'
        - name: limit
          in: query
          description: 'Number of items to return (default: 20, max: 100).'
          required: false
          schema:
            type:
              - integer
              - 'null'
            format: int64
      responses:
        '200':
          description: Paginated list of audit events
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedEventResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              example:
                error:
                  code: invalid_api_key
                  message: unauthorized
                  details: null
      security:
        - api_key: []
components:
  schemas:
    PaginatedEventResponse:
      type: object
      description: >-
        Wrapper for paginated event responses (needed for OpenAPI schema
        generation).
      required:
        - data
        - has_more
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/EventResponse'
        has_more:
          type: boolean
        next_cursor:
          type:
            - string
            - 'null'
    ErrorResponse:
      type: object
      description: Error envelope returned by every non-2xx response.
      required:
        - error
      properties:
        error:
          type: object
          required:
            - code
            - message
          properties:
            code:
              type: string
              description: Stable machine-readable error code, e.g. `invalid_api_key`.
            message:
              type: string
              description: Human-readable description of the error.
            details:
              type:
                - object
                - 'null'
              description: Optional structured context for the error.
    EventResponse:
      type: object
      description: A single audit/lifecycle event returned by the API.
      required:
        - id
        - org_id
        - category
        - event_type
        - actor
        - payload
        - timestamp
      properties:
        actor:
          $ref: '#/components/schemas/EventActor'
        category:
          type: string
        event_type:
          type: string
        id:
          type: string
          format: uuid
        org_id:
          type: string
          format: uuid
        payload: {}
        timestamp:
          type: string
          format: date-time
    EventActor:
      oneOf:
        - type: object
          required:
            - user_id
            - label
            - redacted_email
            - kind
          properties:
            kind:
              type: string
              enum:
                - user
            label:
              type: string
            redacted_email:
              type: string
            user_id:
              type: string
              format: uuid
        - type: object
          required:
            - api_key_id
            - name
            - kind
          properties:
            api_key_id:
              type: string
              format: uuid
            kind:
              type: string
              enum:
                - api_key
            name:
              type: string
        - type: object
          required:
            - code
            - label
            - kind
          properties:
            code:
              type: string
            kind:
              type: string
              enum:
                - system
            label:
              type: string
        - type: object
          description: >-
            The authorized SSH key that authenticated a front-door session. The

            principal SSH actually proves at connect is the *key*, not a person
            -

            the scope-only model (D8) doesn't bind a key to a user (a global key
            may

            be shared), so the session is attributed to the key (label +
            fingerprint),

            while whoever registered it rides the event payload as `added_by`.
          required:
            - key_id
            - fingerprint
            - kind
          properties:
            fingerprint:
              type: string
              description: '`SHA256:…` fingerprint.'
            key_id:
              type: string
              format: uuid
            kind:
              type: string
              enum:
                - ssh_key
            label:
              type:
                - string
                - 'null'
              description: Human label set at registration (e.g. `alice-laptop`), if any.
      description: |-
        Maximum total length, in characters, of the truncated `command` field in
        Immutable actor snapshot stored alongside an event.
  securitySchemes:
    api_key:
      type: http
      scheme: bearer
      description: Organization API key (msb_…) - org-scoped programmatic access.

````