> ## Documentation Index > Fetch the complete documentation index at: https://docs.granola.ai/llms.txt > Use this file to discover all available pages before exploring further. # List audit events ## OpenAPI ````yaml get /v1/audit openapi: 3.1.0 info: title: Granola API version: 1.0.0 description: API for accessing meeting data from Granola servers: - url: https://public-api.granola.ai description: Production security: [] paths: /v1/audit: get: summary: List audit events parameters: - schema: type: string pattern: ^[a-z][a-z0-9_.-]*$ description: >- Return only events with this exact action, or events whose action starts with it followed by a dot (`workspace` returns `workspace.member_added` but not `workspace_automation.created`). Lowercase, as actions are. example: workspace required: false name: action in: query - schema: anyOf: - type: string format: date - type: string format: date-time description: >- Return events that occurred before this date. Must fall within the one-year retention window; an earlier date is rejected. examples: - '2026-01-27' - '2026-01-27T15:30:00Z' required: false name: occurred_before in: query - schema: anyOf: - type: string format: date - type: string format: date-time description: >- Return events that occurred after this date. Must fall within the one-year retention window; an earlier date is rejected. examples: - '2026-01-27' - '2026-01-27T15:30:00Z' required: false name: occurred_after in: query - schema: type: string description: The cursor to continue from example: eyJjcmVkZW50aWFsfQ== required: false name: cursor in: query - schema: type: integer minimum: 1 maximum: 30 default: 10 description: Maximum number of audit events to return per page example: 10 required: false name: page_size in: query responses: '200': description: List of audit events content: application/json: schema: type: object properties: events: type: array items: type: object properties: id: type: string pattern: ^aud_[a-zA-Z0-9]{14}$ description: The ID of the audit event example: aud_7Kq2mXbT9vRp3L object: type: string enum: - audit_event description: The object type of the audit event action: type: string description: >- The action that was recorded. See the [audit events reference](/audit-events) for every action and the `data` it carries. Actions are added over time, so treat this as an open set of strings rather than a fixed list. example: workspace.member_added occurred_at: type: string format: date-time description: When the action happened, to the millisecond example: '2026-01-27T15:30:00.482Z' collected_at: type: string format: date-time description: >- When Granola recorded the event. Usually the same moment as `occurred_at`, but later for events we learn about after the fact — a meeting recording is recorded once its summary finishes, and a note viewed offline is recorded when that device next reaches us. Events are returned in `collected_at` order, so this is the field that never moves under a cursor, and it carries microseconds to keep events that share a millisecond ordered. example: '2026-01-27T15:30:04.109733Z' actor: oneOf: - type: object properties: object: type: string enum: - api_key description: The object type of the actor id_suffix: type: string pattern: ^[A-Za-z0-9]{8}$ description: >- The final eight characters of the non-secret API key identifier. example: aB3dE7hK required: - object - id_suffix description: A public API key authenticated the request. title: API key example: object: api_key id_suffix: aB3dE7hK - type: object properties: object: type: string enum: - user description: The object type of the actor id: type: - string - 'null' pattern: ^usr_[a-zA-Z0-9]{14}$ description: >- The ID of the user who performed the action, or null if the recorded actor was not a resolvable user. example: usr_3nQ8vLpZ2kR7dY email: type: - string - 'null' format: email description: >- The email of the user who performed the action, or null if the account no longer exists. example: oat@granola.ai required: - object - id - email description: A person in your workspace performed the action. title: User example: object: user id: usr_3nQ8vLpZ2kR7dY email: oat@granola.ai - type: object properties: object: type: string enum: - system description: The object type of the actor required: - object description: >- No identifiable user performed the action — it came from an automated process, such as a scheduled job or an inbound webhook from a connected service. This variant carries no other fields. title: System example: object: system - type: object properties: object: type: string enum: - anonymous description: The object type of the actor required: - object description: >- A person performed the action without signing in, so there is no account to name — for example, someone opening a note through a shared link. Distinct from `system`, which means no person was involved at all. This variant carries no other fields; the `ip_address` and `user_agent` in `context` are the only attribution available. title: Anonymous example: object: anonymous description: Who performed the action data: type: object description: >- Details of the action. The fields depend on the action, and their names are the ones Granola records internally, so they are camelCase rather than snake_case. See the [audit events reference](/audit-events) for the fields each action carries. additionalProperties: true example: role: member context: type: object properties: ip_address: type: - string - 'null' description: >- The IP address the request came from, or null if it was not recorded. example: 203.0.113.42 user_agent: type: - string - 'null' description: >- The user agent of the client that made the request, or null if it was not recorded. example: Granola/7.400.0 (macOS 15.3) client_version: type: - string - 'null' description: >- The Granola client version that made the request, or null if it was not recorded. example: 7.400.0 required: - ip_address - user_agent - client_version description: >- How the request that produced this event reached Granola example: ip_address: 203.0.113.42 user_agent: Granola/7.400.0 (macOS 15.3) client_version: 7.400.0 required: - id - object - action - occurred_at - collected_at - actor - data - context hasMore: type: boolean description: >- Whether there are more audit events to fetch. A page can hold fewer than `page_size` events and still not be the last one, so page on this and `cursor` rather than on the number of events returned. example: true cursor: type: - string - 'null' description: The cursor to continue from example: eyJjcmVkZW50aWFsfQ== required: - events - hasMore - cursor '400': description: Bad request '401': description: Unauthorized - Invalid API key security: - ApiKeyAuth: [] components: securitySchemes: ApiKeyAuth: type: http scheme: bearer bearerFormat: apiKey ````