> ## Documentation Index > Fetch the complete documentation index at: https://apidocs.sessionboard.com/llms.txt > Use this file to discover all available pages before exploring further. # List audit trail > Every recorded change to your organization's data — who changed which record, which property, and (by default) the new value. `action` is `.`, for example `session.update`. No retention limit. ## OpenAPI ````yaml /api-reference/openapi.yaml get /v1/logs/audit-trail openapi: 3.1.0 info: title: Sessionboard Public API version: '1.0' description: >- REST API for managing sessions, speakers, contacts, sponsors, exhibitors, and event data on the Sessionboard platform. contact: name: Sessionboard Support email: support@sessionboard.com termsOfService: https://www.sessionboard.com/legal/terms-of-service servers: - url: https://public-api.sessionboard.com description: US Region - url: https://public-api-eu.sessionboard.com description: EU Region security: - ApiKey: [] - BearerToken: [] tags: - name: Events description: Manage events on the platform. - name: Sessions description: Search and retrieve sessions within an event. - name: Session Writes description: >- Create, update, delete, and restore sessions. Requires the `write:sessions` scope. - name: Contact Writes description: >- Create, update, delete, and restore contacts. Requires the `write:contacts` scope. - name: Exhibitor Writes description: >- Create, update, delete, and restore exhibitors. Requires the `write:exhibitors` scope. - name: Sponsor Writes description: >- Create, update, delete, and restore sponsors. Requires the `write:sponsors` scope. - name: Field Writes description: >- Create, update, and delete custom fields. Requires the `write:fields` scope. - name: Speakers description: Search and retrieve speakers within an event. - name: Participants description: | Search and retrieve every contact holding a session role on an event — speakers, chairpersons, moderators and custom roles — with the roles each one holds, and list the event's participant roles. - name: Contacts description: Search and retrieve contacts at the organization or event level. - name: Sponsors description: Search and retrieve sponsors within an event. - name: Exhibitors description: Search and retrieve exhibitors within an event. - name: Event Settings description: >- Retrieve event configuration such as fields, tags, tracks, rooms, formats, levels, languages, and session statuses. - name: GDPR description: Manage GDPR data access and erasure requests. - name: Insights description: >- Query event data using SbQL, generate queries with AI, and manage dashboards. - name: Metadata Writes description: >- Create, update, and delete session metadata (rooms, tracks, tags, formats, levels, languages, statuses). Requires the `write:metadata` scope. - name: Agenda Planning description: >- Manage agenda drafts, draft sessions, scheduling rules, and evaluation personas. Requires the `write:events` scope. - name: Dashboards & Widgets description: >- Create, read, update, and delete dashboards and widgets at the event or organization level. Requires `write:events` scope for writes. - name: Reports & Queries description: >- Create, read, update, delete, and run saved SbQL queries/reports at the event or organization level. Requires `write:events` scope for writes. - name: Transcriptions description: >- Transcript text on sessions — fragments, summaries, insights, and translations. Requires `read:transcriptions` / `write:transcriptions` scopes. - name: Session Recordings description: >- Session audio files for recording archives (live capture or imported audio). Requires `read:transcriptions` / `write:transcriptions` scopes. - name: Media description: >- Upload video or audio files for automatic transcription. Requires `read:media` / `write:media` scopes. - name: Session Files description: > Documents attached to sessions (PDFs, PowerPoint, Word, images, and similar). Simple upload: `POST .../files/upload` (multipart, max 50 MB). Direct-to-storage: create → PUT → complete (max 500 MB). Requires `read:sessions` / `write:sessions` scopes. See the [Uploading session files](/guides/uploading-session-files) guide. - name: OAuth description: >- OAuth 2.1 endpoints for AI client authorization (Claude, ChatGPT). Mounted at `/oauth/` (not `/v1/`). - name: Log Export description: > Pull your organization's API request, security and audit logs into a SIEM such as Splunk, Microsoft Sentinel or Elastic. Requires a dedicated API token with the `read:audit_logs` scope, which can call nothing else. See the [Exporting logs to a SIEM](/guides/exporting-logs-to-a-siem) guide. paths: /v1/logs/audit-trail: get: tags: - Log Export summary: List audit trail description: > Every recorded change to your organization's data — who changed which record, which property, and (by default) the new value. `action` is `.`, for example `session.update`. No retention limit. operationId: list-log-audit-trail parameters: - $ref: '#/components/parameters/LogCursor' - $ref: '#/components/parameters/LogSince' - $ref: '#/components/parameters/LogLimit' - name: subject_type in: query required: false schema: type: string example: session,contact description: >- Comma-separated record types to include, for example `session,contact`. - name: include_values in: query required: false schema: type: boolean default: true description: >- Set `false` to omit changed values (`details.value`) — useful when the SIEM must not hold personal data. responses: '200': description: One page of events, oldest first. headers: RateLimit-Limit: $ref: '#/components/headers/RateLimitLimit' RateLimit-Remaining: $ref: '#/components/headers/RateLimitRemaining' content: application/json: schema: $ref: '#/components/schemas/LogPage' '400': description: > `VALIDATION_ERROR` for a bad parameter; `INVALID_CURSOR` for a cursor that is malformed or was issued for another stream or organization; `CURSOR_FILTER_MISMATCH` when the filters differ from the ones the cursor was issued with; `SINCE_BEFORE_RETENTION` when `since` is older than the stream keeps. content: application/json: schema: $ref: '#/components/schemas/LogExportError' '401': description: Missing, invalid, revoked or expired API token. '403': description: >- The token does not hold `read:audit_logs`, or it is an OAuth token. Log export accepts API tokens only. '410': description: >- `CURSOR_EXPIRED` — the cursor points before the start of retention. Restart from `since`. content: application/json: schema: $ref: '#/components/schemas/LogExportError' '429': description: Rate limited. 60 requests per minute per token; honor `Retry-After`. security: - ApiKey: [] components: parameters: LogCursor: name: cursor in: query required: false schema: type: string maxLength: 2048 description: > `next_cursor` from the previous page. Store it after each page and send it back unchanged; it remembers your filters, so repeat the same filters with it. LogSince: name: since in: query required: false schema: type: string format: date-time description: >- Where to start when you have no cursor. Defaults to 24 hours ago. Ignored when `cursor` is sent. LogLimit: name: limit in: query required: false schema: type: integer minimum: 1 maximum: 1000 default: 500 description: Events per page. headers: RateLimitLimit: description: Requests allowed in the current window. schema: type: integer RateLimitRemaining: description: Requests left in the current window. schema: type: integer schemas: LogPage: type: object required: - data - next_cursor - has_more properties: data: type: array items: $ref: '#/components/schemas/LogEvent' next_cursor: type: string description: > Send this as `cursor` on the next call. On an empty page it is the cursor you sent, so a caught-up poller keeps it and waits. has_more: type: boolean description: >- `true` when more events are ready now — fetch again immediately. `false` means wait before polling. LogExportError: type: object properties: error: type: string enum: - VALIDATION_ERROR - INVALID_CURSOR - CURSOR_FILTER_MISMATCH - SINCE_BEFORE_RETENTION - CURSOR_EXPIRED message: type: string LogEvent: type: object description: > One event, in the same shape on every stream. Events appear about a minute after they happen and are ordered by when Sessionboard recorded them, so a late-arriving event is never skipped. properties: id: type: string description: Stable event id. Use it to de-duplicate if you replay a page. stream: type: string enum: - api-requests - security-events - audit-trail occurred_at: type: string format: date-time description: When the event happened. ingested_at: type: string format: date-time description: When Sessionboard recorded it. Pages are ordered by this. action: type: string description: >- `GET /v1/events` for API requests, the event type (for example `login.password_ok` or `login.challenge_failed`) for security events, `.` for the audit trail. example: GET /v1/events outcome: type: string enum: - success - failure - unknown reason: type: string nullable: true description: Why it failed, when it did. actor: type: object properties: type: type: string description: >- `api_token`, `oauth_token` or `anonymous` for API requests; `user` or `admin` for security events; `user`, `system` or `rule` (an automation) for the audit trail. id: type: string nullable: true name: type: string nullable: true token_hint: type: string nullable: true description: Last characters of the token id, for API requests. user_email: type: string nullable: true src_ip: type: string nullable: true user_agent: type: string nullable: true status: type: integer nullable: true description: HTTP status, for API requests. duration_ms: type: integer nullable: true description: Response time, for API requests. target: type: object nullable: true properties: type: type: string example: event id: type: string details: type: object additionalProperties: true description: >- Stream-specific fields (for example `source` and `request_id` for API requests, `property` and `value` for the audit trail). securitySchemes: ApiKey: type: apiKey in: header name: x-access-token description: >- Organization API token. Generate from Organization Settings → API Tokens. BearerToken: type: http scheme: bearer description: >- OAuth 2.1 access token. Obtained via the OAuth PKCE flow at `/oauth/token`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.