Overview
TheauditEvents query retrieves audit events for your team. Events follow the OCSF v1.5.0 standard and cover meeting operations, team operations, user settings changes, and authentication (login/logout) events.
This query requires an Enterprise plan and the requesting user must be a team admin. See pricing for more details.
Supported Events
Arguments
Int
default:"20"
Maximum number of events to return. Must be between 1 and 50.
String
Pagination cursor for fetching the next page of results. Use the
next_cursor value from a
previous response.AuditEventFiltersInput
required
Filters for the query. The
category field is required.Response Fields
[AuditEvent]
List of audit events matching the query.
Boolean
Indicates if there are more results available.
String
Cursor to use for fetching the next page of results.
Usage Example
Pagination
Use cursor-based pagination to fetch additional results:OCSF Compliance
All events conform to the OCSF v1.5.0 standard. Theclass_uid, activity_id, and type_uid fields map directly to OCSF event classification, enabling integration with SIEM tools and compliance pipelines.
Error Codes
List of possible error codes that may be returned by theauditEvents query. Full list of error codes can be found here.
paid_required (enterprise)
paid_required (enterprise)
You need to be on an Enterprise plan to query audit events.
require_elevated_privilege
require_elevated_privilege
You need to be a team admin to query audit events.
Additional Resources
Transcripts
Querying list of transcripts
Rule Executions
Querying automation rule executions