COSS
Audit log

Retrieve an audit event

GET
/v1/audit_events/{id}

Authorization

bearerAuth
headerAuthorizationBearer <token>

A secret API key from the dashboard: coss_live_… for production environments, coss_test_… for sandbox environments.

Path Parameters

id*string

The audit event's id.

Header Parameters

Coss-Version?"2026-10-10"

The API version (a date) to use for this request. Defaults to your organization's version, pinned to the latest one when it first used the API and upgraded from the dashboard. The SDK always sends the version it was built for.

Value in"2026-10-10"

Response Body

The audit event.

application/json
  1. response
object*"audit_event"
Value in"audit_event"
id*string
created_at*string
Formatdate-time
actor_type*AuditActorType

user: a member, in the dashboard (actor_id is the user's id, actor_label their email). api_key: a request made with an API key (actor_id is the key's id). system: COSS itself, including COSS support.

Value in"user""api_key""system"
actor_id*|

The user's or API key's id; null for the system.

actor_label*string

Who made the change, copied when it was recorded so it outlives them: the user's email, the API key's id, or COSS support.

action*string

<resource>.<verb>, e.g. api_key.created, domain.deleted, member.role_changed.

target_type*|

What was changed: domain, api_key, member…

target_id*string|null
target_label*|

A readable name for the target when it was changed.

project_id*|

null for organization-wide changes (domains, members…).

environment_id*|

null for organization-wide changes (domains, members…).

metadata*

Details of the change; API changes include their request_id.

client_ip*string|null
user_agent*string|null
import { Coss } from "coss";const coss = new Coss({  apiKey: process.env.COSS_API_KEY,  baseUrl: "https://api.coss.com",});const { data, error } = await coss.auditEvents.get("oaudit_01k7c8m4q2f3e9v6t5r1n0p8yz");
{  "object": "audit_event",  "id": "oaudit_01k7c8m4q2f3e9v6t5r1n0p8yz",  "created_at": "2026-01-15T09:30:00.000Z",  "actor_type": "api_key",  "actor_id": "key_01k7c8m4q2f3e9v6t5r1n0p8yz",  "actor_label": "key_01k7c8m4q2f3e9v6t5r1n0p8yz",  "action": "suppression.created",  "target_type": "suppression",  "target_id": "sup_01k7c8m4q2f3e9v6t5r1n0p8yz",  "target_label": "user@example.com",  "project_id": "proj_01k7c8m4q2f3e9v6t5r1n0p8yz",  "environment_id": "env_01k7c8m4q2f3e9v6t5r1n0p8yz",  "metadata": {    "scope": "*",    "request_id": "req_01k7c8m4q2f3e9v6t5r1n0p8yz"  },  "client_ip": "203.0.113.7",  "user_agent": "coss-node/0.1.0"}

Idempotency

Retry POST requests without sending twice.

List audit events GET

The organization's audit log, newest first: changes made by members in the dashboard, by API keys (from any environment) and by COSS support. The audit log is organization-wide, so every key of the organization reads the same events. Filter by action (an entry ending in `.` matches a whole resource, e.g. `domain.`), actor, target, environment or time. Pass the last `id` as `after` to get the next page while `has_more` is true. Reading the audit log is not itself logged.