COSS
Audit log

List audit events

GET
/v1/audit_events

The organization's audit log, newest first: changes made by members in the dashboard, by API keys (from any environment) and by COSS support. The audit log is organization-wide, so every key of the organization reads the same events. Filter by action (an entry ending in . matches a whole resource, e.g. domain.), actor, target, environment or time. Pass the last id as after to get the next page while has_more is true. Reading the audit log is not itself logged.

Authorization

bearerAuth
headerAuthorizationBearer <token>

A secret API key from the dashboard: coss_live_… for production environments, coss_test_… for sandbox environments.

Query Parameters

action?string

Only these actions, comma-separated. An entry ending in . matches every action of that resource: domain.,api_key.created.

actor_type?string

Only these actor types, e.g. user,api_key.

actor_id?string

Only changes made by this user or API key.

Lengthlength <= 64
target_id?string

Only changes to this resource, e.g. a dom_… id.

Lengthlength <= 64
environment_id?string

Only changes in this environment.

Lengthlength <= 64
from?string

Only events at or after this time.

Formatdate-time
to?string

Only events before this time.

Formatdate-time
limit?integer

1-100, default 50.

Range1 <= value <= 100
after?string

Cursor: the id of the last event of the previous page.

Header Parameters

Coss-Version?"2026-10-10"

The API version (a date) to use for this request. Defaults to your organization's version, pinned to the latest one when it first used the API and upgraded from the dashboard. The SDK always sends the version it was built for.

Value in"2026-10-10"

Response Body

A page of audit events.

application/json
  1. response
object*"list"
Value in"list"
data*array<>
has_more*boolean
import { Coss } from "coss";const coss = new Coss({  apiKey: process.env.COSS_API_KEY,  baseUrl: "https://api.coss.com",});const { data, error } = await coss.auditEvents.list();
{  "object": "list",  "data": [    {      "object": "audit_event",      "id": "oaudit_01k7c8m4q2f3e9v6t5r1n0p8yz",      "created_at": "2026-01-15T09:30:00.000Z",      "actor_type": "api_key",      "actor_id": "key_01k7c8m4q2f3e9v6t5r1n0p8yz",      "actor_label": "key_01k7c8m4q2f3e9v6t5r1n0p8yz",      "action": "suppression.created",      "target_type": "suppression",      "target_id": "sup_01k7c8m4q2f3e9v6t5r1n0p8yz",      "target_label": "user@example.com",      "project_id": "proj_01k7c8m4q2f3e9v6t5r1n0p8yz",      "environment_id": "env_01k7c8m4q2f3e9v6t5r1n0p8yz",      "metadata": {        "scope": "*",        "request_id": "req_01k7c8m4q2f3e9v6t5r1n0p8yz"      },      "client_ip": "203.0.113.7",      "user_agent": "coss-node/0.1.0"    }  ],  "has_more": false}

Retrieve an audit event GET

Previous Page

Retrieve the organization's billing GET

The organization's plan (and contract), the current billing month's usage and what it would add to the next invoice so far, its standing (`past_due`, billing holds), payment method, and what the plan includes. Organization-wide: every environment's key sees the same. Plan changes are made in the dashboard; subscribe to the `billing.*` webhook events to follow them.