Management API — Audit Trail

Read the organization’s trail of management actions. Requires a Management API Key and is scoped to its organization — see the Overview for authentication and error conventions.

Each successful folder, member, and Red Team API Key mutation appends one audit entry. A rejected action leaves no entry. Entries record identifiers and the action only — no folder, key, or user content is ever stored.

List audit entries

GET /management/audit

Returns entries newest first.

$
curl -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
>
  "https://$LAKERA_RED_HOST/management/audit?limit=50"

1
{
2
  "entries": [
3
    {
4
      "id": "...",
5
      "at": 1786546819835,
6
      "actorUserId": "...",
7
      "keyId": "...",
8
      "action": "folder.key.created",
9
      "folderId": "...",
10
      "targetKeyId": "..."
11
    }
12
  ],
13
  "nextCursor": 1786546819835
14
}

actorUserId is the owner of the Management API Key that performed the action, and keyId is that key. folderId, memberUserId, and targetKeyId appear only for actions that touch those resources.

Page through history

nextCursor is the before value to pass to fetch the next page, or null when the last page has been reached. Keep requesting with it until it comes back null:

$
curl -H "Authorization: Bearer $LAKERA_MANAGEMENT_KEY" \
>
  "https://$LAKERA_RED_HOST/management/audit?limit=100&before={nextCursor}"