Live-tail admin audit-log events (SSE)
/portal/v1/accounts/{accountSlug}/audit-log/admin/streamServer-Sent Events live-tail of newly written admin audit rows (actor is an operator: user, api_key, platform, system), scoped to the current Account. Accepts the same filter DSL as the query endpoint; date range and cursor are ignored since every event is current. Each row is delivered in an event: audit-log frame. The stream closes on client disconnect or a 30-minute hard timeout, and is subject to a per-Account cap of 10 concurrent streams across both surfaces — exceeding it returns 429. Writes one audit.live_tail.started row at open and one audit.live_tail.ended row at close.
Authentication
AuthorizationJWT access token. Never send alongside X-API-Key: a request carrying both is refused.
audit.viewSecurityView the account-wide audit log. Granted through an administrator role in the Admin Workspace; a valid token without it is refused with 403.
Path Parameters
accountSlugstring Required The Account's slug. An unknown one answers 404.
Query Parameters
fromstring · date-time Optional Lower bound (inclusive). Defaults to `to - 30 days` when omitted.
tostring · date-time Optional Upper bound (inclusive). Defaults to `now()` when omitted.
actionstring[] Optional Filter by one or more action keys. Repeat the query param (`?action=a&action=b`) or pass a comma-separated string.
categoryenum Optional severityenum Optional outcomeenum Optional actor_idstring · uuid Optional actor_typestring Optional Free-form actor-type filter (e.g. `user`, `identity`).
resource_typestring Optional Free-form resource-type filter (e.g. `identity`, `role`, `node`).
resource_idstring · uuid Optional correlation_idstring · uuid Optional application_idstring · uuid Optional Narrow to rows for one Application within the Account. Omit to include all Applications.
environment_idstring · uuid Optional Narrow to rows for one Environment. Implies the Environment's parent Application. Omit to include all Environments.
qstring Optional Full-text query against actor_label, resource_label (trigram), and metadata (GIN).
cursorstring Optional Opaque base64url cursor returned by the previous response. Omit for the first page.
limitnumber Optional Page size. Defaults to 50; max 200.
Responses
text/event-stream
stringapplication/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
Errors
When the request can't be completed, the response body includes a stable error code you can branch on, and a correlation_id (also sent as the X-Correlation-Id header). Quote the correlation id when you contact support: it identifies the exact request in Canopy's logs.
account.capability_requiredForbiddenThe signed-in user's administrator roles do not grant the capability this endpoint requires.
Ask an account administrator to grant a role carrying the capability named in the Authentication section, then retry.
curl -X GET "https://auth.canopy-io.com/portal/v1/accounts/value/audit-log/admin/stream?from=value&to=value&action=value&category=auth&severity=info&outcome=success&actor_id=value&actor_type=value&resource_type=value&resource_id=value&correlation_id=value&application_id=value&environment_id=value&q=value&cursor=value&limit=0" \ -H "Authorization: Bearer $CANOPY_TOKEN"
Content-Type: text/event-stream
event: audit-log
data: {"id":"3f2c…","action":"identity.created","actor_type":"user","resource_type":"identity","created_at":"2026-10-05T12:00:00.000Z"}
Tell us how we can improve this guide.