Live-tail identity audit-log events (SSE)
/portal/v1/accounts/{accountSlug}/audit-log/identities/streamServer-Sent Events live-tail of newly written identity-surface audit rows (an end-user identity is the actor or the resource, so admin-on-identity actions appear here too), scoped to the current Account. Accepts the same filter DSL as the query endpoint; date range and cursor are ignored since every event is current. Each row is delivered in an event: audit-log frame. The stream closes on client disconnect or a 30-minute hard timeout, and is subject to a per-Account cap of 10 concurrent streams across both surfaces — exceeding it returns 429. Writes one audit.live_tail.started row at open and one audit.live_tail.ended row at close.
Authentication
AuthorizationJWT access token. Never send alongside X-API-Key: a request carrying both is refused.
audit.viewSecurityView the account-wide audit log. Granted through an administrator role in the Admin Workspace; a valid token without it is refused with 403.
Query Parameters
fromstring · date-time Optional Lower bound (inclusive). Defaults to `to - 30 days` when omitted.
tostring · date-time Optional Upper bound (inclusive). Defaults to `now()` when omitted.
actionstring[] Optional Filter by one or more action keys. Repeat the query param (`?action=a&action=b`) or pass a comma-separated string.
categoryenum Optional severityenum Optional outcomeenum Optional actor_idstring · uuid Optional actor_typestring Optional Free-form actor-type filter (e.g. `user`, `identity`).
resource_typestring Optional Free-form resource-type filter (e.g. `identity`, `role`, `node`).
resource_idstring · uuid Optional correlation_idstring · uuid Optional application_idstring · uuid Optional Narrow to rows for one Application within the Account. Omit to include all Applications.
environment_idstring · uuid Optional Narrow to rows for one Environment. Implies the Environment's parent Application. Omit to include all Environments.
qstring Optional Full-text query against actor_label, resource_label (trigram), and metadata (GIN).
cursorstring Optional Opaque base64url cursor returned by the previous response. Omit for the first page.
limitnumber Optional Page size. Defaults to 50; max 200.
Responses
Server-Sent Events stream of new audit rows as they're written. Accepts the same filter DSL as the query endpoint (date range and cursor are ignored — every event is 'now'). Each delivered row is wrapped in an `event: audit-log` frame with the serialized row as `data`. Connection closes on client disconnect, JWT expiry (within the request lifecycle), or a 30-minute hard timeout. Customer-visible rows only, scoped to this surface (admin or identities). Per-Account concurrency cap: 10 simultaneous streams across both surfaces combined. Writes one `audit.live_tail.started` row at open and one `audit.live_tail.ended` row at close.
application/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
application/json
errorApiErrorBodyDto
Errors
When the request can't be completed, the response body includes a stable error code you can branch on.
account.capability_requiredForbiddenThe signed-in user's administrator roles do not grant the capability this endpoint requires.
Ask an account administrator to grant a role carrying the capability named in the Authentication section, then retry.
curl -X GET "https://auth.canopy-io.com/portal/v1/accounts/{accountSlug}/audit-log/identities/stream?from=value&to=value&action=value&category=auth&severity=info&outcome=success&actor_id=value&actor_type=value&resource_type=value&resource_id=value&correlation_id=value&application_id=value&environment_id=value&q=value&cursor=value&limit=0" \ -H "Authorization: Bearer $CANOPY_TOKEN"
HTTP/1.1 200 Server-Sent Events stream of new audit rows as they're written. Accepts the same filter DSL as the query endpoint (date range and cursor are ignored — every event is 'now'). Each delivered row is wrapped in an `event: audit-log` frame with the serialized row as `data`. Connection closes on client disconnect, JWT expiry (within the request lifecycle), or a 30-minute hard timeout. Customer-visible rows only, scoped to this surface (admin or identities). Per-Account concurrency cap: 10 simultaneous streams across both surfaces combined. Writes one `audit.live_tail.started` row at open and one `audit.live_tail.ended` row at close. (empty body)
Tell us how we can improve this guide.