List authentication audit events across the platform

Returns paginated authentication events from every tenant, intended for platform security analysts investigating cross-tenant brute-force or credential-stuffing patterns. When the {@code tenantIds} filter is omitted, the query INCLUDES pre-authentication events that never resolved to a tenant (tenant_id IS NULL) — these are the most valuable rows for attack detection. When the filter is provided, null-tenant rows are excluded by design. The applied window and the maximum this feed accepts are stated on every accepted response in appliedRange; this description asserts neither.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Query Params
tenantIds
array of uuids

Optional comma-separated list of tenant UUIDs. When omitted, the query returns events from ALL tenants INCLUDING pre-auth events with null tenantId.

tenantIds
string

Filter by principal identifier (exact match)

string

Filter by status: SUCCESS or FAILURE

string

Filter by error code (upper-snake case)

string

Filter by client IP address (IPv4 or IPv6 literal) — primary filter for brute-force investigation

string

Filter by operation type

string

Event type pattern (SQL LIKE, max 5 wildcards)

date-time

Start of time range (ISO-8601). Defaults to the applied window reported in appliedRange.

date-time

End of time range (ISO-8601). Defaults to now.

integer
≥ 0
Defaults to 0

Page number (zero-based)

integer
1 to 100
Defaults to 20

Page size. Values outside 1-100 are CLAMPED to the nearest bound, not rejected: size=5000 returns 100 rows with HTTP 200 and size=0 returns 1 row with HTTP 200. This operation clamps BOTH ends, unlike the other paginated reads on this controller, which cap above and reject below - so the declared range is EFFECTIVE and nothing on this parameter can produce a 400.

Headers
string
enum
Defaults to application/json

Generated from available response content types

Allowed:
Responses

Language
Credentials
Bearer
JWT
URL
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json
application/problem+json