Export Audit Events
curl --request GET \
--url https://api.promptguard.co/api/v1/audit-events \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.promptguard.co/api/v1/audit-events"
headers = {"X-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.promptguard.co/api/v1/audit-events', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.promptguard.co/api/v1/audit-events",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.promptguard.co/api/v1/audit-events"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.promptguard.co/api/v1/audit-events")
.header("X-API-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.promptguard.co/api/v1/audit-events")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"organization_id": "12613a5a-ff26-4e72-8105-a36b40327a7c",
"organization_name": "Acme Corp",
"events": [
{
"schema_version": "1",
"event": "audit_event",
"event_id": "audit_1730453400123_9f2c41d07a6e",
"timestamp": "2026-11-01T09:30:00.123000+00:00",
"organization_id": "12613a5a-ff26-4e72-8105-a36b40327a7c",
"organization_name": "Acme Corp",
"project_id": null,
"project": null,
"actor_type": "user",
"actor_id": "9c1d2e3f-4a5b-4c6d-8e7f-0a1b2c3d4e5f",
"actor_ip": "203.0.113.7",
"category": "configuration",
"action": "member_role_changed",
"severity": "warning",
"outcome": "success",
"resource_type": "membership",
"resource_id": "5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9",
"description": "Changed a member's role from member to admin",
"details": {
"old_role": "member",
"new_role": "admin"
},
"integrity_hash": "3b1f9a0c6d2e4f8a7b5c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a",
"text": "[PromptGuard] Audit: member role changed in *Acme Corp* (success)",
"dashboard_url": "https://app.promptguard.co/dashboard/audit-log?org=12613a5a-ff26-4e72-8105-a36b40327a7c"
},
{
"schema_version": "1",
"event": "audit_event",
"event_id": "audit_1730453455871_04be7c9132fa",
"timestamp": "2026-11-01T09:30:55.871000+00:00",
"organization_id": "12613a5a-ff26-4e72-8105-a36b40327a7c",
"organization_name": "Acme Corp",
"project_id": null,
"project": null,
"actor_type": "user",
"actor_id": "9c1d2e3f-4a5b-4c6d-8e7f-0a1b2c3d4e5f",
"actor_ip": "203.0.113.7",
"category": "security",
"action": "api_key_rotated",
"severity": "info",
"outcome": "success",
"resource_type": "api_key",
"resource_id": "473ae10c-5be1-467a-8c3a-341dec5a7e88",
"description": "Rotated API key Production API",
"details": {},
"integrity_hash": "8e2d4c6b0a9f7e5d3c1b2a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d",
"text": "[PromptGuard] Audit: api key rotated in *Acme Corp* (success)",
"dashboard_url": "https://app.promptguard.co/dashboard/audit-log?org=12613a5a-ff26-4e72-8105-a36b40327a7c"
}
],
"next_cursor": "YXVkaXR8MTg0Mg",
"has_more": false
}Export Audit Events
The Organization’s audit trail, oldest first: what its people, keys and the system did there — role changes, key rotations, policy edits, sign-ins.
Every entry but each scan’s own decision, which is an event on
/api/v1/interactions. Requires a Plan that includes the audit trail.
Guide: SIEM export
GET
/
api
/
v1
/
audit-events
Export Audit Events
curl --request GET \
--url https://api.promptguard.co/api/v1/audit-events \
--header 'X-API-Key: <api-key>'import requests
url = "https://api.promptguard.co/api/v1/audit-events"
headers = {"X-API-Key": "<api-key>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {'X-API-Key': '<api-key>'}};
fetch('https://api.promptguard.co/api/v1/audit-events', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.promptguard.co/api/v1/audit-events",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"X-API-Key: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.promptguard.co/api/v1/audit-events"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("X-API-Key", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.promptguard.co/api/v1/audit-events")
.header("X-API-Key", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.promptguard.co/api/v1/audit-events")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["X-API-Key"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"organization_id": "12613a5a-ff26-4e72-8105-a36b40327a7c",
"organization_name": "Acme Corp",
"events": [
{
"schema_version": "1",
"event": "audit_event",
"event_id": "audit_1730453400123_9f2c41d07a6e",
"timestamp": "2026-11-01T09:30:00.123000+00:00",
"organization_id": "12613a5a-ff26-4e72-8105-a36b40327a7c",
"organization_name": "Acme Corp",
"project_id": null,
"project": null,
"actor_type": "user",
"actor_id": "9c1d2e3f-4a5b-4c6d-8e7f-0a1b2c3d4e5f",
"actor_ip": "203.0.113.7",
"category": "configuration",
"action": "member_role_changed",
"severity": "warning",
"outcome": "success",
"resource_type": "membership",
"resource_id": "5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9",
"description": "Changed a member's role from member to admin",
"details": {
"old_role": "member",
"new_role": "admin"
},
"integrity_hash": "3b1f9a0c6d2e4f8a7b5c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a",
"text": "[PromptGuard] Audit: member role changed in *Acme Corp* (success)",
"dashboard_url": "https://app.promptguard.co/dashboard/audit-log?org=12613a5a-ff26-4e72-8105-a36b40327a7c"
},
{
"schema_version": "1",
"event": "audit_event",
"event_id": "audit_1730453455871_04be7c9132fa",
"timestamp": "2026-11-01T09:30:55.871000+00:00",
"organization_id": "12613a5a-ff26-4e72-8105-a36b40327a7c",
"organization_name": "Acme Corp",
"project_id": null,
"project": null,
"actor_type": "user",
"actor_id": "9c1d2e3f-4a5b-4c6d-8e7f-0a1b2c3d4e5f",
"actor_ip": "203.0.113.7",
"category": "security",
"action": "api_key_rotated",
"severity": "info",
"outcome": "success",
"resource_type": "api_key",
"resource_id": "473ae10c-5be1-467a-8c3a-341dec5a7e88",
"description": "Rotated API key Production API",
"details": {},
"integrity_hash": "8e2d4c6b0a9f7e5d3c1b2a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d",
"text": "[PromptGuard] Audit: api key rotated in *Acme Corp* (success)",
"dashboard_url": "https://app.promptguard.co/dashboard/audit-log?org=12613a5a-ff26-4e72-8105-a36b40327a7c"
}
],
"next_cursor": "YXVkaXR8MTg0Mg",
"has_more": false
}Authorizations
PromptGuard API key for developer endpoints. Keys start with pg_live_ and are created in the dashboard.
Headers
Query Parameters
Read events from this time (ISO 8601). Default: 24 hours ago.
Read events before this time.
next_cursor from the previous page; replaces since.
Events per page.
Required range:
1 <= x <= 1000Response
Successful Response
One page of an Organization's audit trail, oldest first.
Show child attributes
Show child attributes
Where this page ended. Pass it back as cursor to read on; it is returned even when the page is short, so a poller always has its place. Null only when there was no position to report.
Whether another page is ready now.