> ## Documentation Index > Fetch the complete documentation index at: https://docs.promptguard.co/llms.txt > Use this file to discover all available pages before exploring further. # Stream Audit Events > The Organization's audit trail as server-sent events, from where the reader left off. Each entry is one `audit_event` frame whose `id` is its cursor, so a client that reconnects with `Last-Event-ID` resumes after the last entry it received. A comment line every few seconds keeps idle connections open. Guide: [SIEM export](https://docs.promptguard.co/integrations/siem-export#audit-events) ## OpenAPI ````yaml /api-reference/openapi-developer.json get /api/v1/audit-events/stream openapi: 3.1.0 info: title: PromptGuard Developer API description: >- Public API for developers to integrate PromptGuard security into their applications version: 1.0.0 servers: - url: https://api.promptguard.co description: Production security: - ApiKeyAuth: [] paths: /api/v1/audit-events/stream: get: tags: - SIEM export summary: Stream Audit Events description: >- The Organization's audit trail as server-sent events, from where the reader left off. Each entry is one `audit_event` frame whose `id` is its cursor, so a client that reconnects with `Last-Event-ID` resumes after the last entry it received. A comment line every few seconds keeps idle connections open. Guide: [SIEM export](https://docs.promptguard.co/integrations/siem-export#audit-events) operationId: stream_audit_events_api_v1_audit_events_stream_get parameters: - name: since in: query required: false schema: anyOf: - type: string format: date-time - type: 'null' description: 'Read events from this time (ISO 8601). Default: 24 hours ago.' title: Since description: 'Read events from this time (ISO 8601). Default: 24 hours ago.' - name: cursor in: query required: false schema: anyOf: - type: string - type: 'null' description: '`next_cursor` from the previous page; replaces `since`.' title: Cursor description: '`next_cursor` from the previous page; replaces `since`.' - name: Last-Event-ID in: header required: false schema: anyOf: - type: string - type: 'null' title: Last-Event-Id - name: x-api-key in: header required: false schema: anyOf: - type: string - type: 'null' title: X-Api-Key responses: '200': description: Server-sent events, until the client disconnects content: text/event-stream: schema: type: string example: >+ event: connected data: {} id: YXVkaXR8MTg0MQ event: audit_event data: {"schema_version": "1", "event": "audit_event", "event_id": "audit_1730453400123_9f2c41d07a6e", "timestamp": "2026-11-01T09:30:00.123000+00:00", "organization_id": "12613a5a-ff26-4e72-8105-a36b40327a7c", "organization_name": "Acme Corp", "project_id": null, "project": null, "actor_type": "user", "actor_id": "9c1d2e3f-4a5b-4c6d-8e7f-0a1b2c3d4e5f", "actor_ip": "203.0.113.7", "category": "configuration", "action": "member_role_changed", "severity": "warning", "outcome": "success", "resource_type": "membership", "resource_id": "5e6f7a8b-9c0d-4e1f-a2b3-c4d5e6f7a8b9", "description": "Changed a member's role from member to admin", "details": {"old_role": "member", "new_role": "admin"}, "integrity_hash": "3b1f9a0c6d2e4f8a7b5c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a", "text": "[PromptGuard] Audit: member role changed in *Acme Corp* (success)", "dashboard_url": "https://app.promptguard.co/dashboard/audit-log?org=12613a5a-ff26-4e72-8105-a36b40327a7c"} id: YXVkaXR8MTg0Mg event: audit_event data: {"schema_version": "1", "event": "audit_event", "event_id": "audit_1730453455871_04be7c9132fa", "timestamp": "2026-11-01T09:30:55.871000+00:00", "organization_id": "12613a5a-ff26-4e72-8105-a36b40327a7c", "organization_name": "Acme Corp", "project_id": null, "project": null, "actor_type": "user", "actor_id": "9c1d2e3f-4a5b-4c6d-8e7f-0a1b2c3d4e5f", "actor_ip": "203.0.113.7", "category": "security", "action": "api_key_rotated", "severity": "info", "outcome": "success", "resource_type": "api_key", "resource_id": "473ae10c-5be1-467a-8c3a-341dec5a7e88", "description": "Rotated API key Production API", "details": {}, "integrity_hash": "8e2d4c6b0a9f7e5d3c1b2a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d", "text": "[PromptGuard] Audit: api key rotated in *Acme Corp* (success)", "dashboard_url": "https://app.promptguard.co/dashboard/audit-log?org=12613a5a-ff26-4e72-8105-a36b40327a7c"} : keep-alive '401': description: Missing, malformed, unknown, disabled or expired API key content: application/json: examples: missing_api_key: summary: No X-API-Key header value: error: message: >- PromptGuard API key required. Please provide via X-API-Key header. type: authentication_error code: missing_api_key doc_url: >- https://docs.promptguard.co/production/error-handling#missing_api_key malformed_api_key: summary: Not a pg_live_ key value: error: message: Invalid API key format type: authentication_error code: invalid_api_key doc_url: >- https://docs.promptguard.co/production/error-handling#invalid_api_key unknown_api_key: summary: No such key value: error: message: Invalid API key type: authentication_error code: invalid_api_key doc_url: >- https://docs.promptguard.co/production/error-handling#invalid_api_key disabled_api_key: summary: Key disabled value: error: message: API key is disabled type: authentication_error code: disabled_api_key doc_url: >- https://docs.promptguard.co/production/error-handling#disabled_api_key expired_api_key: summary: Key expired value: error: message: API key has expired type: authentication_error code: expired_api_key doc_url: >- https://docs.promptguard.co/production/error-handling#expired_api_key schema: $ref: '#/components/schemas/AuthErrorEnvelope' '403': description: Refused by the key's scopes or the organization's IP allowlist content: application/json: examples: scope_denied: summary: The key's scopes exclude this endpoint value: error: message: >- This API key's scopes do not permit this endpoint. Create a key with the required scope or use an unrestricted key. type: insufficient_scope code: scope_denied doc_url: >- https://docs.promptguard.co/production/error-handling#scope_denied scan_only_credential: summary: A scan-only device credential value: error: message: This credential is scan-only; endpoint not permitted. type: insufficient_scope code: scope_denied doc_url: >- https://docs.promptguard.co/production/error-handling#scope_denied read_only_key: summary: A SIEM export key value: error: message: >- This is a read-only export key. It may only GET /api/v1/alerts, /api/v1/audit-events, /api/v1/audit-events/stream, /api/v1/interactions and /api/v1/interactions/stream. type: insufficient_scope code: read_only_key doc_url: >- https://docs.promptguard.co/production/error-handling#read_only_key ip_not_allowed: summary: Caller IP outside the allowlist value: error: message: Request IP is not in the organization's allowlist type: permission_error code: ip_not_allowed doc_url: >- https://docs.promptguard.co/production/error-handling#ip_not_allowed ip_allowlist_error: summary: Allowlist could not be checked value: error: message: IP allowlist validation failed type: permission_error code: ip_allowlist_error doc_url: >- https://docs.promptguard.co/production/error-handling#ip_allowlist_error schema: $ref: '#/components/schemas/ErrorEnvelope' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' '429': description: Per-minute rate limit reached; retry after `retry_after` seconds content: application/json: examples: rate_limit_exceeded: summary: Per-minute limit reached value: error: message: >- Rate limit exceeded: your plan allows 60 requests per minute. Please retry later. type: rate_limit_exceeded code: rate_limit_exceeded retry_after: 42 doc_url: >- https://docs.promptguard.co/production/error-handling#rate_limit_exceeded schema: $ref: '#/components/schemas/RateLimitErrorEnvelope' externalDocs: description: 'Guide: SIEM export' url: https://docs.promptguard.co/integrations/siem-export#audit-events components: schemas: AuthErrorEnvelope: properties: error: $ref: '#/components/schemas/ErrorDetail' examples: - code: missing_api_key message: >- PromptGuard API key required. Please provide via X-API-Key header. type: authentication_error type: object required: - error title: AuthErrorEnvelope ErrorEnvelope: properties: error: $ref: '#/components/schemas/ErrorDetail' type: object required: - error title: ErrorEnvelope HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError example: detail: - type: missing loc: - body - messages msg: Field required input: direction: input RateLimitErrorEnvelope: properties: error: $ref: '#/components/schemas/RateLimitErrorDetail' type: object required: - error title: RateLimitErrorEnvelope ErrorDetail: properties: message: type: string title: Message description: Human-readable error description type: type: string title: Type description: Error category, e.g. 'authentication_error' code: type: string title: Code description: Machine-readable error code doc_url: anyOf: - type: string - type: 'null' title: Doc Url description: >- The error catalogue's entry for `code` (cause and fix); present when the catalogue documents the code type: object required: - message - type - code title: ErrorDetail ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError RateLimitErrorDetail: properties: message: type: string title: Message type: type: string title: Type description: '''rate_limit_exceeded''' code: type: string title: Code description: '''rate_limit_exceeded''' retry_after: type: integer title: Retry After description: Seconds until the window resets; also `Retry-After` doc_url: anyOf: - type: string - type: 'null' title: Doc Url description: >- The error catalogue's entry for `code` (cause and fix); present when the catalogue documents the code type: object required: - message - type - code - retry_after title: RateLimitErrorDetail securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-API-Key description: >- PromptGuard API key for developer endpoints. Keys start with pg_live_ and are created in the dashboard. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.