{"openapi":"3.1.0","info":{"title":"Aglide API","version":"1.0.0","description":"The Aglide API gives you programmatic access to your Workspace's data. It is read-only and scoped: each API token is limited to the scopes you grant it and can only access its own Workspace.\n\n## Base URL\n\nEndpoints are versioned under `/api/v2/` and served from your Workspace's region:\n\n- Global: `https://api.aglide.com`\n- US: `https://api.us.aglide.com`\n\n## Authentication\n\nRequests are authenticated with an API token, sent as a bearer token:\n`Authorization: Bearer <API token>`. Tokens are created by Admins in the Dashboard. See [Creating API Tokens](https://docs.aglide.com/admin/api-tokens/creating-api-tokens).\n\n## Response format\n\nEvery response is JSON with a `status` field. Success returns data under `data`; errors return `status: \"error\"` with an `error` object.\n\n## Pagination\n\nList endpoints are cursor-paginated: `size` (default 100, max 500), and `after`/`before` cursors set to the `id` of an event. Responses include `hasNextPage` / `hasPreviousPage`. Page until `hasNextPage` is false."},"paths":{"/api/v2/audit-logs":{"get":{"operationId":"listAuditLogEvents","summary":"List audit log events","description":"Lists audit log events for the organisation, newest first, with cursor pagination: pass the `id` of the last event in a page as the `after` parameter to fetch the next page. Events are retained for 365 days. Requires an API key with the `audit_logs:read` scope (or an admin session).","tags":["Audit logs"],"parameters":[{"name":"size","in":"query","required":false,"description":"GET /api/v2/audit-logs Parameter","schema":{"default":100,"type":"number","minimum":1}},{"name":"after","in":"query","required":false,"description":"GET /api/v2/audit-logs Parameter","schema":{"type":"string"}},{"name":"before","in":"query","required":false,"description":"GET /api/v2/audit-logs Parameter","schema":{"type":"string"}},{"name":"createdAfter","in":"query","required":false,"description":"Only return events created at or after this ISO 8601 UTC timestamp, which must end in `Z` (e.g. `2026-06-01T00:00:00Z`).","schema":{"description":"Only return events created at or after this ISO 8601 UTC timestamp, which must end in `Z` (e.g. `2026-06-01T00:00:00Z`).","type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"}},{"name":"createdBefore","in":"query","required":false,"description":"Only return events created at or before this ISO 8601 UTC timestamp, which must end in `Z` (e.g. `2026-06-01T00:00:00Z`).","schema":{"description":"Only return events created at or before this ISO 8601 UTC timestamp, which must end in `Z` (e.g. `2026-06-01T00:00:00Z`).","type":"string","format":"date-time","pattern":"^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"}},{"name":"actorIds","in":"query","required":false,"description":"Comma-separated list of actor IDs to filter by.","schema":{"maxItems":100,"items":{"type":"string"},"description":"Comma-separated list of actor IDs to filter by.","format":"array (preprocessed)"}},{"name":"actorTypes","in":"query","required":false,"description":"Comma-separated list of actor types to filter by.","schema":{"maxItems":100,"items":{"type":"string","enum":["user","scim_token","system"]},"description":"Comma-separated list of actor types to filter by.","format":"array (preprocessed)"}},{"name":"actions","in":"query","required":false,"description":"Comma-separated list of actions to filter by.","schema":{"maxItems":100,"items":{"type":"string","enum":["user.create","user.deactivate","user.activate","user.delete","user.sign_in_password","user.sign_in_saml","user.admin_promote","user.admin_demote","user_security.password.update","user_security.password_reset.request","user_security.password_reset.approve","user_security.mfa_method.update","user_security.mfa_totp.enable","user_security.mfa_totp.disable","group.create","group.delete","group.member.add","group.member.remove","role.create","role.delete","role.linked_group.add","role.linked_group.remove","role.permission_policy.create","role.permission_policy.update","role.permission_policy.delete","device.create","device.archive","device.user.add","device.user.remove","client.register","client.approve","client.revoke","client.update","phone_number.provision","phone_number.release","vault.create","vault.delete","vault.member.add","vault.member.remove","vault_item.create","vault_item.update","vault_item.archive","vault_item.delete","application.create","application.export","application.delete","application.assignment.add","application.assignment.remove","application.recovery_mode.enable","application.recovery_mode.disable","application.saml_config.create","application.saml_config.update","application.saml_config.delete","application.email_forwarding_sensitive.update","application.email_forwarding_nonsensitive.update","application.service_accounts.update","application.scim_key.create","application.scim_key.revoke","application.sequence.create","application.sequence.update","application.sequence.delete","sequence.change_proposed","sequence.change_approved","sequence.change_rejected","sequence.change_withdrawn","application.email_filter.create","application.email_filter.update","application.email_filter.delete","account.create","account.delete","account.recovery_mode.enable","account.recovery_mode.disable","account.credentials.request","account.credentials.update","account.sso_session.pending","account.sso_session.inactive","account.sso_session.admin_released","agent_session.create","task.create","task.assign","task.update","task_schedule.create","task_schedule.update","task_schedule.archive","org_security.api_token.create","org_security.api_token.revoke","org_security.scim_key.create","org_security.scim_key.revoke","org_security.saml_config.create","org_security.saml_config.update","org_security.saml_config.delete","org_security.default_sign_in_method.update","org_security.sensitive_email_forwarding_address.update","org_security.deprovisioning_policy.update","org_security.super_admin.transfer","org_aglide_support.share_sequence_errors.enable","org_aglide_support.share_sequence_errors.disable"],"x-enumDescriptions":{"account.sso_session.pending":"A user started a login into the account. The SSO session has been created but is not yet active. `target.metadata.ssoSessionId` identifies the session.","account.sso_session.inactive":"Aglide ended an SSO session itself: `SUPERSEDED` when the same user started a newer login from the same device, or `FAILED` when the session was not established in time (`target.metadata.endReason`). Endings reported by Aglide's apps, such as a log-out or an expiry, are not recorded.","account.sso_session.admin_released":"An admin released the account's SSO session, so the account is free for another login. This does not guarantee that the session was revoked from the original user of the account.","agent_session.create":"A user started an agent session."}},"description":"Comma-separated list of actions to filter by.","format":"array (preprocessed)"}},{"name":"targetIds","in":"query","required":false,"description":"Comma-separated list of target IDs to filter by.","schema":{"maxItems":100,"items":{"type":"string"},"description":"Comma-separated list of target IDs to filter by.","format":"array (preprocessed)"}},{"name":"targetTypes","in":"query","required":false,"description":"Comma-separated list of target types to filter by.","schema":{"maxItems":100,"items":{"type":"string"},"description":"Comma-separated list of target types to filter by.","format":"array (preprocessed)"}},{"name":"success","in":"query","required":false,"description":"Filter by event outcome (`true` or `false`).","schema":{"description":"Filter by event outcome (`true` or `false`).","format":"boolean (preprocessed)"}}],"responses":{"200":{"description":"GET /api/v2/audit-logs Positive response","content":{"application/json":{"schema":{"type":"object","properties":{"status":{"type":"string","const":"success"},"data":{"$ref":"#/components/schemas/ListAuditLogEventsResponse"}},"required":["status","data"],"additionalProperties":false}}}},"400":{"description":"GET /api/v2/audit-logs Negative response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}},"components":{"schemas":{"ListAuditLogEventsResponse":{"type":"object","properties":{"hasNextPage":{"type":"boolean"},"hasPreviousPage":{"type":"boolean"},"auditLogEvents":{"type":"array","items":{"$ref":"#/components/schemas/AuditLogEvent"}}},"required":["auditLogEvents"],"additionalProperties":false,"id":"ListAuditLogEventsResponse"},"AuditLogEventActor":{"type":"object","properties":{"type":{"type":"string","enum":["user","scim_token","system"]},"id":{"type":"string"},"name":{"type":["string","null"]},"email":{"type":["string","null"]},"metadata":{"type":"object","propertyNames":{"type":"string"},"additionalProperties":{}}},"additionalProperties":false,"id":"AuditLogEventActor"},"AuditLogEventContext":{"type":"object","properties":{"tokenId":{"type":["string","null"]},"sessionId":{"type":["string","null"]},"ipAddress":{"type":["string","null"]},"userAgent":{"type":["string","null"]},"requestId":{"type":["string","null"]},"traceId":{"type":["string","null"]},"clientId":{"type":["string","null"]},"clientType":{"type":["string","null"]},"clientVersion":{"type":["string","null"]},"deviceId":{"type":["string","null"]},"slackIntegrationId":{"type":["string","null"]},"slackWorkspaceId":{"type":["string","null"]},"slackChannelId":{"type":["string","null"]},"slackActorId":{"type":["string","null"]},"samlAssertionId":{"type":["string","null"]}},"additionalProperties":false,"id":"AuditLogEventContext"},"AuditLogEventTarget":{"type":"object","properties":{"type":{"type":"string"},"id":{"type":"string"},"metadata":{"type":"object","propertyNames":{"type":"string"},"additionalProperties":{}}},"additionalProperties":false,"id":"AuditLogEventTarget"},"AuditLogEvent":{"type":"object","properties":{"version":{"type":"string"},"id":{"type":"string"},"orgId":{"type":"string"},"createdAt":{},"actor":{"$ref":"#/components/schemas/AuditLogEventActor"},"context":{"$ref":"#/components/schemas/AuditLogEventContext"},"action":{"type":"string","enum":["user.create","user.deactivate","user.activate","user.delete","user.sign_in_password","user.sign_in_saml","user.admin_promote","user.admin_demote","user_security.password.update","user_security.password_reset.request","user_security.password_reset.approve","user_security.mfa_method.update","user_security.mfa_totp.enable","user_security.mfa_totp.disable","group.create","group.delete","group.member.add","group.member.remove","role.create","role.delete","role.linked_group.add","role.linked_group.remove","role.permission_policy.create","role.permission_policy.update","role.permission_policy.delete","device.create","device.archive","device.user.add","device.user.remove","client.register","client.approve","client.revoke","client.update","phone_number.provision","phone_number.release","vault.create","vault.delete","vault.member.add","vault.member.remove","vault_item.create","vault_item.update","vault_item.archive","vault_item.delete","application.create","application.export","application.delete","application.assignment.add","application.assignment.remove","application.recovery_mode.enable","application.recovery_mode.disable","application.saml_config.create","application.saml_config.update","application.saml_config.delete","application.email_forwarding_sensitive.update","application.email_forwarding_nonsensitive.update","application.service_accounts.update","application.scim_key.create","application.scim_key.revoke","application.sequence.create","application.sequence.update","application.sequence.delete","sequence.change_proposed","sequence.change_approved","sequence.change_rejected","sequence.change_withdrawn","application.email_filter.create","application.email_filter.update","application.email_filter.delete","account.create","account.delete","account.recovery_mode.enable","account.recovery_mode.disable","account.credentials.request","account.credentials.update","account.sso_session.pending","account.sso_session.inactive","account.sso_session.admin_released","agent_session.create","task.create","task.assign","task.update","task_schedule.create","task_schedule.update","task_schedule.archive","org_security.api_token.create","org_security.api_token.revoke","org_security.scim_key.create","org_security.scim_key.revoke","org_security.saml_config.create","org_security.saml_config.update","org_security.saml_config.delete","org_security.default_sign_in_method.update","org_security.sensitive_email_forwarding_address.update","org_security.deprovisioning_policy.update","org_security.super_admin.transfer","org_aglide_support.share_sequence_errors.enable","org_aglide_support.share_sequence_errors.disable"],"x-enumDescriptions":{"account.sso_session.pending":"A user started a login into the account. The SSO session has been created but is not yet active. `target.metadata.ssoSessionId` identifies the session.","account.sso_session.inactive":"Aglide ended an SSO session itself: `SUPERSEDED` when the same user started a newer login from the same device, or `FAILED` when the session was not established in time (`target.metadata.endReason`). Endings reported by Aglide's apps, such as a log-out or an expiry, are not recorded.","account.sso_session.admin_released":"An admin released the account's SSO session, so the account is free for another login. This does not guarantee that the session was revoked from the original user of the account.","agent_session.create":"A user started an agent session."}},"actionMetadata":{"type":"object","propertyNames":{"type":"string"},"additionalProperties":{}},"success":{"type":"boolean"},"failureReason":{"type":["string","null"],"enum":["AccessDenied"]},"target":{"$ref":"#/components/schemas/AuditLogEventTarget"}},"required":["id"],"additionalProperties":false,"id":"AuditLogEvent"},"ErrorResponse":{"type":"object","properties":{"status":{"type":"string","const":"error"},"error":{"type":"object","properties":{"message":{"type":"string"},"code":{"type":"string"},"legacyTraceId":{"type":"string"},"sentryEventId":{"type":"string"}},"required":["message"],"additionalProperties":false}},"required":["status","error"],"additionalProperties":false,"id":"ErrorResponse"}},"responses":{},"parameters":{},"examples":{},"requestBodies":{},"headers":{},"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Aglide API key, sent as `Authorization: Bearer <key>`. Audit log endpoints require a key with the `audit_logs:read` scope. For how to create and manage tokens, see [Creating API Tokens](https://docs.aglide.com/admin/api-tokens/creating-api-tokens)."}},"links":{},"callbacks":{}},"tags":[{"name":"Audit logs","description":"Read your organisation's audit log events. For more information on audit log events, see the [Audit log events guide](https://docs.aglide.com/admin/audit-logs/audit-log-events)."}],"servers":[{"url":"https://api.aglide.com"}],"security":[{"bearerAuth":[]}]}