Audit log Beta

The audit log records changes to your organization and who made them. These endpoints read it, so you can send the events to your own security tools.

Reading the audit log needs the scope audit:read. The person the token acts for must be an admin of your organization. A key that acts as Conclude counts as an admin.

List events

GET /v1/auditEvents · scope audit:read

Returns one page of events, newest first. Every parameter is optional. Conclude rejects an invalid value instead of ignoring it.

URL-encode every value. A + in a time offset or in position otherwise reads as a space.

curl -G https://api.conclude.io/v1/auditEvents \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  --data-urlencode "category=key" \
  --data-urlencode "from=2026-10-01T00:00:00Z"

{
  "events": [
    {
      "id": "1287",
      "type": "apiKey.issued",
      "category": "key",
      "date": "2026-10-27T14:03:12.52Z",
      "actor": {
        "kind": "user",
        "user": {
          "id": "U-3b5d7f9h",
          "name": "Kim Lee",
          "email": "kim.lee@example.com",
          "accounts": [{"platform": "slack", "platformID": "U07ABCDEF12"}]
        }
      },
      "summary": "Issued API key Helpdesk",
      "refs": {},
      "details": [
        {
          "key": "scopes",
          "label": "Scopes",
          "value": ["connections:readwrite", "org:read"],
          "text": "connections:readwrite, org:read"
        },
        {"key": "expiry", "label": "Expires", "value": "2027-10-27T00:00:00Z", "text": "2027-10-27"},
        {"key": "global", "label": "Acts as Conclude", "value": true, "text": "yes"}
      ]
    }
  ],
  "nextPosition": "MjAyNi0xMC0yN1QxNDowMzoxMi41Mlp8MTI4Nw=="
}

To read the next page, send the same request with position set to nextPosition. On the last page, nextPosition is empty.

Get an event

GET /v1/auditEvents/{auditEvent} · scope audit:read

Returns one event. {auditEvent} is the event’s id.

The event object

actor.kind says who made the change:

A user has these fields:

refs can hold these fields:

A channel has an id, a name, a platform and its Slack or Microsoft Teams ID as platformID. It also says whether it is private or deleted. It names its team, or its org when it belongs to another organization. The team is the Slack workspace or the team in Microsoft Teams, with its id, name, platform and platformID. A redacted channel only says where it is.

Categories and types

A type outside the category you also give returns no events.