Query Audit Events

Read the AI activity stream and per-subject timelines, and build your own consumers on top.

Every action in the control plane emits an immutable event. This guide reads them and shows how to build on the stream.

Read the live feed#

curl "https://your-company.authspoke.com/api/v1/ai/activity" -H "Authorization: Bearer $TOKEN"

[
  {
    "eventId": "…",
    "eventType": "AGENT_REGISTERED",
    "actor": "[email protected]",
    "subjectType": "AGENT",
    "subjectName": "invoice-reconciler",
    "summary": "Registered AI agent (risk 82, trust 64)",
    "severity": "WARNING",
    "createdAt": "2026-06-29T04:16:00Z"
  }
]

Read one subject's timeline#

curl "https://your-company.authspoke.com/api/v1/ai/activity/$AGENT_ID" -H "Authorization: Bearer $TOKEN"

Build a consumer#

The feed is the same stream the product's live activity view uses. Common patterns:

Poll /ai/activity on an interval for a dashboard (the console polls every few seconds).
Filter client-side by eventType or severity for alerting (e.g. surface every CRITICAL).
Archive to your SIEM or warehouse for compliance evidence.

Because events are append-only and tenant-scoped, they're safe to treat as a durable audit log. See AI Audit & Events and Event Architecture.