Org-wide live audit stream (SSE)

GET

/audit/stream

const url = 'https://your-org.evershell.ai/v1/audit/stream';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://your-org.evershell.ai/v1/audit/stream \
  --header 'Authorization: Bearer <token>'

The live counterpart of GET /v1/audit: server-sent events for every audit + activity row as it’s committed, with the same per-scope visibility and the same filters — so the stream and the query show the same rows.

Permissions: any of audit:read, audit:read:own, workspace:read, workspace:read:own — the delivered rows are the union of what each held scope grants, identical to GET /v1/audit.

Accepts the same filter matchers as GET /v1/audit (e.g. ?filter=event_type=policy_decision), applied per event before delivery. The CP holds the connection open up to sseMaxStreamDuration (5 minutes today) then closes it cleanly so browsers’ EventSource can auto-reconnect; non-EventSource clients should reconnect on close. Heartbeats are SSE comment lines (: heartbeat\n\n) roughly every 15 seconds.

SSE consumers that can’t set headers may present the API key in the query string: ?api_key=sk_live_....

Authorizations

bearerAuth

Parameters

Query Parameters

filter

Array<string>

Same matcher syntax as GET /v1/audit; repeat for AND.

api_key

string

API key fallback for SSE clients that can’t set Authorization headers.

Responses

200

Event stream

text/event-stream

Each event has shape event: audit\nid: <event id>\ndata: <JSON AuditEvent>\n\n. See the AuditEvent schema for the payload shape.

string