Audit API activity

BoxCompute records API-key requests, key creation and revocation, and attempts to use a revoked key. Use the activity view on the API keys page, or query the public API with a key that has usage:read scope.

curl --get 'https://api.boxcompute.ai/api/v2/audit-events' \
  -H 'Authorization: Bearer bc_live_REDACTED' \
  --data-urlencode 'type=api.request' \
  --data-urlencode 'outcome=error' \
  --data-urlencode 'limit=50'

Events are newest first. The response contains up to 200 events and an opaque nextCursor:

{
  "events": [
    {
      "id": "aud_REDACTED",
      "type": "api.request",
      "createdAt": 1791244800000,
      "requestId": "req_REDACTED",
      "actor": {
        "type": "api_key",
        "apiKey": { "id": "key_REDACTED", "name": "Production", "hint": "8f2c" },
        "ipAddress": "203.0.113.10",
        "userAgent": "my-service/1.0"
      },
      "request": {
        "method": "GET",
        "route": "/api/v2/sandboxes/:id",
        "path": "/api/v2/sandboxes/sbx_REDACTED",
        "status": 404,
        "durationMs": 12
      },
      "resourceId": "sbx_REDACTED"
    }
  ],
  "nextCursor": null
}

For key lifecycle events, request and requestId can be null, and the actor can be a signed-in session. API-key metadata, IP address, user agent, route and resource ID can also be absent.

Filter and page results

Pass a non-null cursor unchanged to read the next page:

curl --get 'https://api.boxcompute.ai/api/v2/audit-events' \
  -H 'Authorization: Bearer bc_live_REDACTED' \
  --data-urlencode 'before=REDACTED_OPAQUE_CURSOR' \
  --data-urlencode 'limit=200'

The web activity view supports filtering by key, event type, outcome and Sandbox ID, and can export up to 10,000 matching rows as CSV.

Retention and sensitive data

Read requests (GET and HEAD) are retained for 31 days. Mutating requests and key lifecycle events are retained for about 15 months.

Every API response includes a Request-Id header. Its value matches requestId in the corresponding event, so record that header when investigating a request. Audit events include the normalized path, but do not store query strings, request or response bodies, bearer credentials, or API-key secrets. They are operational records, not a backup of request payloads or command output.