---
title: "Audit API activity"
description: "Review API-key requests and key lifecycle events for your account."
---

> Documentation Index
> Fetch the complete documentation index at: https://boxcompute.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit API activity

BoxCompute records API-key requests, key creation and revocation, and attempts to use a revoked key.
Use the activity view on the [API keys page](https://app.boxcompute.ai/api-keys), or query the public
API with a key that has `usage:read` scope.

```bash
curl --get 'https://api.boxcompute.ai/api/v2/audit-events' \
  -H 'Authorization: Bearer bc_live_REDACTED' \
  --data-urlencode 'type=api.request' \
  --data-urlencode 'outcome=error' \
  --data-urlencode 'limit=50'
```

Events are newest first. The response contains up to 200 events and an opaque `nextCursor`:

```json
{
  "events": [
{
  "id": "aud_REDACTED",
  "type": "api.request",
  "createdAt": 1791244800000,
  "requestId": "req_REDACTED",
  "actor": {
    "type": "api_key",
    "apiKey": { "id": "key_REDACTED", "name": "Production", "hint": "8f2c" },
    "ipAddress": "203.0.113.10",
    "userAgent": "my-service/1.0"
  },
  "request": {
    "method": "GET",
    "route": "/api/v2/sandboxes/:id",
    "path": "/api/v2/sandboxes/sbx_REDACTED",
    "status": 404,
    "durationMs": 12
  },
  "resourceId": "sbx_REDACTED"
}
  ],
  "nextCursor": null
}
```

For key lifecycle events, `request` and `requestId` can be `null`, and the actor can be a signed-in
`session`. API-key metadata, IP address, user agent, route and resource ID can also be absent.

## Filter and page results

| Query | Behavior |
| --- | --- |
| `apiKeyId` | One API key ID |
| `type` | `api.request`, `api_key.created`, `api_key.revoked`, or `api_key.rejected` |
| `resourceId` | One resource ID, such as a Sandbox ID |
| `method` | `GET`, `HEAD`, `POST`, `PUT`, `PATCH`, or `DELETE` |
| `outcome` | `success` for status below 400, or `error` for status 400 and above |
| `from` | Inclusive ISO 8601 timestamp |
| `to` | Exclusive ISO 8601 timestamp; must be later than `from` |
| `before` | Opaque `nextCursor` from the previous page |
| `limit` | 1–200 events; defaults to 50 |

Pass a non-null cursor unchanged to read the next page:

```bash
curl --get 'https://api.boxcompute.ai/api/v2/audit-events' \
  -H 'Authorization: Bearer bc_live_REDACTED' \
  --data-urlencode 'before=REDACTED_OPAQUE_CURSOR' \
  --data-urlencode 'limit=200'
```

The web activity view supports filtering by key, event type, outcome and Sandbox ID, and can export
up to 10,000 matching rows as CSV.

## Retention and sensitive data

Read requests (`GET` and `HEAD`) are retained for 31 days. Mutating requests and key lifecycle
events are retained for about 15 months.

Every API response includes a `Request-Id` header. Its value matches `requestId` in the corresponding
event, so record that header when investigating a request. Audit events include the normalized path,
but do not store query strings, request or response bodies, bearer credentials, or API-key secrets.
They are operational records, not a backup of request payloads or command output.

Source: https://boxcompute.ai/docs/audit-log/index.mdx