Audit logs and SIEM

Pull with the API

Audit events are numbered in order (sequence) and hash-chained (event_hash), so a poller can resume exactly where it stopped and detect gaps. /v1/logs adds sign-ins, API calls, emails and alerts with filters and cursor pages (pagination). Every API call is itself recorded in the organization’s Logs.

# Start from 0 (or your last stored sequence) and keep next_after for the next run
curl -s 'https://passkey-x.com/api/org/v1/audit-events?after=0&limit=100' \
  -H "Authorization: Bearer $PASSKEY_X_API_KEY"
# → { "data": [ … ], "next_after": 18342, "has_more": true }

# Sign-ins, API calls, emails and alerts, newest first
curl -s 'https://passkey-x.com/api/org/v1/logs?type=api&level=error&limit=100' \
  -H "Authorization: Bearer $PASSKEY_X_API_KEY"

const org = new PasskeyX({ apiKey: process.env.PASSKEY_X_ORG_KEY }); // pxk_…

// Every audit event, page by page, without handling cursors
for await (const event of org.org.auditEvents.iterate({ limit: 500 })) {
  console.log(event.sequence, event.occurred_at, event.action);
}

// Signature requests still waiting
for await (const request of org.org.signatureRequests.iterate({ status: "pending" })) {
  console.log(request.label, request.signed, "of", request.total, "signed");
}

Endpoints

Scopes

Stream to your SIEM

Send every audit event to your security tools as it happens.

1. Open Admin console › Company & billing › Integrations & API keys › Audit streaming.
2. Choose Splunk HEC, Datadog, Microsoft Sentinel, Elastic or a signed webhook, and enter the endpoint details.
3. Send a test event, then turn streaming on.
4. Alerts can also go to Slack or Microsoft Teams channels.

For your own collector, choose a signed webhook: ordered, at-least-once batches of up to 200 events with retries, dead letters and replay of the last 30 days.

Evidence and integrity

1. Open Admin console › Activity & reports › Audit log to see every admin action, share, secret reveal and sign-in event.
2. Filter by person, vault, action or date.
3. Choose Verify integrity to check the hash chain: any edited or deleted entry shows up.
4. Export CSV or JSON for your auditors, or stream events to your SIEM continuously.