Audit Log API & Streaming

The audit log records which actor changed which resource, and how - see Audit logs. Besides reading it in the dashboard, you can hand it to your own systems in two ways:

	Audit log API	Streaming
Direction	Your system pulls	TrustComponent pushes every new event
Typical use	Archiving, periodic imports, own reports	SIEM and log platforms, real-time alerting
Plan	Governance add-on	Governance Enterprise add-on

Both deliver an event in the same JSON format, so one parser handles both.

Audit log API

Create an API key. In your Project, open Settings → API Keys and choose Create API Key. For an Organization, open Governance → Audit Logs; the organization keys are listed there.

Call the API with the key as bearer token:

curl -H "Authorization: Bearer ak_..." \
  "https://api.trustcomponent.com/platform/v1/events?from=2026-09-01T00:00:00.000Z&to=2026-09-02T00:00:00.000Z&pageSize=100"

Read the next page by passing the nextCursor of the response as cursor, with the same from and to, until nextCursor is null.

A Project key returns the events of the Project and of all its modules. An Organization key returns the events of the Organization itself, not the ones of its client projects.

Parameter	Default	Meaning
`from`	24 hours before `to`	Start of the time range, ISO 8601 in UTC
`to`	now	End of the time range, ISO 8601 in UTC
`cursor`	–	Position to continue after, taken from `nextCursor` of the previous response
`pageSize`	`100`	Entries per page, at most `1000`
`page`	`0`	Zero-based page index, ignored when `cursor` is set

Events are sorted newest first. Read a range with the cursor: unlike page, it does not shift when new events arrive while you read. Events older than the audit retention of your plan are not returned.

{
  "from": "2026-09-01T00:00:00.000Z",
  "to": "2026-09-02T00:00:00.000Z",
  "content": [
    {
      "id": "cc2e2d5e-d1ef-4a7f-a7bd-dec5b37df47a",
      "schemaVersion": 2,
      "occurredAt": "2026-09-01T13:30:05.941Z",
      "type": "captcha.captcha.updated",
      "action": "updated",
      "subject": { "kind": "captcha.captcha", "id": "0f8e...", "label": "Checkout form" },
      "scopes": [{ "kind": "platform.subscription", "id": "5664...", "label": "Initech" }],
      "origin": { "namespace": "CAPTCHA", "source": "REST_CONTROLLER", "applicationName": "tc-captcha-captchaservice", "traceId": "a1b2...", "transactionId": "e5f6..." },
      "actor": { "type": "USER", "userId": "b1c2...", "apiKeyId": null, "automation": null },
      "changes": [{ "field": "label", "operation": "SET", "before": "Checkout", "after": "Checkout form", "isRedacted": false }],
      "details": {}
    }
  ],
  "page": 0,
  "pageSize": 100,
  "totalElements": 1,
  "nextCursor": null
}

Field	Meaning
`id`	Unique id of the event. An event is never delivered with two different ids, so use it to skip duplicates.
`schemaVersion`	`2` for events since API keys, automations and anonymous callers are told apart; `1` for older events, which only know `USER` and `SYSTEM`.
`type`	Kind of the subject followed by the action, for example `platform.user.authentication-failed`.
`subject` / `scopes`	The resource the action happened to, and the resources it belongs to. `label` is the name at the time of the event.
`origin`	Where in TrustComponent the event was recorded. Quote the `traceId` when you ask support about an event.
`actor`	Who caused the event, see below.
`changes`	The fields the action changed. Secret values are never recorded; such a change has `isRedacted: true`.
`details`	Facts about the action that are not a change of the subject: the sign-in method and masked IP address of a sign-in, the format and time range of an export.

Actor `type`	Meaning
`USER`	A signed-in person, identified by `userId`.
`API_KEY`	A request authenticated with an API key, identified by `apiKeyId`.
`AUTOMATION`	A process of TrustComponent that runs by itself: a scheduled job, a task at service start, or a reaction to another event. `automation.kind` is `SCHEDULER`, `RUNNER` or `LISTENER`, `automation.name` names the job.
`ANONYMOUS`	A caller that is not signed in, for example a failed sign-in or a password reset through the link in an e-mail.
`SYSTEM`	TrustComponent itself, when no more specific actor applies.

Status	Meaning
`401`	No API key sent
`402`	The plan does not include the audit log API, or the Project is locked
`403`	Unknown or expired API key
`422`	`from` or `to` is not an ISO 8601 timestamp, `from` lies after `to`, or `cursor` was not returned by this API

Streaming

Streaming sends every new audit log event as one JSON document - exactly the event format of the API above - by HTTPS POST to a destination of your choice. Deliveries that fail are retried several times.

Open Governance → Audit Logs and choose New Destination in the Streaming section.
Pick the type and fill in the fields below.
Open the menu of the destination and choose Send test event. You see right away whether your platform accepted it.

Create an HTTP Event Collector token in Splunk and enter the address of the collector (for example https://splunk.example.com:8088) and the token. TrustComponent sends to /services/collector/raw?sourcetype=_json with the header Authorization: Splunk <token>. If your collector requires indexer acknowledgement, edit the destination afterwards and add the header X-Splunk-Request-Channel.

Choose your Datadog site and enter an API key. TrustComponent sends to the logs intake of your site with ddsource=trustcomponent and service=trustcomponent-audit-log, so you can filter for it right away.

Enter the Elasticsearch endpoint of your deployment, the index and a base64-encoded API key with write access to it. TrustComponent sends to /<index>/_doc. A regular index works as is; a data stream needs an ingest pipeline that sets @timestamp from occurredAt.

Any HTTPS endpoint that accepts a JSON POST. Add the headers your endpoint needs, for example an Authorization header.

A delivery that is retried keeps its body, so use the id of the event to skip one you already stored. Every request carries the headers TC-Webhook-Id, TC-Webhook-Event (platform.audit-event.created, or platform.export-destination.test for a test event) and TC-Webhook-Timestamp. TC-Webhook-Signature has the form t=<timestamp>,v1=<signature>, where the signature is the hex-encoded HMAC-SHA256 of <timestamp>.<body> with the signing secret shown when you edit the destination. Check it if your endpoint is reachable from the internet.

If your plan no longer includes streaming, existing destinations are suspended: they receive nothing, and you can only pause or delete them. After an upgrade, active destinations continue on their own.

Projects Audit logs, API keys and the Governance add-ons of a Project.

Organizations The organization-level audit log.