> ## Documentation Index
> Fetch the complete documentation index at: https://www.1password.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# GET v3 audit events (beta)

<Badge color="gray" stroke size="lg">Beta</Badge>

<Tip>
  This API reference documents the latest version of the <a href="/static/files/events-api/events-api-beta_3.0.0_2026-06-25.yaml" download>1Password Events API beta specification (3.0.0)</a>. Learn more [about the beta API](/events-api/beta/about-v3-beta).
</Tip>

Retrieve v3 (version 3) audit events for actions performed by team members within a 1Password account.

<table>
  <thead>
    <tr>
      <th>Method</th>
      <th>Endpoint URL</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>GET</code></td>
      <td><code>\<base\_url>/api/v3/auditevents</code></td>
    </tr>
  </tbody>
</table>

You can use this endpoint to determine who performed an action and when, like when a team member edits an item's password, invites another team member to a shared vault, or updates item access permissions.

## Make a request

### Request header

To make a request to the `/api/v3/auditevents` endpoint, you'll need to use the `Authorization` header with a [bearer token](/events-api/authorization/) scoped to access audit events.

```
Authorization: Bearer YOUR_BEARER_TOKEN
```

### Query parameters

You can optionally use any of the following query parameters in your request:

* `max_page_size`: Specify the maximum number of events records to return per page, between `0` and `1000`.
* `start_time`: The earliest insertion time for which to retrieve events (exclusive), filtered on when events were ingested by 1Password. Only events whose insertion time is strictly greater than this value are returned. Invalid if `page_token` is specified.
* `end_time`: The latest insertion time for which to retrieve events (exclusive), filtered on when events were ingested by 1Password. Only events whose insertion time is strictly less than this value are returned. Invalid if `page_token` is specified.
* `page_token`: Use the token value from the `next_page_token` of the previous response (if provided) and use it with this parameter to fetch the next page of results.

See the [query parameters schema](#query-parameters-schema) for more details.

### Example requests

Example request with `max_page_size`, `start_time`, and `end_time` parameters:

```shell theme={null}
curl --request GET \
  --url https://events.1password.com/api/v3/auditevents?max_page_size=50&start_time=2026-05-29T18:00:00Z&end_time=2026-05-29T18:59:59Z \
  --header 'Authorization: Bearer YOUR_BEARER_TOKEN'
```

Example request that includes the `page_token` to return the next page of events:

```shell theme={null}
curl --request GET \
  --url "https://events.1password.com/api/v3/auditevents?page_token=aGVsbG8hIGlzIGl0IG1lIHlvdSBhcmUgbG9va2luZyBmb3IK" \
  --header "Authorization: Bearer YOUR_BEARER_TOKEN"
```

## Receive a response

A successful response will include a subset of events matching your query parameters, if any exist. If more results are available, the response will also include a `next_page_token` at the top level that you can use to request the next page of events.

If the `next_page_token` is absent, that indicates there are no more results for the requested time window. To continue polling for new events, start a new request using the `insert_time` of the last event as the value for the `start_time` [query parameter](#query-parameters).

If the response is successful but there aren't any events for the parameters you requested, the `audit_events` array will be empty (`[]`).

Learn more about [pagination](/events-api/beta/about-v3-beta#pagination) and [continuous polling](/events-api/beta/about-v3-beta#continuous-polling) in the beta API.

### HTTP status codes

Every request returns an [HTTP status code](/events-api/status-codes) that indicates if the response was successful or there was a problem.

### Response headers

The response always includes the following HTTP response headers:

* `Date`: The exact date and time the response was generated by the server.
* `Content-Type`: The resource representation format of the response body. This will always be `application/json`.

The response may also include one or more of the following rate limit response headers, as defined by [IETF standards: <Icon icon="arrow-up-right-from-square" />](https://www.ietf.org/archive/id/draft-polli-ratelimit-headers-02.html#name-header-specifications)

* `RateLimit-Limit`
* `RateLimit-Remaining`
* `RateLimit-Reset`
* `Retry-After` (only in responses with a `429 Too Many Requests` error)

[Learn more about rate limits.](/events-api/beta/about-v3-beta#rate-limits)

### Example responses

A successful `200` response returns an [`AuditEventsResponse` object](#auditeventsresponse-object) with the following high-level structure:

```json theme={null}
{
  "audit_events": [
    {
      "action": "string", /* Action taken */
      "actor": { /* Actor object */ },
      "category": "string", /* Category of event */
      "context": { /* Context object */ },
      "correlation_id": "string", /* When applicable */
      "create_time": "string", /* Date and time */
      "diff": { /* Diff object, when applicable */ },
      "insert_time": "string", /* Date and time */
      "targets": [ /* Entity objects */ ],
      "id": "string" /* ID for event */
    }
  ],
  "next_page_token": "string" /* Opaque token */
}
```

Below is an example of a successful response that shows one event — a user's vault access was updated to include additional permissions. It includes response headers and metadata with a token to fetch the next page of results.

```json Example 200 response expandable theme={null}
HTTP/2 200
date: Fri, 29 May 2026 18:54:52 GMT
content-type: application/json
ratelimit-limit: 600
ratelimit-remaining: 599
ratelimit-reset: 1767735927

{
  "audit_events": [
    {
      "action": "vault.access.update",
      "actor": {
        "email": "wendy_appleseed@agilebits.com",
        "name": "Wendy Appleseed",
        "type": "user",
        "id": "4HCGRGYCTRQFBMGVEGTABYDU2V"
      },
      "category": "vault",
      "context": {
        "account": {
          "name": "AgileBits",
          "id": "VZSYVT2LGHTBWBQGUJAIZVRABM"
        },
        "client": {
          "name": "1Password Extension",
          "version": "81224010"
        },
        "device": {
          "model": "149.0.7827.22",
          "name": "Chrome extension",
          "id": "xa2p3x45d6vbk7noqnom89rxqm"
        },
        "location": {
          "city": "Toronto",
          "ip_address": "192.0.2.254",
          "latitude": 43.6425,
          "longitude": -79.3870,
          "region_code": "CA"
        },
        "origin": "Admin Console",
        "os": {
          "name": "MacOSX",
          "version": "26.5.0"
        },
        "session": {
          "login_time": "2026-05-29T18:29:46.871840158Z",
          "id": "X6TARAEE2NGKFLMK5POQBZ4U2Q"
        },
        "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36"
      },
      "correlation_id": "BENRUNBI3JCPPLFFRZTQA6XWIZ",
      "create_time": "2026-05-29T18:36:31Z",
      "diff": {
        "new_value": {
          "acl": 15730674,
          "aclDescription": [
            "manage",
            "reveal-password",
            "read-item",
            "update-item",
            "create-item",
            "archive-item",
            "delete-item",
            "view-item-history",
            "send-item"
          ]
        },
        "old_value": {
          "acl": 15730672,
          "aclDescription": [
            "read-item"
          ]
        },
        "type": "user-vault-access-change"
      },
      "insert_time": "2026-05-29T18:36:31.883698939Z",
      "targets": [
        {
          "payload": {
            "type": "U",
            "typeDescription": "user-created",
            "id": "lc5fqgbrcm4plajd8mwncv2b3u"
          },
          "type": "vault"
        },
        {
          "payload": {
            "email": "wendyappleseed+1@1password.com",
            "name": "Wendy Appleseed",
            "id": "OYBARQG5SNEFZHGYT4NDXCHGNI"
          },
          "type": "user"
        }
      ],
      "id": "A5K6COGVRVEJXJW3XQZGS7VAMM"
    }
  ],
  "next_page_token": "eyLMNWdlU2l6ZSI6NSwiU3RhcnRUaW1lIjoiMjAyNS0xMC0wMVQwMDowMDowMFoiLCJFbmRUaW1lIjoiMjAyNi0wMS0wNlQyMTozMzo0Ny44NDA2MjA3NFoiLOPTZWFyY2hBZnRlciI6MTc2MzA2MjYxMjQRSTwiVGllQnJlYWtlciI6IkpaUjdaUVWMN1ZGVDVLVE0zRXYZRURSRlBRIn0"
}
```

Example response headers when the [rate limit](/events-api/beta/about-v3-beta#rate-limits) has been exceeded:

```json theme={null}
HTTP/1.1 429 Too Many Requests
content-type: application/json
ratelimit-limit: 600
ratelimit-remaining: 0
ratelimit-reset: 1768325512
retry-after: 60
date: Tue, 13 Jan 2026 17:30:52 GMT
```

## Request schemas

<h3 id="query-parameters-schema">
  Query parameters
</h3>

<table>
  <thead>
    <tr>
      <th>Name</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>max\_page\_size</code></td>
      <td>integer</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>Maximum number of events records to return per page, from <code>0</code> to <code>1000</code>. If the <code>max\_page\_size</code> parameter isn't included (or is set to <code>0</code>), the server default of <code>100</code> is used. The endpoint accepts any positive value, but returns no more than <code>1000</code> events per page.</td>
    </tr>

    <tr>
      <td><code>page\_token</code></td>
      <td>string</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>Opaque cursor token identifying the next page of results to retrieve. Do not use the <code>start\_time</code> or <code>end\_time</code> parameters with the <code>page\_token</code>. Doing so will result in a <code>400</code> bad request error.</td>
    </tr>

    <tr>
      <td><code>start\_time</code></td>
      <td>string <small>(date-time)</small></td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>The lower bound insertion time for which to retrieve results, filtering on when events were ingested, not when they occurred. This bound is exclusive: only events whose insertion time is strictly greater than <code>start\_time</code> are returned. Invalid if <code>page\_token</code> is specified. Uses the <a href="https://datatracker.ietf.org/doc/html/rfc3339">RFC 3339 standard. <Icon icon="arrow-up-right-from-square" /></a></td>
    </tr>

    <tr>
      <td><code>end\_time</code></td>
      <td>string <small>(date-time)</small></td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>The upper bound insertion time for which to retrieve results, filtering on when events were ingested, not when they occurred. This bound is exclusive: only events whose insertion time is strictly less than <code>end\_time</code> are returned. Invalid if <code>page\_token</code> is specified. Uses the <a href="https://datatracker.ietf.org/doc/html/rfc3339">RFC 3339 standard. <Icon icon="arrow-up-right-from-square" /></a></td>
    </tr>
  </tbody>
</table>

## Response schemas

### Rate limit headers

<table>
  <thead>
    <tr>
      <th>Header</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>RateLimit-Limit</code></td>
      <td>integer</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>The request quota for the associated client in the current time window.</td>
    </tr>

    <tr>
      <td><code>RateLimit-Remaining</code></td>
      <td>integer</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>The remaining request quota for the associated client.</td>
    </tr>

    <tr>
      <td><code>RateLimit-Reset</code></td>
      <td>integer</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>Unix timestamp that indicates the number of seconds until the request quota is reset for the associated client.</td>
    </tr>

    <tr>
      <td><code>Retry-After</code></td>
      <td>integer</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>Number of seconds until the request quota is reset for the associated client. Only included in responses with the `429 Too Many Requests` rate limit error.</td>
    </tr>
  </tbody>
</table>

### AuditEventsResponse object

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>audit\_events</code></td>
      <td>array</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Array of [<code>AuditEvent</code> objects](#auditeventsresponse-auditevent-object). Empty brackets (<code>\[]</code>) indicate no events match the request.</td>
    </tr>

    <tr>
      <td><code>next\_page\_token</code></td>
      <td>string</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>Opaque token used to retrieve the next page of results. Pass it as the <code>page\_token</code> query parameter on the next request. Only present when additional pages are available. If the <code>next\_page\_token</code> is absent, that indicates there are no more pages.</td>
    </tr>
  </tbody>
</table>

#### AuditEventsResponse: AuditEvent object

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>action</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Specific action taken. For example: <code>report.view</code>.</td>
    </tr>

    <tr>
      <td><code>actor</code></td>
      <td>object</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>An [<code>Actor</code> object](#auditeventsresponse-actor-object) describing who initiated the event.</td>
    </tr>

    <tr>
      <td><code>category</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>High-level category of the event. For example: <code>report</code>.</td>
    </tr>

    <tr>
      <td><code>context</code></td>
      <td>object</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>A [<code>Context</code> object](#auditeventsresponse-context-object) containing information about how the event was initiated.</td>
    </tr>

    <tr>
      <td><code>correlation\_id</code></td>
      <td>string</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>An optional identifier shared by audit events that originated from the same bulk action. Use it to group related events from a single bulk operation. For example, a bulk user invitation or updating multiple permissions at the same time.</td>
    </tr>

    <tr>
      <td><code>create\_time</code></td>
      <td>string <small>(date-time)</small></td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>The date and time when the event occurred. Uses the <a href="https://datatracker.ietf.org/doc/html/rfc3339">RFC 3339 standard. <Icon icon="arrow-up-right-from-square" /></a></td>
    </tr>

    <tr>
      <td><code>diff</code></td>
      <td>object</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>A [<code>Diff</code> object](#auditeventsresponse-diff-object) describing the change made by the event. Only present for events that represent a change. For example, if a user's vault access has been updated to add or remove permissions.</td>
    </tr>

    <tr>
      <td><code>insert\_time</code></td>
      <td>string <small>(date-time)</small></td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>The date and time when the event was received and stored by 1Password. The <code>start\_time</code> and <code>end\_time</code> query parameters filter on this field. Uses the <a href="https://datatracker.ietf.org/doc/html/rfc3339">RFC 3339 standard. <Icon icon="arrow-up-right-from-square" /></a></td>
    </tr>

    <tr>
      <td><code>targets</code></td>
      <td>array</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Array of [<code>Entity</code> objects](#auditeventsresponse-entity-object) that describe what was affected.</td>
    </tr>

    <tr>
      <td><code>id</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Unique identifier for the audit event.</td>
    </tr>
  </tbody>
</table>

#### AuditEventsResponse: Account object

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>id</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>ID of the account.</td>
    </tr>

    <tr>
      <td><code>name</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Name of the account.</td>
    </tr>

    <tr>
      <td><code>state</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>State of the account. For example: <code>A</code>.</td>
    </tr>

    <tr>
      <td><code>type</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Type of the account. For example: <code>B</code>.</td>
    </tr>

    <tr>
      <td><code>domain</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Domain associated with the account. For example: <code>domain.com</code>.</td>
    </tr>
  </tbody>
</table>

#### AuditEventsResponse: Actor object

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>type</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>The type of actor. For example: <code>user</code>.</td>
    </tr>

    <tr>
      <td><code>id</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>ID of the actor.</td>
    </tr>

    <tr>
      <td><code>name</code></td>
      <td>string</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>Display name of the actor, if available.</td>
    </tr>

    <tr>
      <td><code>email</code></td>
      <td>string</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>Email address of the actor, if available.</td>
    </tr>

    <tr>
      <td><code>linked\_account</code></td>
      <td>object</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>An [<code>Account</code> object](#auditeventsresponse-account-object) describing a related account, if any.</td>
    </tr>
  </tbody>
</table>

#### AuditEventsResponse: Client object

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>name</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Name of the client that was used.</td>
    </tr>

    <tr>
      <td><code>version</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Version of the client that was used.</td>
    </tr>
  </tbody>
</table>

#### AuditEventsResponse: Context object

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>account</code></td>
      <td>object</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>A [<code>ContextAccount</code> object](#auditeventsresponse-contextaccount-object) describing the account associated with the event.</td>
    </tr>

    <tr>
      <td><code>origin</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>The application or interface where the event occurred. For example: <code>password\_manager</code>.</td>
    </tr>

    <tr>
      <td><code>session</code></td>
      <td>object</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>A [<code>Session</code> object](#auditeventsresponse-session-object) describing the session in which the event occurred.</td>
    </tr>

    <tr>
      <td><code>location</code></td>
      <td>object</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>A [<code>Location</code> object](#auditeventsresponse-location-object) describing where the event originated.</td>
    </tr>

    <tr>
      <td><code>device</code></td>
      <td>object</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>A [<code>Device</code> object](#auditeventsresponse-device-object) describing the device used to initiate the event.</td>
    </tr>

    <tr>
      <td><code>client</code></td>
      <td>object</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>A [<code>Client</code> object](#auditeventsresponse-client-object) describing the 1Password client used (app or integration).</td>
    </tr>

    <tr>
      <td><code>os</code></td>
      <td>object</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>An [<code>OS</code> object](#auditeventsresponse-os-object) describing the operating system.</td>
    </tr>

    <tr>
      <td><code>user\_agent</code></td>
      <td>string</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>The user agent string reported by the client, when available.</td>
    </tr>
  </tbody>
</table>

#### AuditEventsResponse: ContextAccount object

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>id</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>ID of the account.</td>
    </tr>

    <tr>
      <td><code>name</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Name of the account.</td>
    </tr>
  </tbody>
</table>

#### AuditEventsResponse: Device object

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>id</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>ID of the device.</td>
    </tr>

    <tr>
      <td><code>model</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Model of the device.</td>
    </tr>

    <tr>
      <td><code>name</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Name of the device. For example: <code>Safari</code>.</td>
    </tr>
  </tbody>
</table>

#### AuditEventsResponse: Diff object

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>type</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>The type of change made by the event. For example: <code>account-change</code>.</td>
    </tr>

    <tr>
      <td><code>old\_value</code></td>
      <td>object</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>The previous value before the change. The shape of the object depends on the <code>type</code>.</td>
    </tr>

    <tr>
      <td><code>new\_value</code></td>
      <td>object</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>The new value after the change. The shape of the object depends on the <code>type</code>.</td>
    </tr>
  </tbody>
</table>

#### AuditEventsResponse: Entity object

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>type</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Type of entity affected by a given event. An entity may contain a number of additional properties specific to its type. For example: <code>report</code>, <code>user</code>, or other resource types.</td>
    </tr>

    <tr>
      <td><code>payload</code></td>
      <td>object</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Additional properties describing the entity.</td>
    </tr>
  </tbody>
</table>

#### AuditEventsResponse: Location object

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>ip\_address</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>IP address from which the event originated.</td>
    </tr>

    <tr>
      <td><code>region\_code</code></td>
      <td>string</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>The <a href="https://cldr.unicode.org/">Unicode CLDR region code <Icon icon="arrow-up-right-from-square" /></a> associated with the IP address. For example, <code>CA</code> for Canada or <code>DE</code> for Germany.</td>
    </tr>

    <tr>
      <td><code>city</code></td>
      <td>string</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>City associated with the IP address.</td>
    </tr>

    <tr>
      <td><code>latitude</code></td>
      <td>number</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>Latitude of the location.</td>
    </tr>

    <tr>
      <td><code>longitude</code></td>
      <td>number</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>Longitude of the location.</td>
    </tr>
  </tbody>
</table>

#### AuditEventsResponse: OS object

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>name</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Name of the operating system that was used.</td>
    </tr>

    <tr>
      <td><code>version</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Version of the operating system that was used.</td>
    </tr>

    <tr>
      <td><code>user\_agent</code></td>
      <td>string</td>
      <td><span class="badge badge--secondary">No</span></td>
      <td>Information about the operating system, such as software identification and environment details. </td>
    </tr>
  </tbody>
</table>

#### AuditEventsResponse: Session object

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>id</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>ID of the session.</td>
    </tr>

    <tr>
      <td><code>login\_time</code></td>
      <td>string <small>(date-time)</small></td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>Time when the session was created.</td>
    </tr>
  </tbody>
</table>

### Error object

Error responses use the standard error shape defined by [AEP-193. <Icon icon="arrow-up-right-from-square" />](https://aep.dev/193/) The `type` field is a machine-readable error type identifier. The `message` field is a human-readable description of the error.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Required</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td><code>type</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>A machine-readable error type identifier. For example: <code>unauthenticated</code>.</td>
    </tr>

    <tr>
      <td><code>message</code></td>
      <td>string</td>
      <td><span class="badge badge--primary">Yes</span></td>
      <td>A human-readable description of the error.</td>
    </tr>
  </tbody>
</table>