Forgecroft Docs
Guides / Access Control

Audit Events

Query the access event audit trail to track who did what and when.

What Are Access Events?

Every access grant operation (create, revoke) is recorded as an access event. This provides an audit trail of permission changes.

Querying Events

GET /access-events?subject_id=user-uuid&from=2026-01-01T00:00:00Z&to=2026-01-31T23:59:59Z
ParamTypeDescription
subject_idUUIDFilter by subject user
resource_typestringFilter by resource type
resource_idUUIDFilter by resource ID
fromRFC3339Start of time range
toRFC3339End of time range

Invalid from/to values are silently ignored (no error).

Event Shape

{
  "id": "uuid",
  "occurred_at": "2026-01-15T10:00:00Z",
  "org_id": "uuid",
  "subject_type": "user",
  "subject_id": "user-uuid",
  "verb": "write",
  "resource_type": "workspace",
  "resource_id": "workspace-uuid",
  "decision": "granted",
  "grant_id": "grant-uuid"
}

Access

Only org admin/owner can view audit events.