List organization events

get

https://api.socket.dev/v0/orgs/{org_slug}/events

List events for an organization.

Events are records of actions taken across Socket products, such as firewall decisions and CLI/SDK actions.

The maximum date range per request is 365 days. When more results are available, the response body's "endCursor" property contains the cursor to pass as the "startAfterCursor" query parameter to retrieve the next page.

This endpoint consumes 10 units of your quota.

This endpoint requires the following org token scopes:

telemetry-events:list

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Path Params

org_slug

string

required

The slug of the organization

Query Params

per_page

integer

1 to 5000

Defaults to 1000

Specify the maximum number of results to return per page (intermediate pages may have fewer than this limit and callers should always check "endCursor" in response body to know if there are more pages)

date

string

The ISO 8601 date in YYYY-MM-DD format (e.g. "2025-01-01"). If not specified, defaults to the current date.

range

string

The date range in format like "7d" or "-7d" where "d" is days. A positive value means the range extends forward from the date, and a negative value means the range extends backward. Defaults to "-7d" (past week). Maximum range is 365 days. NOTE: "latest" is not supported for events.

startAfterCursor

string

The pagination cursor that was returned as the "endCursor" property in previous request

sort

string

Defaults to eventCreatedAt

Sort type (eventCreatedAt, eventSource, eventCategory, eventType, eventLevel, clientProductName, clientAction)

string

Search keywords to filter events

filters.alertAction

string

Comma-separated list of alert actions (one of "error", "warn", "monitor", "ignore"). Filters on the policy-decided alert_action column.

filters.alertAction.notIn

string

Comma-separated list of alert actions (one of "error", "warn", "monitor", "ignore"). Filters on the policy-decided alert_action column.

filters.artifactName

string

Name of artifact

filters.artifactName.notIn

string

Name of artifact

filters.artifactNamespace

string

Filter by artifact namespace

filters.artifactNamespace.notIn

string

Filter by artifact namespace

filters.artifactPurl

string

Filter by artifact purl (matches on purl without version)

filters.artifactPurl.notIn

string

Filter by artifact purl (matches on purl without version)

filters.artifactType

string

Comma-separated list of artifact types (e.g. "npm", "pypi", "gem", "maven", "golang", etc.) that should be included

filters.artifactType.notIn

string

Comma-separated list of artifact types (e.g. "npm", "pypi", "gem", "maven", "golang", etc.) that should be excluded

filters.artifactVersion

string

Filter by artifact version

filters.artifactVersion.notIn

string

Filter by artifact version

filters.clientAction

string

Comma-separated list of client actions (e.g., "install", "scan", "block")

filters.clientAction.notIn

string

Comma-separated list of client actions (e.g., "install", "scan", "block")

filters.clientMachineId

string

Comma-separated list of client machine IDs for exact matching

filters.clientMachineId.notIn

string

Comma-separated list of client machine IDs for exact matching

filters.clientProductName

string

Comma-separated list of client product names (e.g., "socket-cli", "socket-firewall")

filters.clientProductName.notIn

string

Comma-separated list of client product names (e.g., "socket-cli", "socket-firewall")

filters.clientUserAgent

string

Comma-separated list of HTTP request user-agent header values for exact matching

filters.clientUserAgent.notIn

string

Comma-separated list of HTTP request user-agent header values for exact matching

filters.eventCategory

string

Comma-separated list of event categories (e.g., "audit", "analytics", "debug")

filters.eventCategory.notIn

string

Comma-separated list of event categories (e.g., "audit", "analytics", "debug")

filters.eventCreatedAt.eq

string