Audit
List audit events with filters and pagination.
Permissions: admin, owner (Audit.view)
API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.
Filter by service name
Filter by action type
Filter by actor entity
Filter by resource type
Filter by specific resource
Only PHI access events
falseStart of date range
End of date range
Page size
50Page offset
0Successful Response
Validation Error
Rate limited
GET /v1/{workspace_id}/audit HTTP/1.1
Host: platform.api-us.concurrence.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"events": [
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"workspace_id": "123e4567-e89b-12d3-a456-426614174000",
"timestamp": "text",
"service": "text",
"actor_entity_id": "123e4567-e89b-12d3-a456-426614174000",
"actor_credential_id": "123e4567-e89b-12d3-a456-426614174000",
"action": "text",
"resource_type": "text",
"resource_id": "text",
"resource_name": "text",
"ip_address": "text",
"user_agent": "text",
"metadata": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"phi_accessed": false
}
],
"total": 1,
"limit": 1,
"offset": 1,
"has_more": true
}PHI access report — who accessed what patient data, when, from where.
Required for HIPAA breach investigation (§164.312(b)).
Permissions: admin, owner (Audit.view)
API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.
Filter by patient entity
Start of date range
End of date range
Page size
50Page offset
0Successful Response
Validation Error
Rate limited
GET /v1/{workspace_id}/audit/phi-access HTTP/1.1
Host: platform.api-us.concurrence.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"events": [
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"workspace_id": "123e4567-e89b-12d3-a456-426614174000",
"timestamp": "text",
"service": "text",
"actor_entity_id": "123e4567-e89b-12d3-a456-426614174000",
"actor_credential_id": "123e4567-e89b-12d3-a456-426614174000",
"action": "text",
"resource_type": "text",
"resource_id": "text",
"resource_name": "text",
"ip_address": "text",
"user_agent": "text",
"metadata": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"phi_accessed": false
}
],
"total": 1,
"limit": 1,
"offset": 1,
"has_more": true
}Per-entity access history — all audit events for a specific resource.
Permissions: admin, owner (Audit.view)
API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.
Start of date range
End of date range
Page size
50Page offset
0Successful Response
Entity not found
Validation Error
Rate limited
GET /v1/{workspace_id}/audit/entity/{entity_id}/access-log HTTP/1.1
Host: platform.api-us.concurrence.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"events": [
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"workspace_id": "123e4567-e89b-12d3-a456-426614174000",
"timestamp": "text",
"service": "text",
"actor_entity_id": "123e4567-e89b-12d3-a456-426614174000",
"actor_credential_id": "123e4567-e89b-12d3-a456-426614174000",
"action": "text",
"resource_type": "text",
"resource_id": "text",
"resource_name": "text",
"ip_address": "text",
"user_agent": "text",
"metadata": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"phi_accessed": false
}
],
"total": 1,
"limit": 1,
"offset": 1,
"has_more": true
}Audit summary statistics for compliance dashboard.
Permissions: admin, owner (Audit.view)
API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.
Start of date range
End of date range
Successful Response
Validation Error
Rate limited
GET /v1/{workspace_id}/audit/summary HTTP/1.1
Host: platform.api-us.concurrence.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"total_events": 1,
"phi_access_events": 1,
"unique_actors": 1,
"services_with_events": 1
}Submit an async audit-events export.
Runs the filtered query on the SQL warehouse with results staged to presigned CSV EXTERNAL_LINKS, and returns a Databricks statement_id. Poll GET /export/{statement_id} for the download links. Nothing is materialized in platform-api, so the export scales to large date windows.
Permissions: admin, owner
API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.
Filter by service name.
Filter by action type.
falseSuccessful Response
Databricks statement handle — poll GET /export/{statement_id} for links.
pending: still running. ready: links available immediately.
Validation Error
Rate limited
POST /v1/{workspace_id}/audit/export HTTP/1.1
Host: platform.api-us.concurrence.com
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 127
{
"date_from": "2026-01-01T00:00:00.000Z",
"date_to": "2026-01-01T00:00:00.000Z",
"service": "text",
"action": "text",
"phi_only": false
}{
"statement_id": "text",
"status": "pending"
}Poll a submitted audit export and return presigned CSV download links.
status is pending until the statement finishes, then ready with chunks carrying short-lived presigned URLs the client downloads directly from object storage. The links expire quickly (~15 min) — re-poll to refresh. The workspace scope was fixed into the statement at submit time; statement_id is an unguessable, short-lived capability.
Permissions: admin, owner (Audit.export — same gate as create).
API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.
Successful Response
Result file format (CSV).
0Invalid statement_id
Rate limited
GET /v1/{workspace_id}/audit/export/{statement_id} HTTP/1.1
Host: platform.api-us.concurrence.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"statement_id": "text",
"status": "pending",
"result_format": "text",
"total_row_count": 0,
"chunks": [
{
"chunk_index": 1,
"row_count": 1,
"byte_count": 1,
"external_link": "text",
"expiration": "text"
}
]
}List the authenticated caller's own audit events across every workspace.
Any authenticated caller may read their OWN trail — deliberately no Audit.view gate. actor_entity_id is server-set to the caller's entity and is NEVER accepted from the client, so the workspace_id=None query can only ever return the caller's own events (safe cross-workspace).
API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.
Filter by action type
Filter by resource type
Start of date range
End of date range
Page size
50Page offset
0Successful Response
Credential has no associated actor entity
Validation Error
Rate limited
GET /v1/audit-log/me HTTP/1.1
Host: platform.api-us.concurrence.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"events": [
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"workspace_id": "123e4567-e89b-12d3-a456-426614174000",
"timestamp": "text",
"service": "text",
"actor_entity_id": "123e4567-e89b-12d3-a456-426614174000",
"actor_credential_id": "123e4567-e89b-12d3-a456-426614174000",
"action": "text",
"resource_type": "text",
"resource_id": "text",
"resource_name": "text",
"ip_address": "text",
"user_agent": "text",
"metadata": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"phi_accessed": false
}
],
"total": 1,
"limit": 1,
"offset": 1,
"has_more": true
}Cross-workspace + null-workspace audit read — platform administrators only.
The surface for cross-workspace and null-workspace events (login / token-theft events carry no workspace). Gated strictly on the global platform:admin scope carried by an identity JWT; every other caller — including a workspace owner/admin — is rejected with 403.
API key issued via POST /v1/{workspace_id}/api-keys. Pass the returned api_key value as a Bearer token.
Filter by workspace; omit for all workspaces
Filter by service name
Filter by action type
Filter by actor entity
Filter by resource type
Filter by specific resource
Only PHI access events
falseStart of date range
End of date range
Page size
50Page offset
0Successful Response
platform:admin scope required
Validation Error
Rate limited
GET /v1/audit-log/platform HTTP/1.1
Host: platform.api-us.concurrence.com
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"events": [
{
"id": "123e4567-e89b-12d3-a456-426614174000",
"workspace_id": "123e4567-e89b-12d3-a456-426614174000",
"timestamp": "text",
"service": "text",
"actor_entity_id": "123e4567-e89b-12d3-a456-426614174000",
"actor_credential_id": "123e4567-e89b-12d3-a456-426614174000",
"action": "text",
"resource_type": "text",
"resource_id": "text",
"resource_name": "text",
"ip_address": "text",
"user_agent": "text",
"metadata": {
"ANY_ADDITIONAL_PROPERTY": "anything"
},
"phi_accessed": false
}
],
"total": 1,
"limit": 1,
"offset": 1,
"has_more": true
}Last updated
Was this helpful?