GET /api/v1/audit/ lists this Organization's IdentityEvent rows, filterable by ?event_type=, ?user= (a User UUID), and ?created_after=/?created_before= (ISO datetimes). Security-sensitive event types are marked distinctly in the Audit log page itself, not
rendered as an opaque type string.
login · signup · self_registration_rejected · invite_sent · invite_accepted · session_revoked · organization_healed · role_changed · mfa_changed · email_changed · password_changed · password_sync_failed · suspicious_activity · device_verified · device_revoked · api_key_created · api_key_revoked · agent_grant_issued · agent_grant_revoked · passkey_registered · passkey_removed · scim_user_provisioned · scim_user_deprovisioned · federated_identity_linked
These event types exist in the schema and are filterable, but nothing in this codebase currently writes one — they will never appear in a real Organization's log yet:
logout · account_recovery_initiated · account_recovery_completed