This example shows you how to retrieve Cutover audit events so you can send them to your security information and event management (SIEM) or other log management platform.
1. Specify your time range
Choose the period for which you want to retrieve audit events. For example:
From: 2026-07-01T00:00:00Z To: 2026-07-02T00:00:00Z
2. Retrieve the audit events
Make an authenticated call to the List Action Logs endpoint:
GET /core/action_logs?created_after=2026-07-01T00:00:00Z&created_before=2026-07-02T00:00:00Z
The response contains the audit events that occurred during the specified period. You can also filter the results by workspace, folder, runbook, event type, or user.
3. Retrieve all results
Audit events are paginated. Continue requesting pages until all events have been retrieved.
4. Send the events to your SIEM
Your application can then pass the retrieved events to your SIEM or other log management platform using its standard ingestion method. You can repeat this process on a schedule to keep your security monitoring platform up to date.
Note: The created_after and created_before filters require Cutover platform version 3.79.0 or later.
