FruxonDocs
UsersAPI Access

List a service account's lifecycle audit events.

Returns the provisioned / rotated / revoked / used-while-revoked events for the service account, newest-first. This is the compliance-grade lifecycle trail of the principal; per-request activity for its keys lives under the API-key activity surface.

GET
/v1/tenants/{tenant}/serviceAccounts/{serviceAccount}/auditEvents

Authorization

Bearer
AuthorizationBearer <token>

JWT Authorization header using the Bearer scheme. Enter 'Bearer' [space] and then your token.

In: header

Path Parameters

serviceAccount*string

The unique identifier of the service account.

tenant*string

The tenant identifier

Query Parameters

PageSize?integer

The maximum number of items to return per page

Formatint32
PageToken.Skip?integer
Formatint32
PageToken.Cursor?string

Opaque cursor token from an external system (e.g. RAG API). When set, M:Fruxon.Common.Collections.PageToken.AsString returns this value directly instead of encoding Fruxon.Common.Collections.PageToken.Skip.

Response Body

curl -X GET "https://api.fruxon.com/v1/tenants/string/serviceAccounts/string/auditEvents"
{
  "items": [
    {
      "id": "00000000-0000-0000-0000-000000000000",
      "serviceAccountId": "00000000-0000-0000-0000-000000000000",
      "serviceAccountName": "string",
      "eventType": "PROVISIONED",
      "createdAt": 0,
      "actorId": "string",
      "actor": "string",
      "details": "string",
      "tenantId": "00000000-0000-0000-0000-000000000000"
    }
  ],
  "nextPageToken": "string",
  "totalCount": 0
}
Empty
{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "property1": null,
  "property2": null
}
{
  "type": "string",
  "title": "string",
  "status": 0,
  "detail": "string",
  "instance": "string",
  "property1": null,
  "property2": null
}

List a service account's request activity.

Returns the per-request usage stream — which endpoints the account called, when, and with what status — aggregated across every key the account owns, newest-first. Distinct from `/auditEvents`, which is the principal's security lifecycle (provision / rotate / revoke). This is high-volume, hence cursor pagination. Mirrors `/tokens/{id}/activity`, the per-key view a personal access token uses; a service account is a principal that can own several keys, so its activity is the union across them.

Revoke a service account.

Marks the service account inactive and cascade-revokes every key it owns. The principal being dead is the source of truth — subsequent use of any of its keys returns 401, even if a key row was missed by the sweep.