Page through a token's lifecycle audit events.
Returns mint / rotate / revoke / used-while-revoked events newest-first, plus a `nextPageToken` the caller replays to fetch older events — the same cursor-pagination contract as `/activity`. This is the lifecycle history; per-request usage lives under `/activity`.
Authorization
Bearer JWT Authorization header using the Bearer scheme. Enter 'Bearer' [space] and then your token.
In: header
Path Parameters
The token identifier.
The tenant identifier
Query Parameters
The maximum number of items to return per page
int32int32Opaque pagination token returned by an external service. Pass it back unchanged rather than interpreting it as an offset.
Response Body
curl -X GET "https://api.fruxon.com/v1/tenants/string/tokens/string/auditEvents"{
"items": [
{
"id": "00000000-0000-0000-0000-000000000000",
"tokenId": "00000000-0000-0000-0000-000000000000",
"keyPrefix": "string",
"eventType": "MINTED",
"createdAt": 0,
"userId": "string",
"actor": "string",
"details": "string",
"tenantId": "00000000-0000-0000-0000-000000000000"
}
],
"nextPageToken": "string",
"totalCount": 0
}{
"type": "string",
"title": "string",
"status": 0,
"detail": "string",
"instance": "string",
"property1": null,
"property2": null
}Page through request activity for an API key.
Returns a page of request events newest-first — one per authenticated HTTP call made with the key — plus a `nextPageToken` the caller replays to fetch older events. Each event carries the method, route, status code and latency, so the dashboard can answer "what endpoints is this key calling, how often, and are the calls succeeding?". Distinct from `/auditEvents`, which is the key's security lifecycle (mint / rotate / revoke). This is the usage stream and is high-volume, hence cursor pagination rather than a flat list.
Get the calling API key's own metadata — name, prefix, scopes, expiry, last-used — and what it may do on this request.
Self-introspection. Returns 404 when the caller authenticated via federation/JWT (no API key in scope) and 401 when there's no authentication at all. Never returns the secret or its hash — only the displayable prefix. No `[RequireScope]`: a key must be able to read its own metadata regardless of what scopes it carries, otherwise narrow keys couldn't see what they can do. `scopes` is what the key was minted with. A personal access token acts as its owner and is cut down on every request to what the owner's current workspace role (`ownerRole`) carries, so `effectiveScopes` is what this request was authorised with: a scope in `scopes` but not in `effectiveScopes` is one the owner's role refuses. For a service-account key, `effectiveScopes` is the account's grant and `ownerRole` is absent.