NetBird Full API Reference + Read-Only MCP Prototype
GET/api/events/audit

List audit events

Lists audit events recorded for the account. Event entries include the activity, initiator, target, timestamp, and metadata. Use the activity code to distinguish the types of recorded events.

5 status codes
200Returns an array of audit event objects containing each event's identifier, timestamp, activity and activity code, initiator details, target identifier, and metadata.
activitystringrequired
The activity that occurred during the event
activity_codestringrequired
The string code of the activity that occurred during the event
Allowed:peer.user.addpeer.setupkey.adduser.joinuser.inviteaccount.createaccount.deleteuser.peer.deleterule.addrule.updaterule.deletepolicy.addpolicy.update
idstringrequired
Event unique identifier
initiator_emailstringrequired
The e-mail address of the initiator of the event. E.g., an e-mail of a user that triggered the event.
initiator_idstringrequired
The ID of the initiator of the event. E.g., an ID of a user that triggered the event.
initiator_namestringrequired
The name of the initiator of the event.
metaobjectrequired
The metadata of the event
target_idstringrequired
The ID of the target of the event. E.g., an ID of the peer that a user removed.
timestampstringrequired
The date and time when the event occurred
400Returned when the request is invalid.
401Returned when authentication is required but missing or invalid.
403Returned when access to audit events is forbidden.
500Returned when an internal server error occurs.

Error handling

A 400 is returned for an invalid request, a 401 when authentication is required but missing or invalid, and a 403 when the authenticated user cannot access audit events. A 500 indicates an internal server error.