Export audit logs

curl --request GET \
  --url https://api.select.dev/v2/audit-logs \
  --header 'Authorization: Bearer <token>' \
  --header 'x-tenant-id: <x-tenant-id>'

import requests

url = "https://api.select.dev/v2/audit-logs"

headers = {
    "x-tenant-id": "<x-tenant-id>",
    "Authorization": "Bearer <token>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {'x-tenant-id': '<x-tenant-id>', Authorization: 'Bearer <token>'}
};

fetch('https://api.select.dev/v2/audit-logs', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.select.dev/v2/audit-logs",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "x-tenant-id: <x-tenant-id>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.select.dev/v2/audit-logs"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-tenant-id", "<x-tenant-id>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.select.dev/v2/audit-logs")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-tenant-id"] = '<x-tenant-id>'
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "items": [
    {
      "id": "<string>",
      "record_id": "<string>",
      "operation": "insert",
      "status": "success",
      "changed_by": "<string>",
      "changed_at": "<string>",
      "updates": [
        {
          "field": "<string>",
          "old_value": "<unknown>",
          "new_value": "<unknown>"
        }
      ],
      "resource": "<string>",
      "event_type": "<string>"
    }
  ],
  "page_token": "<string>",
  "row_count": 123
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

Endpoints

Export audit logs

Append-only, oldest-first stream of audit log records, designed for continuous polling (e.g. SIEM export). Records are immutable once written.

The audit log records every create, update, and delete on your SELECT resources, plus events like login and org membership changes — who changed what, and when. Each record is tied to either a resource (something in SELECT that changed) or an event_type (something that happened with no resource).

Name	Kind	What it is
`actions`	resource	Cost-saving actions
`api_keys`	resource	API keys
`budgets`	resource	Budgets
`connections`	resource	Data warehouse connections
`dashboards`	resource	Dashboards
`dashboard_digests`	resource	Scheduled dashboard digests
`insights`	resource	Insights
`monitors_v2`	resource	Monitors
`saved_views`	resource	Saved views
`snowflake_warehouses`	resource	Snowflake warehouse settings
`teams`	resource	Teams
`ticket_integrations`	resource	Ticketing tool integrations (Jira, etc.)
`ticket_links`	resource	Links between SELECT items and external tickets
`user_roles`	resource	User and role assignments
`usage_group_sets`	resource	Usage group sets
`session`	event	Login / logout
`invitation`	event	Org invitation created / revoked
`users`	event	User removed from the org
`organization`	event	Organization-level settings: trial end date, app warehouse size, feature enablement, data share provisioning

How to poll

Page with page_token, and drain every poll until page_token is null:

First run — call with no page_token. Optionally set changed_at__gte to a start date to skip old history.
Drain — keep re-requesting with the page_token from the previous response until the response returns page_token: null (you are caught up).
Persist the last non-null page_token you received.
Next poll — resume from that stored page_token. It continues strictly after the last record you ingested, so every new record is delivered exactly once.

Do not build your own cursor from changed_at. Bulk operations can stamp thousands of records with the exact same changed_at. A client that computes its next request from max(changed_at) will re-receive duplicates and, if a single-timestamp cluster is larger than max_results, loop forever and never advance past it. Always page with page_token.

sort_order defaults to asc (oldest-first) to preserve the SIEM drain-forward contract above; pass desc for newest-first. A page_token carries the sort_order it was minted with, so resuming with the other order is rejected rather than silently resuming in the wrong direction.

GET

audit-logs

Export audit logs

curl --request GET \
  --url https://api.select.dev/v2/audit-logs \
  --header 'Authorization: Bearer <token>' \
  --header 'x-tenant-id: <x-tenant-id>'

import requests

url = "https://api.select.dev/v2/audit-logs"

headers = {
    "x-tenant-id": "<x-tenant-id>",
    "Authorization": "Bearer <token>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {'x-tenant-id': '<x-tenant-id>', Authorization: 'Bearer <token>'}
};

fetch('https://api.select.dev/v2/audit-logs', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.select.dev/v2/audit-logs",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "x-tenant-id: <x-tenant-id>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.select.dev/v2/audit-logs"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-tenant-id", "<x-tenant-id>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.select.dev/v2/audit-logs")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-tenant-id"] = '<x-tenant-id>'
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "items": [
    {
      "id": "<string>",
      "record_id": "<string>",
      "operation": "insert",
      "status": "success",
      "changed_by": "<string>",
      "changed_at": "<string>",
      "updates": [
        {
          "field": "<string>",
          "old_value": "<unknown>",
          "new_value": "<unknown>"
        }
      ],
      "resource": "<string>",
      "event_type": "<string>"
    }
  ],
  "page_token": "<string>",
  "row_count": 123
}

{
  "detail": [
    {
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "type": "<string>"
    }
  ]
}

Authorizations

Authorization

string

header

required

Organization API key (sl_…).

Headers

x-tenant-id

string

required

The organization ID the request is scoped to.

Query Parameters

max_results

integer

default:50

Maximum number of records to return (1–500).

sort_order

enum<string>

default:asc

asc (default, oldest-first) or desc (newest-first).

Available options:

asc,

desc

page_token

string | null

Opaque cursor from a previous response. Omit on the first call.

changed_at__gte

string<date-time> | null

changed_at__lte

string<date-time> | null

changed_at__in_range

string | null

table_name__in

string | null

event_type__in

string | null

changed_by__ilike

string | null

changed_by__not_ilike

string | null

changed_by__isnull

boolean | null

resource__in

string | null

resource__not_in

string | null

operation__in

string | null

operation__not_in

string | null

status__in

string | null

status__not_in

string | null

id__in

string | null

Response

Successful Response

items

ExportAuditLog · object[]

required

Show child attributes

page_token

string | null

Opaque cursor for the next page; empty/absent on the last page.

row_count

integer | null

Best-effort total for the filtered result set; may be null when expensive.

⌘I