Audit events

Sente writes an audit event whenever something sensitive happens to an account: a credential is read or overwritten, a browser session is opened or exported, a connection is created or revoked, a run is taken over. Read the trail to answer “who got access to this account, and when” — for a security review, an incident, or your own monitoring. The trail is insert-only. There is no API to edit or delete an event, and events outlive the resources they describe: after an identity is deleted, its identity.delete event still names the address. Events are org-scoped and never carry secret values — no passwords, no TOTP seeds, no session state, no cookies. meta holds descriptive fields only.

The audit event object

{
  "id": "aud_4c3b2a1908f7e6d5c4b3a2918f7e6d5c",
  "action": "credentials.read",
  "subjectType": "registration",
  "subjectId": "reg_1c2d3e4f5a6b708192a3b4c5d6e7f801",
  "meta": null,
  "createdAt": "2026-07-20T11:42:07.884Z"
}

Field	Description
`action`	What happened — see the table below.
`subjectType`	`registration`, `identity`, or `run`.
`subjectId`	The subject’s id. Note it may point at a row that has since been deleted.
`meta`	Action-specific JSON, or `null`. Never secret values.

There is no actor field. Events record what happened to which resource, not which API key or dashboard user did it. If you need per-actor attribution, use a separate API key per caller and correlate by time.

Actions

Every action the API emits today:

Action	Subject	`meta`	What it means
`registration.create`	registration	`{ credentialOrigin, appOrigin }`	A Sente-created account row was opened for an app. `credentialOrigin` is `generated` or `supplied` — whether Sente made the password or you did.
`connection.create`	registration	`{ appOrigin, hasTotp }`	You connected an account you already own. `hasTotp` says whether a TOTP seed was vaulted with it. Also fires on a re-connect, which rotates the credentials.
`connection.revoke`	registration	—	The delegation was withdrawn; the vault was kept.
`connection.delete`	registration	—	The connection was revoked and its vaulted password and TOTP seed purged.
`credentials.read`	registration	—	The vaulted username and password were returned in plaintext via `GET /v1/registrations/:id/credentials`. Sente-created accounts only — connected accounts are write-only and 403 instead.
`credentials.write`	registration	—	The vault was overwritten via `PUT /v1/registrations/:id/credentials`.
`session.open`	identity	`{ registrationId }`	A logged-in browser session was handed out via `POST /v1/registrations/:id/session`.
`session.close`	identity	—	The live session was released via `DELETE /v1/registrations/:id/session`.
`session.export`	registration	—	A Playwright `storageState` was exported.
`run.intervene`	run	—	A human paused a live run to take over the browser.
`run.resume`	run	—	A blocked run was handed back to the agent.
`run.abort`	run	—	A run was aborted.
`identity.delete`	identity	`{ email }`	An identity and everything under it was hard-deleted. The event keeps the address, which now exists nowhere else.

session.export and credentials.read are the two high-signal events: both hand out something that grants standing access to a real account, and neither can be revoked after the fact. Alert on them.

Run outcomes (completed, failed, blocked) are not audit events — they live on the run itself and on the run.* webhooks. The audit trail records deliberate acts on credentials, sessions, accounts, and takeover, not the automation’s own progress.

List audit events

GET /v1/audit-events

Query param	Type	Required	Description
`action`	string	no	Exact match on one action, e.g. `credentials.read`. No prefix or wildcard matching.
`since`	ISO date	no	Only events at or after this timestamp.
`limit`	int 1–200	no	Default 50. Newest first.

curl "https://api.sente.run/v1/audit-events?action=session.export&limit=100" \
  -H "Authorization: Bearer sk_sente_..."

Response 200: an array of audit event objects, newest first.

[
  {
    "id": "aud_4c3b2a1908f7e6d5c4b3a2918f7e6d5c",
    "action": "session.export",
    "subjectType": "registration",
    "subjectId": "reg_1c2d3e4f5a6b708192a3b4c5d6e7f801",
    "meta": null,
    "createdAt": "2026-07-20T11:42:07.884Z"
  },
  {
    "id": "aud_9182a3b4c5d6e7f80192a3b4c5d6e7f8",
    "action": "connection.create",
    "subjectType": "registration",
    "subjectId": "reg_1c2d3e4f5a6b708192a3b4c5d6e7f801",
    "meta": { "appOrigin": "https://app.example.com", "hasTotp": true },
    "createdAt": "2026-07-20T11:05:19.302Z"
  }
]

Status	Body	What to do
`400`	zod issues	`limit` outside 1–200, or `since` isn’t a parseable date.
`200` `[]`	—	An unknown `action` is not an error; it just matches nothing. Check the spelling against the table above before concluding nothing happened.

Paging a long trail

There is no cursor, no offset, and no until — the only window control is since, and results always come back newest-first. That makes two patterns possible and one impossible:

Tail-following works. Keep the newest createdAt you have seen and pass it as since on the next call to get everything after it. This is the right shape for a monitor that mirrors the trail into your own store.
Narrowing works. Filter by action and raise limit to 200 to pull a specific slice.
Walking backwards into deep history does not. An earlier since returns the newest 200 again, not an older page. If you need the full history, mirror it forwards from the start rather than trying to paginate into the past.

Events are insert-only, so anything you already mirrored never changes.

This is HTTP-only. Neither SDK nor the CLI wraps the audit trail; the dashboard renders the same data on the Security tab.

Another org’s events are never returned, and there is no endpoint to fetch a single event by id.

Audit trail

What to monitor and how the trail is used.

Security

The vault, the key, and what Sente does not have.

Connections

Write-only credentials and revocation.

​The audit event object

​Actions

​List audit events

​Related

Audit trail

Security

Connections

The audit event object

Actions

List audit events

Related