WorkOS

WorkOS events API

Query events and event streams.

GitHub OpenAPI

Documentation

📖
Documentation
https://workos.com/docs
📖
APIReference
https://workos.com/docs/reference
📖
RateLimits
https://workos.com/docs/reference/rate-limits

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/workos/refs/heads/main/openapi/workos-events-api-openapi.yml

SDKs

📦
GitHubRepository
https://github.com/workos/openapi-spec

Other Resources

🔗
StatusPage
https://status.workos.com
🔗
ChangeLog
https://workos.com/changelog
🔗
Pricing
https://workos.com/pricing
🔗
Plans
https://raw.githubusercontent.com/api-evangelist/workos/main/plans/workos-plans-pricing.yml
🔗
Capabilities
https://raw.githubusercontent.com/api-evangelist/workos/main/capabilities/shared/workos.yaml
🔗
GraphQL
https://raw.githubusercontent.com/api-evangelist/workos/refs/heads/main/graphql/workos-graphql.md

OpenAPI Specification

workos-events-api-openapi.yml Raw ↑ 
openapi: 3.1.1
info:
  title: WorkOS admin-portal events API
  description: WorkOS REST API
  version: '1.0'
  contact:
    name: WorkOS
    url: https://workos.com
    email: support@workos.com
  license:
    name: MIT
    url: https://opensource.org/license/MIT
servers:
- url: https://api.workos.com
  description: Production
- url: https://api.workos-test.com
  description: Staging
security:
- bearer: []
tags:
- name: events
  description: Query events and event streams.
  x-displayName: Events
paths:
  /events:
    get:
      description: List events for the current environment.
      operationId: EventsController_list
      parameters:
      - name: before
        required: false
        in: query
        description: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`.
        schema:
          example: xxx_01HXYZ123456789ABCDEFGHIJ
          type: string
      - name: after
        required: false
        in: query
        description: An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`.
        schema:
          example: xxx_01HXYZ987654321KJIHGFEDCBA
          type: string
      - name: limit
        required: false
        in: query
        description: Upper limit on the number of objects to return, between `1` and `100`.
        schema:
          minimum: 1
          maximum: 100
          default: 10
          example: 10
          type: integer
      - name: order
        required: false
        in: query
        description: Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to descending.
        schema:
          $ref: '#/components/schemas/PaginationOrder'
      - name: events
        required: false
        in: query
        description: Filter events by one or more event types (e.g. `dsync.user.created`).
        style: form
        explode: false
        schema:
          example:
          - dsync.user.created
          - dsync.user.updated
          type: array
          items:
            type: string
      - name: range_start
        required: false
        in: query
        description: ISO-8601 date string to filter events created after this date.
        schema:
          example: '2025-01-01T00:00:00Z'
          type: string
      - name: range_end
        required: false
        in: query
        description: ISO-8601 date string to filter events created before this date.
        schema:
          example: '2025-12-31T23:59:59Z'
          type: string
      - name: organization_id
        required: false
        in: query
        description: Filter events by the [Organization](/reference/organization) that the event is associated with.
        schema:
          example: org_01EHQMYV6MBK39QC5PZXHY59C3
          type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/EventList'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: 'Organization not found: ''org_01EHQMYV6MBK39QC5PZXHY59C3''.'
                required:
                - message
        '422':
          description: Unprocessable Entity
          content:
            application/json:
              schema:
                type: object
                properties:
                  errors:
                    type: array
                    items:
                      type: object
                      properties:
                        code:
                          type: string
                          description: The validation error code.
                          example: required
                        field:
                          type: string
                          description: The field that failed validation.
                          example: events
                      required:
                      - code
                      - field
                    description: The list of validation errors.
                  message:
                    type: string
                    description: A human-readable description of the error.
                    example: Validation failed.
                required:
                - errors
                - message
      summary: List Events
      tags:
      - events
components:
  schemas:
    EventContextDto:
      type: object
      properties:
        google_analytics_client_id:
          type: string
          description: The Google Analytics client ID.
          example: GA1.2.1234567890.1234567890
        google_analytics_sessions:
          type: array
          items:
            type: object
            properties:
              containerId:
                type: string
                description: The Google Analytics container ID.
                example: GTM-ABCDEF
              sessionId:
                type: string
                description: The Google Analytics session ID.
                example: '1234567890'
              sessionNumber:
                type: string
                description: The Google Analytics session number.
                example: '1'
            required:
            - containerId
          description: The Google Analytics sessions associated with the event.
        ajs_anonymous_id:
          type: string
          description: The anonymous ID from analytics.
          example: ajs_anon_01EHWNCE74X7JSDV0X3SZ3KJNY
        client_id:
          type: string
          description: The client ID associated with the event.
          example: client_01EHWNCE74X7JSDV0X3SZ3KJNY
        actor:
          $ref: '#/components/schemas/EventContextActorDto'
        previous_attributes:
          type: object
          additionalProperties: {}
          description: Attributes that changed from their previous values.
      description: Additional context about the event.
    UserlandUser:
      type: object
      properties:
        object:
          type: string
          description: Distinguishes the user object.
          const: user
        id:
          type: string
          description: The unique ID of the user.
          example: user_01E4ZCR3C56J083X43JQXF3JK5
        first_name:
          type:
          - string
          - 'null'
          description: The first name of the user.
          example: Marcelina
        last_name:
          type:
          - string
          - 'null'
          description: The last name of the user.
          example: Davis
        profile_picture_url:
          type:
          - string
          - 'null'
          description: A URL reference to an image representing the user.
          example: https://workoscdn.com/images/v1/123abc
        email:
          type: string
          description: The email address of the user.
          example: marcelina.davis@example.com
        email_verified:
          type: boolean
          description: Whether the user's email has been verified.
          example: true
        external_id:
          type:
          - string
          - 'null'
          description: The external ID of the user.
          example: f1ffa2b2-c20b-4d39-be5c-212726e11222
        metadata:
          type: object
          additionalProperties:
            type: string
            maxLength: 600
          description: Object containing metadata key/value pairs associated with the user.
          example:
            timezone: America/New_York
          propertyNames:
            maxLength: 40
          maxProperties: 50
        last_sign_in_at:
          format: date-time
          type:
          - string
          - 'null'
          description: The timestamp when the user last signed in.
          example: '2025-06-25T19:07:33.155Z'
        locale:
          type:
          - string
          - 'null'
          description: The user's preferred locale.
          example: en-US
        created_at:
          format: date-time
          type: string
          description: An ISO 8601 timestamp.
          example: '2026-01-15T12:00:00.000Z'
        updated_at:
          format: date-time
          type: string
          description: An ISO 8601 timestamp.
          example: '2026-01-15T12:00:00.000Z'
      required:
      - object
      - id
      - first_name
      - last_name
      - profile_picture_url
      - email
      - email_verified
      - external_id
      - last_sign_in_at
      - created_at
      - updated_at
      description: The user object.
    Group:
      type: object
      properties:
        object:
          type: string
          description: The Group object.
          example: group
          const: group
        id:
          type: string
          description: The unique ID of the Group.
          example: group_01HXYZ123456789ABCDEFGHIJ
        organization_id:
          type: string
          description: The ID of the Organization the Group belongs to.
          example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
        name:
          type: string
          description: The name of the Group.
          example: Engineering
        description:
          type:
          - string
          - 'null'
          description: An optional description of the Group.
          example: The engineering team
        created_at:
          format: date-time
          type: string
          description: An ISO 8601 timestamp.
          example: '2026-01-15T12:00:00.000Z'
        updated_at:
          format: date-time
          type: string
          description: An ISO 8601 timestamp.
          example: '2026-01-15T12:00:00.000Z'
      required:
      - object
      - id
      - organization_id
      - name
      - description
      - created_at
      - updated_at
    PaginationOrder:
      type: string
      enum:
      - normal
      - desc
      - asc
      example: desc
      default: desc
    EventContextActorDto:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier of the actor.
          example: user_01EHWNCE74X7JSDV0X3SZ3KJNY
        source:
          type: string
          enum:
          - api
          - dashboard
          - admin_portal
          - system
          description: The source of the actor that performed the action.
        name:
          type:
          - string
          - 'null'
          description: The name of the actor.
          example: Jane Doe
      required:
      - id
      - source
      - name
      description: The actor who performed the action.
    EventSchema:
      allOf:
      - type: object
        properties:
          object:
            type: string
            description: Distinguishes the Event object.
            const: event
          id:
            type: string
            description: Unique identifier for the Event.
            example: event_01EHZNVPK3SFK441A1RGBFSHRT
          event:
            type: string
            description: The type of event that occurred.
            example: dsync.user.created
          data:
            type: object
            additionalProperties: {}
            description: The event payload.
            example: &id001
              id: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ
              directory_id: directory_01ECAZ4NV9QMV47GW873HDCX74
              organization_id: org_01EZTR6WYX1A0DSE2CYMGXQ24Y
              state: active
              email: veda@foo-corp.com
              emails:
              - primary: true
                type: work
                value: veda@foo-corp.com
              idp_id: '2836'
              object: directory_user
              username: veda@foo-corp.com
              last_name: Torp
              first_name: Veda
              raw_attributes: {}
              custom_attributes: {}
              created_at: '2021-06-25T19:07:33.155Z'
              updated_at: '2021-06-25T19:07:33.155Z'
          created_at:
            format: date-time
            type: string
            description: An ISO 8601 timestamp.
            example: '2026-01-15T12:00:00.000Z'
          context:
            type: object
            additionalProperties: {}
            description: Additional context about the event.
        required:
        - object
        - id
        - event
        - data
        - created_at
        description: An event emitted by WorkOS.
        example: &id007
          object: event
          id: event_01EHZNVPK3SFK441A1RGBFSHRT
          event: dsync.user.created
          data: *id001
          created_at: '2021-06-25T19:07:33.155Z'
          context: {}
      - oneOf:
        - type: object
          properties:
            id:
              type: string
              description: Unique identifier for the event.
              example: event_01EHZNVPK3SFK441A1RGBFSHRT
            event:
              type: string
              const: action.authentication.denied
            data:
              type: object
              properties:
                action_endpoint_id:
                  type: string
                  description: The ID of the action endpoint.
                  example: action_endpoint_01EHWNCE74X7JSDV0X3SZ3KJNY
                action_execution_id:
                  type: string
                  description: The ID of the action execution.
                  example: action_execution_01EHWNCE74X7JSDV0X3SZ3KJNY
                type:
                  type: string
                  description: The type of action that was denied.
                  const: authentication
                verdict:
                  type: string
                  description: The verdict of the action.
                  const: Deny
                user_id:
                  type: string
                  description: The ID of the user.
                  example: user_01EHWNCE74X7JSDV0X3SZ3KJNY
                organization_id:
                  type:
                  - string
                  - 'null'
                  description: The ID of the organization.
                  example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
                email:
                  type: string
                  description: The email address of the user.
                  example: user@example.com
                ip_address:
                  type:
                  - string
                  - 'null'
                  description: The IP address of the request.
                  example: 203.0.113.1
                user_agent:
                  type:
                  - string
                  - 'null'
                  description: The user agent of the request.
                  example: Mozilla/5.0
              required:
              - action_endpoint_id
              - action_execution_id
              - type
              - verdict
              - user_id
              - organization_id
              - email
              - ip_address
              - user_agent
              description: The event payload.
            context:
              $ref: '#/components/schemas/EventContextDto'
            created_at:
              format: date-time
              type: string
              description: An ISO 8601 timestamp.
              example: '2026-01-15T12:00:00.000Z'
            object:
              type: string
              description: Distinguishes the Event object.
              const: event
          required:
          - id
          - event
          - data
          - created_at
          - object
        - type: object
          properties:
            id:
              type: string
              description: Unique identifier for the event.
              example: event_01EHZNVPK3SFK441A1RGBFSHRT
            event:
              type: string
              const: action.user_registration.denied
            data:
              type: object
              properties:
                action_endpoint_id:
                  type: string
                  description: The ID of the action endpoint.
                  example: action_endpoint_01EHWNCE74X7JSDV0X3SZ3KJNY
                action_execution_id:
                  type: string
                  description: The ID of the action execution.
                  example: action_execution_01EHWNCE74X7JSDV0X3SZ3KJNY
                type:
                  type: string
                  description: The type of action that was denied.
                  const: user_registration
                verdict:
                  type: string
                  description: The verdict of the action.
                  const: Deny
                organization_id:
                  type:
                  - string
                  - 'null'
                  description: The ID of the organization.
                  example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
                email:
                  type: string
                  description: The email address of the user.
                  example: user@example.com
                ip_address:
                  type:
                  - string
                  - 'null'
                  description: The IP address of the request.
                  example: 203.0.113.1
                user_agent:
                  type:
                  - string
                  - 'null'
                  description: The user agent of the request.
                  example: Mozilla/5.0
              required:
              - action_endpoint_id
              - action_execution_id
              - type
              - verdict
              - organization_id
              - email
              - ip_address
              - user_agent
              description: The event payload.
            context:
              $ref: '#/components/schemas/EventContextDto'
            created_at:
              format: date-time
              type: string
              description: An ISO 8601 timestamp.
              example: '2026-01-15T12:00:00.000Z'
            object:
              type: string
              description: Distinguishes the Event object.
              const: event
          required:
          - id
          - event
          - data
          - created_at
          - object
        - type: object
          properties:
            id:
              type: string
              description: Unique identifier for the event.
              example: event_01EHZNVPK3SFK441A1RGBFSHRT
            event:
              type: string
              const: api_key.created
            data:
              type: object
              properties:
                object:
                  type: string
                  description: Distinguishes the API key object.
                  const: api_key
                id:
                  type: string
                  description: Unique identifier of the API key.
                  example: api_key_01EHWNCE74X7JSDV0X3SZ3KJNY
                owner:
                  oneOf:
                  - type: object
                    properties:
                      type:
                        type: string
                        description: The type of the API key owner.
                        const: organization
                      id:
                        type: string
                        description: The unique identifier of the API key owner.
                        example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
                    required:
                    - type
                    - id
                  - type: object
                    properties:
                      type:
                        type: string
                        description: The type of the API key owner.
                        const: user
                      id:
                        type: string
                        description: The unique identifier of the user who owns the API key.
                        example: user_01EHWNCE74X7JSDV0X3SZ3KJNY
                      organization_id:
                        type: string
                        description: The unique identifier of the organization the API key belongs to.
                        example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
                    required:
                    - type
                    - id
                    - organization_id
                  description: The owner of the API key.
                name:
                  type: string
                  description: The name of the API key.
                  example: My API Key
                obfuscated_value:
                  type: string
                  description: The obfuscated value of the API key.
                  example: sk_test_...1234
                last_used_at:
                  type:
                  - string
                  - 'null'
                  description: The timestamp when the API key was last used.
                  example: '2026-01-15T12:00:00.000Z'
                permissions:
                  type: array
                  items:
                    type: string
                  description: The permissions granted to the API key.
                  example: &id002
                  - users:read
                  - users:write
                created_at:
                  type: string
                  description: The timestamp when the API key was created.
                  example: '2026-01-15T12:00:00.000Z'
                updated_at:
                  type: string
                  description: The timestamp when the API key was last updated.
                  example: '2026-01-15T12:00:00.000Z'
              required:
              - object
              - id
              - owner
              - name
              - obfuscated_value
              - last_used_at
              - permissions
              - created_at
              - updated_at
              description: The event payload.
            created_at:
              format: date-time
              type: string
              description: An ISO 8601 timestamp.
              example: '2026-01-15T12:00:00.000Z'
            context:
              $ref: '#/components/schemas/EventContextDto'
            object:
              type: string
              description: Distinguishes the Event object.
              const: event
          required:
          - id
          - event
          - data
          - created_at
          - object
        - type: object
          properties:
            id:
              type: string
              description: Unique identifier for the event.
              example: event_01EHZNVPK3SFK441A1RGBFSHRT
            event:
              type: string
              const: api_key.revoked
            data:
              type: object
              properties:
                object:
                  type: string
                  description: Distinguishes the API key object.
                  const: api_key
                id:
                  type: string
                  description: Unique identifier of the API key.
                  example: api_key_01EHWNCE74X7JSDV0X3SZ3KJNY
                owner:
                  oneOf:
                  - type: object
                    properties:
                      type:
                        type: string
                        description: The type of the API key owner.
                        const: organization
                      id:
                        type: string
                        description: The unique identifier of the API key owner.
                        example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
                    required:
                    - type
                    - id
                  - type: object
                    properties:
                      type:
                        type: string
                        description: The type of the API key owner.
                        const: user
                      id:
                        type: string
                        description: The unique identifier of the user who owns the API key.
                        example: user_01EHWNCE74X7JSDV0X3SZ3KJNY
                      organization_id:
                        type: string
                        description: The unique identifier of the organization the API key belongs to.
                        example: org_01EHWNCE74X7JSDV0X3SZ3KJNY
                    required:
                    - type
                    - id
                    - organization_id
                  description: The owner of the API key.
                name:
                  type: string
                  description: The name of the API key.
                  example: My API Key
                obfuscated_value:
                  type: string
                  description: The obfuscated value of the API key.
                  example: sk_test_...1234
                last_used_at:
                  type:
                  - string
                  - 'null'
                  description: The timestamp when the API key was last used.
                  example: '2026-01-15T12:00:00.000Z'
                permissions:
                  type: array
                  items:
                    type: string
                  description: The permissions granted to the API key.
                  example: *id002
                created_at:
                  type: string
                  description: The timestamp when the API key was created.
                  example: '2026-01-15T12:00:00.000Z'
                updated_at:
                  type: string
                  description: The timestamp when the API key was last updated.
                  example: '2026-01-15T12:00:00.000Z'
              required:
              - object
              - id
              - owner
              - name
              - obfuscated_value
              - last_used_at
              - permissions
              - created_at
              - updated_at
              description: The event payload.
            created_at:
              format: date-time
              type: string
              description: An ISO 8601 timestamp.
              example: '2026-01-15T12:00:00.000Z'
            context:
              $ref: '#/components/schemas/EventContextDto'
            object:
              type: string
              description: Distinguishes the Event object.
              const: event
          required:
          - id
          - event
          - data
          - created_at
          - object
        - type: object
          properties:
            id:
              type: string
              description: Unique identifier for the event.
              example: event_01EHZNVPK3SFK441A1RGBFSHRT
            event:
              type: string
              const: authentication.email_verification_failed
            data:
              type: object
              properties:
                type:
                  type: string
                  const: email_verification
                status:
                  type: string
                  const: failed
                ip_address:
                  type:
                  - string
                  - 'null'
                  description: The IP address of the request.
                  example: 203.0.113.42
                user_agent:
                  type:
                  - string
                  - 'null'
                  description: The user agent of the request.
                  example: Mozilla/5.0
                user_id:
                  type:
                  - string
                  - 'null'
                  description: The ID of the user.
                  example: user_01E4ZCR3C56J083X43JQXF3JK5
                email:
                  type:
                  - string
                  - 'null'
                  description: The email address of the user.
                  example: user@example.com
                error:
                  type: object
                  properties:
                    code:
                      type: string
                      description: The error code.
                      example: mfa_challenge_failed
                    message:
                      type: string
                      description: A human-readable error message.
                      example: The MFA challenge has failed.
                  required:
                  - code
                  - message
                  description: Details about the authentication error.
              required:
              - type
              - status
              - ip_address
              - user_agent
              - user_id
              - email
              - error
              description: The event payload.
            created_at:
              format: date-time
              type: string
              description: An ISO 8601 timestamp.
              example: '2026-01-15T12:00:00.000Z'
            context:
              $ref: '#/components/schemas/EventContextDto'
            object:
              type: string
              description: Distinguishes the Event object.
              const: event
          required:
          - id
          - event
          - data
          - created_at
          - object
        - type: object
          properties:
            id:
              type: string
              description: Unique identifier for the event.
              example: event_01EHZNVPK3SFK441A1RGBFSHRT
            event:
              type: string
              const: authentication.email_verification_succeeded
            data:
              type: object
              properties:
                type:
                  type: string
                  const: email_verification
                status:
                  type: string
                  const: succeeded
                ip_address:
                  type:
                  - string
                  - 'null'
                  description: The IP address of the request.
                  example: 203.0.113.42
                user_agent:
                  type:
                  - string
                  - 'null'
                  description: The user agent of the request.
                  example: Mozilla/5.0
                user_id:
                  type: string
                  description: The ID of the user.
                  example: user_01E4ZCR3C56J083X43JQXF3JK5
                email:
                  type: string
                  description: The email address of the user.
                  example: user@example.com
              required:
              - type
              - status
              - ip_address
              - user_agent
              - user_id
              - email
              description: The event payload.
            created_at:
              format: date-time
              type: string
              description: An ISO 8601 timestamp.
              example: '2026-01-15T12:00:00.000Z'
            context:
              $ref: '#/components/schemas/EventContextDto'
            object:
              type: string
              description: Distinguishes the Event object.
              const: event
          required:
          - id
          - event
          - data
          - created_at
          - object
        - type: object
          properties:
            id:
              type: string
              description: Unique identifier for the event.
              example: event_01EHZNVPK3SFK441A1RGBFSHRT
            event:
              type: string
              const: authentication.magic_auth_failed
            data:
              type: object
              properties:
                type:
                  type: string
                  const: magic_auth
                status:
                  type: string
                  const: failed
                ip_address:
                  type:
                  - string
                  - 'null'
                  des

# --- truncated at 32 KB (288 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/workos/refs/heads/main/openapi/workos-events-api-openapi.yml