On this page
← All product updates

Ingest Your Audit Log into Your SIEM

Laurin Quast
Laurin Quast

Until now, getting the audit log out of Hive Console meant exporting a CSV file from the organization settings. That works for an occasional review, but security teams want audit events in the same place as everything else: their SIEM.

The new audit log API makes that possible. It’s a single HTTP endpoint that your SIEM (Splunk, Microsoft Sentinel, Elastic, Datadog, …) or any script can poll to continuously ingest your organization’s audit log.

curl -H "Authorization: Bearer $HIVE_ACCESS_TOKEN" \
  "https://api.graphql-hive.com/audit-log/v1/events?limit=100"

How It Works

  • Cursor-based pagination: every response returns a nextCursor. Store it, pass it back on the next request, and you’ll only receive events you haven’t seen yet. A Link: rel="next" header is included too, for clients that follow links.
  • Stable, versioned events: every event uses a versioned JSON envelope with the event type, the actor (user, organization access token or system), its IP address and user agent, and event-specific metadata.
  • Filtering and backfill: use the eventTypes query parameter to only fetch the events you care about, and the since query parameter to choose how far back a new integration starts. Without since, you get the full year of retained history.

For example, to only fetch sign-in events since November 1st:

curl -H "Authorization: Bearer $HIVE_ACCESS_TOKEN" \
  "https://api.graphql-hive.com/audit-log/v1/events?eventTypes=USER_SIGNED_IN,USER_SIGN_IN_FAILED&since=2026-11-01T00:00:00Z"

Get Started

  1. In your organization Settings, create an organization access token with the new Describe audit log (auditLog:describe) permission.
  2. Point your SIEM’s HTTP pull input (or your own script) at https://api.graphql-hive.com/audit-log/v1/events and send the token as a bearer token.
  3. Fetch from the endpoint, following nextCursor to retrieve latest events (until caught up; then poll every minute).