> ## Documentation Index
> Fetch the complete documentation index at: https://www.courier.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Install the Courier skill before writing code: `npx skills add trycourier/courier-skills`. It carries the verified SDK shapes and the rules you cannot get wrong.
> Authenticate every request with `Authorization: Bearer <API_KEY>`. A workspace has several environments and each has its own keys, which are plain `pk_` strings with no environment prefix. Start with Test.
> Send with `client.send.message` from the Node SDK (`@trycourier/courier` v7 and later, where the client is the default import). Reference a template by its `nt_` id or its alias.
> A send accepts a bare Elemental element list, but storing content on a template requires the top-level elements wrapped in a channel element.
> Templates and journeys can be built in the Courier app or created through the API. Either way they live in the workspace and are referenced by ID when you send.
> The hosted MCP server is https://mcp.courier.com. For a briefing on what Courier is and when to use it, read https://www.courier.com/llms.txt.
> Prefer the Guides tab for how-do-I questions and the Docs tab for how-does-it-behave questions. The API reference lives under /api-reference.

# Audit trail

> A log of API key rotations, role changes, publishes, and integration edits, with who and when.

export const Endpoint = ({method, path, name, href, children, bare}) => {
  const verb = String(method || "").toUpperCase();
  const title = verb + " " + path;
  const label = children || name || path;
  if (bare) {
    return href ? <a href={href}><code>{title}</code></a> : <code>{title}</code>;
  }
  if (!href) {
    return <span className="cx-endpoint" data-method={verb} title={title}>
        <span className="cx-endpoint-label">{label}</span>
        <span className="cx-endpoint-method">{verb}</span>
      </span>;
  }
  return <a className="cx-endpoint" data-method={verb} href={href} title={title}>
      <span className="cx-endpoint-label">{label}</span>
      <span className="cx-endpoint-method">{verb}</span>
    </a>;
};

export const Doc = ({href, children, name, bare}) => {
  const label = children || name || href;
  if (bare) {
    return <a href={href}>{label}</a>;
  }
  return <a className="cx-endpoint" data-kind="doc" href={href}>
      <span className="cx-endpoint-label">{label}</span>
      <span className="cx-endpoint-method">DOC</span>
    </a>;
};

Courier records every API key rotation, role change, publish, and integration edit.

Use it for compliance and security review, in the console or through the Audit Events API.

## How it works

### What it records

The audit trail captures configuration and access changes across the workspace:

* **API keys**: created, deleted, rotated.
* **Users**: invited, role changed, deleted, logged out.
* **Workspace settings**: name, discoverability, SSO-required, tracking toggles, guard rails.
* **Templates**: published, deleted, duplicated, draft created, rolled back, topic changed.
* **Brands**: created, updated, published, deleted, default changed.
* **Automations**: template published or deleted.
* **Preferences**: page published, topic/section created or deleted, channels changed, default status changed.
* **Outbound integrations**: Segment, Rudderstack, Datadog, and New Relic source changes.

Each event records the actor, the target that changed, the source, a timestamp, and the event type. It records workspace changes, not message delivery. For delivery history see <Doc href="/docs/monitor/overview">logs</Doc>.

### Reading the audit trail

Review events in the console under **Settings**, or pull them over the API. <Endpoint method="GET" path="/audit-events" name="List Audit Events" href="/docs/api-reference/audit-events/list-audit-events" /> is cursor-paginated, and <Endpoint method="GET" path="/audit-events/{audit-event-id}" name="Get an Audit Event" href="/docs/api-reference/audit-events/get-an-audit-event" /> reads one. Use the API to forward events to a SIEM, an external log store, or a compliance dashboard.

<CodeGroup>
  ```javascript Node.js theme={null}
  const auditEvents = await client.auditEvents.list();

  for (const event of auditEvents.results) {
    console.log(event.type, event.actor.email, event.timestamp);
  }
  ```

  ```python Python theme={null}
  audit_events = client.audit_events.list()

  for event in audit_events.results:
      print(event.type, event.actor.email, event.timestamp)
  ```

  ```bash cURL theme={null}
  curl https://api.courier.com/audit-events \
    -H "Authorization: Bearer $COURIER_API_KEY"
  ```

  ```ruby Ruby theme={null}
  audit_events = courier.audit_events.list

  audit_events.results.each do |event|
    puts "#{event.type} #{event.actor.email} #{event.timestamp}"
  end
  ```

  ```go Go theme={null}
  auditEvents, err := client.AuditEvents.List(context.TODO(), courier.AuditEventListParams{})
  if err != nil {
  	panic(err)
  }

  for _, event := range auditEvents.Results {
  	fmt.Println(event.Type, event.Timestamp)
  }
  ```

  ```java Java theme={null}
  AuditEventListResponse auditEvents =
      client.auditEvents().list(AuditEventListParams.builder().build());

  auditEvents.results().forEach(event ->
      System.out.println(event.type() + " " + event.timestamp()));
  ```

  ```php PHP theme={null}
  $auditEvents = $client->auditEvents->list();

  foreach ($auditEvents->results as $event) {
    echo $event->type . ' ' . $event->timestamp . PHP_EOL;
  }
  ```

  ```csharp C# theme={null}
  var auditEvents = await client.AuditEvents.List(new());

  foreach (var auditEvent in auditEvents.Results)
  {
      Console.WriteLine($"{auditEvent.Type} {auditEvent.Timestamp}");
  }
  ```

  ```bash CLI theme={null}
  courier audit-events list \
    --api-key "$COURIER_API_KEY"
  ```

  ```text MCP theme={null}
  With Courier MCP, list this workspace's audit events.
  ```
</CodeGroup>

The audit trail requires the **Enterprise** plan. [Contact Courier](https://www.courier.com/request-demo) to enable it for your workspace.

## Limits & behavior

* **It records configuration changes, not message events.** Delivery status lives in message logs.
* **Actor and target are always recorded.** Every event carries who acted and what changed.

## FAQ

<AccordionGroup>
  <Accordion title="Can I pull audit events into my own system?">
    Use <Endpoint method="GET" path="/audit-events" name="List Audit Events" href="/docs/api-reference/audit-events/list-audit-events" /> to page through events and forward them to a SIEM, log store, or dashboard. Each event includes the actor, target, source, type, and timestamp.
  </Accordion>

  <Accordion title="Does the audit trail show message deliveries?">
    The audit trail records workspace and access changes. For delivery history, use <Doc href="/docs/monitor/overview">message logs</Doc>.
  </Accordion>
</AccordionGroup>