Engramma

Security

intermediate

Audit logs, session management, and session revocation endpoints.

Audit log

GET/v1/security/audit-log

Retrieve the audit log. Shows all security-relevant actions.

pageintegerDefault: 1

Page number.

limitintegerDefault: 50

Items per page.

200Response
{
  "entries": [
    {
      "action": "login",
      "actor_email": "[email protected]",
      "ip": "203.0.113.42",
      "user_agent": "Mozilla/5.0...",
      "success": true,
      "timestamp": "2026-01-20T14:30:00Z"
    },
    {
      "action": "key_created",
      "actor_email": "[email protected]",
      "details": {
        "key_name": "Staging Environment"
      },
      "success": true,
      "timestamp": "2026-01-20T14:35:00Z"
    }
  ],
  "page": 1,
  "limit": 50,
  "has_more": true
}
curl "https://api.engramma-memory.com/v1/security/audit-log?page=1&limit=20" \
  -H "X-API-Key: $ENGRAMMA_API_KEY"

List sessions

GET/v1/security/sessions

List all active sessions for your account.

200Response
[
  {
    "id": "sess-uuid",
    "device": "Chrome on macOS",
    "ip_address": "203.0.113.42",
    "location": "Paris, France",
    "last_active": "2026-01-20T15:45:00Z",
    "created_at": "2026-01-20T14:30:00Z",
    "is_current": true
  },
  {
    "id": "sess-uuid-2",
    "device": "Safari on iPhone",
    "ip_address": "198.51.100.23",
    "location": "London, UK",
    "last_active": "2026-01-19T22:00:00Z",
    "created_at": "2026-01-18T09:00:00Z",
    "is_current": false
  }
]

Revoke session

DELETE/v1/security/sessions/{session_id}

Revoke a specific session. Tokens are immediately invalidated.

session_idstringrequired

Session ID to revoke (path parameter).

200Response
{
  "message": "Session revoked"
}
Tip

If you notice an unfamiliar session, revoke it immediately and change your password. Enable MFA if not already active.

Security recommendations

  1. Enable MFA — Protects against password compromise
  2. Review sessions regularly — Revoke any session you don't recognize
  3. Monitor the audit log — Watch for failed login attempts
  4. Rotate API keys — Create new keys and revoke old ones periodically
  5. Use scoped keys — Give each key only the permissions it needs

Next steps

UsageErrors