Fetch team audit logs with the Cursor Admin API

Enterprise teams can pull security and admin events over GET https://api.cursor.com/teams/audit-logs with Basic auth (API key as username, empty password). Official guides: Admin API → Get Audit Logs; Compliance and Monitoring; Grok Bot security → Logging and audit.

Rate limit: 20 requests per minute per team. Date range cannot exceed 30 days — page longer windows with multiple calls.

Auth

Create a team Admin API key from the Cursor dashboard, then:

curl -X GET "https://api.cursor.com/teams/audit-logs?startTime=7d&endTime=now" \
  -u YOUR_API_KEY:

The trailing colon after the key is required for Basic auth with an empty password.

Filter the pull

Param	Purpose
startTime / endTime	Range. Relative (7d, 5h, now), ISO 8601, YYYY-MM-DD, or Unix ms/s
eventTypes	Comma-separated types (see below)
search	Free-text filter
users	Emails and/or encoded user_… IDs (max equals pageSize)
page / pageSize	1-indexed page; size 1–500 (default 100)

Examples:

# Last 7 days, login + Grok Bot routine events
curl -X GET "https://api.cursor.com/teams/audit-logs?startTime=7d&endTime=now&eventTypes=login,grok_bot_routine" \
  -u YOUR_API_KEY:

# Filter by actors
curl -X GET "https://api.cursor.com/teams/audit-logs?users=admin@company.com,user_PDSPmvukpYgZEDXsoNirw3CFhy&eventTypes=login,add_user" \
  -u YOUR_API_KEY:

Grok Bot–relevant event types

Pass these in eventTypes when you care about Bot control-plane activity:

event_type	Meaning
grok_bot_created	Bot created (blank, template, or Agent SDK)
grok_bot_access_changed	Member access changes (all members or groups)
grok_bot_team_setup_manifest	Team Setup manifest save/delete
grok_bot_routine	Routine create/update (older rows may still say automation)
mcp_authentication	MCP OAuth login (user credential or team service account)
slack_account_link	Slack account link / relink

Other common types: login, logout, add_user, remove_user, update_user_role, team_settings, mcp_server_config, team_api_key, user_api_key, privacy_mode, user_spend_limit, team_rule, team_repo, team_hook, team_command, directory-group events, and Bugbot events. Full list is on the Admin API page.

Read application_type

Each event includes application_type:

• grok_bot — action from Grok Bot
• cursor — Cursor desktop, iOS, CLI, Agent SDK, cursor.com, or Admin API
• "" (empty) — unknown, or a row written before the field existed (not backfilled)

Use this field to keep Bot control-plane events separate from editor/admin noise. Bot actions (shell, browser, MCP tool calls) do not appear here — those go through Action Recording and OpenTelemetry Export.

Response shape

{
  "events": [
    {
      "event_id": "evt_abc123",
      "timestamp": "2024-01-15T12:30:00.000Z",
      "ip_address": "203.0.113.42",
      "user_email": "admin@company.com",
      "event_type": "add_user",
      "application_type": "cursor",
      "event_data": { "email": "admin@company.com", "method": "manual" }
    }
  ],
  "pagination": {
    "page": 1,
    "pageSize": 100,
    "totalCount": 2,
    "totalPages": 1,
    "hasNextPage": false,
    "hasPreviousPage": false
  }
}

Page with page until hasNextPage is false. Dedupe on event_id if you re-pull overlapping windows.

Pitfalls

• Expecting Bot shell/browser actions in audit logs — use Action Recording + OpenTelemetry Export for those.
• Windows longer than 30 days in one call — split the range.
• Missing the empty password colon in -u KEY: — auth fails.
• Treating empty application_type as non-Bot — older rows lack the field.