Account Access Review API

The Account Access Review API exposes Quave ONE platform access-review evidence for compliance workflows: account members, pending invitations, MFA coverage, environment-access summaries, and account audit events.

Make sure to read the Get Started document to understand how the API works.

Important: Account events in this API are Quave ONE platform audit events. They are not customer application HTTP access logs, ingress logs, nginx logs, or visitor logs.

Note: These endpoints accept user tokens only.

List Members

To list account members and pending invitations, send a GET request to the /api/public/v1/members endpoint.

This endpoint requires the MANAGE_MEMBERS role on the account. It mirrors the effective Members page permission model.

Query Parameters

Parameter	Type	Description	Required
accountId	String	Account ID to review.	Yes

Example

curl -X GET \
    -H 'Authorization: YOUR_TOKEN' \
    'https://api.quave.cloud/api/public/v1/members?accountId=ACCOUNT_ID'

Example Response

{
  "account": {
    "accountId": "ACCOUNT_ID",
    "name": "Acme",
    "slug": "acme",
    "requireMfa": true,
    "memberEnvAccessEnabled": true
  },
  "summary": {
    "members": 2,
    "pendingInvitations": 1,
    "mfaCoveredMembers": 1,
    "restrictedMembers": 1
  },
  "members": [
    {
      "membershipId": "MEMBERSHIP_ID",
      "userId": "USER_ID",
      "email": "admin@example.com",
      "username": "admin",
      "name": "Admin User",
      "roles": ["ADMIN"],
      "roleLabels": ["Admin"],
      "createdAt": "2026-07-01T10:00:00.000Z",
      "updatedAt": null,
      "mfa": {
        "covered": true,
        "enabledAt": "2026-07-01T10:00:00.000Z",
        "twoFactorType": "otp"
      },
      "memberEnvAccess": {
        "enabled": true,
        "hasFullAccess": true,
        "allowedAppEnvIds": [],
        "allowedAppEnvIdsCount": 0
      }
    }
  ],
  "pendingInvitations": [
    {
      "email": "auditor@example.com",
      "roles": ["AUDIT"],
      "roleLabels": ["Audit"]
    }
  ]
}

The membershipId field can be used with the member environment access endpoints.

List Account Events

To list account audit events, send a GET request to the /api/public/v1/account/events endpoint.

This endpoint requires the AUDIT role on the account and exposes only regular account-scope events. Customer-hidden internal/system events are excluded server-side.

Query Parameters

Parameter	Type	Description	Required
accountId	String	Account ID whose platform audit events should be listed.	Yes
skip	Number	Pagination offset. Default: 0.	No
limit	Number	Maximum events to return. Default: 20; maximum: 100.	No
from	String	Start timestamp in ISO 8601 format.	No
to	String	End timestamp in ISO 8601 format.	No
types	String	Comma-separated EventTypes keys to include, such as MEMBER_INVITE or MCP_KEY_CREATE.	No
channels	String	Comma-separated audit channels, such as UI, API, MCP, or SYSTEM.	No
userIds	String	Comma-separated user IDs to include.	No
appIds	String	Comma-separated app IDs to include.	No
appEnvId	String	App environment ID to include.	No
excludeNavigation	Boolean	Exclude NAVIGATION events when true. Default: false.	No
filters	JSON object	Optional JSON object with the same filter fields above. Direct query parameters win when both are supplied.	No

Example

curl -X GET \
    -H 'Authorization: YOUR_TOKEN' \
    'https://api.quave.cloud/api/public/v1/account/events?accountId=ACCOUNT_ID&channels=MCP,API&limit=50&excludeNavigation=true'

Example Response

{
  "count": 12,
  "skip": 0,
  "limit": 50,
  "events": [
    {
      "_id": "EVENT_ID",
      "type": "MEMBER_INVITE",
      "channel": "MCP",
      "userId": "USER_ID",
      "userEmail": "admin@example.com",
      "appId": null,
      "appName": null,
      "appRemoved": null,
      "appEnvId": null,
      "appEnvName": null,
      "appEnvRemoved": null,
      "ip": "203.0.113.10",
      "pathname": null,
      "details": {
        "email": "auditor@example.com",
        "roles": ["AUDIT"]
      },
      "createdAt": "2026-07-01T10:00:00.000Z"
    }
  ]
}