Audit events

Streams every matching event for the authenticated tenant within the audit log retention period. Events are newest first. The optional q, actorIds, eventTypes, fromUtc, and toUtc parameters filter the download. Dates are UTC calendar dates; both requested bounds are inclusive. The response is not paged. The token must include the analytics:read and audit-log:read permissions. The token's https://stackoverflow.com/claims/subscription_level claim must be Enterprise. A 403 response without the X-Audit-Log-Unavailable-Reason header means authentication or authorization denied the request before the subscription and audit-log availability checks. A 403 response with the X-Audit-Log-Unavailable-Reason header means the request passed authentication and permission checks, but the subscription or audit-log availability check denied access. The starter value means the workspace is on Starter. The disabled value means the audit-log availability check denied access, including a disabled setting, lookup failure, or false fallback.