Security Events API Overview – Proof Help Center
The Security Events API is a RESTful interface automatically available to Proof users with Command Center access that enables organizations to export over 15 types of security and audit events—formatted in the industry-standard OCSF schema and retained for 90 days—directly into SIEM or monitoring tools like Splunk or Datadog to support SOC2/ISO 27001 compliance, automate security monitoring, and facilitate historical event backfill and ongoing polling via authenticated API calls.
The short answer: The Security Events API is a REST API that lets you pull security and audit events from your Proof account — such as logins, role changes, and MFA activity — directly into your SIEM or security monitoring tools like Splunk or Datadog.
This feature is automatically enabled for organizations with Command Center Standard or Command Center Lite access. To get started, you need a Proof API key.
Why use the Security Events API
Organizations pursuing SOC2 or ISO 27001 certification need to demonstrate that security events in systems containing customer data are being monitored. Previously, there was no way to export these events from the Proof platform. The Security Events API solves this by letting you automatically pull events into your own tools.
- Enables compliance certification — provides auditable security event logs to support SOC2 and ISO 27001 requirements
- Saves time — eliminates manual security monitoring through automated API integration
- Industry-standard format — events are returned in OCSF (Open Cybersecurity Schema Framework) for direct ingestion by most SIEM tools without transformation
- Comprehensive coverage — tracks 15+ critical event types including logins, role changes, MFA changes, API key activity, and suspicious behavior
- 90-day retention — provides sufficient history for security investigations and compliance audits
How it works
- 1.
Enable the feature — automatically enabled for all organizations with Command Center Standard or Lite access. No action needed.
- 2.
Generate API credentials — create an API key from your account settings to authenticate requests.
- 3.
Initial backfill — make your first API call with a
sinceparameter to pull historical events (up to 30 days back):GET /logs/v1/security-events?since=2026-02-01T00:00:00Z&limit=1000 - 4.
Set up ongoing polling — configure your SIEM to poll the API regularly (every 5–15 minutes recommended) using the
cursorfrom the previous response:GET /logs/v1/security-events?cursor=eyJpZCI6MTIzNH0&limit=1000 - 5.
Filter events (optional) — add filters for specific event types or severity levels:
GET /logs/v1/security-events?class_uid=3002&severity_id=1 - 6.
Process events — events are returned in OCSF format and can be ingested directly by most SIEM tools without transformation.
- 7.
Monitor continuously — events are retained for 90 days. The API supports up to 100 requests per 15-minute window.
Who is this for
The Security Events API is designed for enterprise and commercial customers in regulated industries — particularly organizations pursuing security certifications or that need to centralize security monitoring. Common use cases include:
- Security operations teams
- Compliance officers
- IT administrators
- DevSecOps engineers
Access requires a Proof API key. The feature can be tested in the Fairfax sandbox environment the same way as other Proof API endpoints.
✓ Summary Checklist
- Available automatically to all Command Center Standard and Lite orgs — no setup needed beyond an API key.
- Use
sincefor initial backfill (up to 30 days), then poll withcursorevery 5–15 minutes for ongoing monitoring. - Events are in OCSF format, retained for 90 days, and the API supports up to 100 requests per 15 minutes.
Still unsure? Contact Proof Support for help.
Related
Premier Onboarding Service Description
The Premier Onboarding Service offers Proof Subscribers up to twelve hours of remote, time-and-materials consulting by Proof’s Solution Engineering team during business hours to facilitate rapid and effective use of the Proof Platform through activities such as validating business objectives and planning, with additional hours billable upon consent and governed by Proof’s General Terms or any separately negotiated agreements.
Cleaner Data and More Admin Control This June
June updates for Enterprise and Command Center teams introduce direct deactivation of child organizations from the Command Center with safeguards, seamless export of Proof audit events into SIEM tools like Splunk and Datadog via a standards-based API in OCSF format, and enhanced transaction data exports featuring additional fields aligned with the product UI, all enabling improved data control and security management without needing support or CSM assistance.
API Supplement
The API Supplement, effective December 16, 2024, is incorporated into the Proof General Terms and grants Subscribers a limited, revocable license to use Proof’s APIs solely for integrating their applications with Proof’s Services, requires secure handling and non-sharing of API Keys, restricts API use to approved purposes, and governs access to sensitive personal data such as homeowner and financial information under strict compliance conditions.
Implementation Service Description
The Implementation Service provides Proof Subscribers with a time- and materials-based, remote consulting engagement during business hours to assist with architecting, planning, and integrating the Proof Platform via API for an embedded product experience, including discovery sessions with stakeholders to align business objectives and technical requirements, governed by Proof's General Terms and detailed in the Order Form.
Notarize: Remote Online Notarization by Proof
Notarize by Proof offers a secure, 24/7 remote online notarization platform accepted in all 50 states, enabling individuals and businesses to notarize documents instantly without appointments, featuring compliant identity verification, optional witnesses, custom branding, and the ability to use either your own or Proof’s extensive notary network to ensure seamless, fraud-protected notarizations anytime.
Command Center
Command Center is an enterprise administration tool that enables organizations to centrally manage Proof across divisions with advanced user provisioning, precise permission controls, team-based data organization, automated user management via SCIM, and robust security features including SSO, just-in-time provisioning, sign-up restrictions, email change controls, and rigorous data protection to ensure compliance and secure customer data.