> ## Documentation Index > Fetch the complete documentation index at: https://docs.sfcompute.com/llms.txt > Use this file to discover all available pages before exploring further. # Events > Read an ordered log of what happened on your account, from instances starting to orders filling
This feature is in [public preview](/preview/roadmap#feature-states).
Events form an append-only log of what happens on your account, such as [instances](/preview/instances) starting and terminating or [orders](/preview/orders) filling. Only events from the last 7 days are available. Authenticate with a bearer token, as described in [Using the API](/preview/using-the-api). ```bash theme={null} curl -H "Authorization: Bearer $SF_API_KEY" \ "https://api.sfcompute.com/preview/v2/events" ``` The response holds a page of events in `data`. ```json theme={null} { "object": "list", "data": [ { "object": "event", "id": "evt_x7Kp2mQhTv9rWq3s", "cursor": "evtc_...", "action": "instance.terminated", "occurred_at": 1755644312, "actor": { "type": "token", "id": "tokn_..." }, "targets": [{ "type": "instance", "id": "inst_9dQpXk2LwZj" }] } ], "has_more": false, "cursor": "evtc_..." } ``` `action` names what happened, and `occurred_at` records when, as a Unix timestamp in seconds. `actor` is the API token whose request caused the event, or `{ "type": "system" }` for automated actions, such as a preemption or a scheduled end. `targets` lists the resources the event is about as `{type, id}` pairs. Each `id` is the same ID the rest of the API uses for that resource. ## Event types The table below lists each event type and its target type. To filter by resource, pass a target type as `target_type` or a single resource's ID as `target`. | Action | Target type | Meaning | | ------------------------------- | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `instance.created` | `instance` | The instance was created and is [awaiting allocation](/preview/instances#instance-lifecycle). | | `instance.running` | `instance` | The instance started running. SSH access becomes available once its image finishes booting. | | `instance.termination_imminent` | `instance` | The instance will be terminated soon because its allocation is ending, whether from preemption or a scheduled end. | | `instance.terminated` | `instance` | The instance was terminated, whether by user request, replacement, preemption, deployment teardown, or a scheduled end. | | `instance.failed` | `instance` | The instance reported itself unhealthy. This does not terminate the instance, though work on it may be lost. [Replace](/preview/instances#replace-an-instance) or terminate it. | | `instance.connection_lost` | `instance` | The instance stopped responding. | | `order.created` | `order` | The order was placed. | | `order.filled` | `order` | The order filled completely. | | `order.cancelled` | `order` | The order was cancelled. | | `image.revoked` | `image` | The image was [revoked](/preview/images#revoking-an-image) and can no longer back new instances. | | `image.reinstated` | `image` | The image was reinstated and can back new instances again. | | `trust_level.updated` | `account` | Your account's trust level changed. | | `instance_sku_override.updated` | `instance_sku` | SF Compute set or changed property overrides on a [SKU](/preview/instance-skus) for your account. | | `instance_sku_override.deleted` | `instance_sku` | SF Compute removed the property overrides on a SKU for your account. | New event types are added over time, so if you don't filter by `action`, expect actions that aren't in this table. For a given instance, `instance.created`, `instance.running`, and `instance.terminated` appear in that order. An instance terminated while still awaiting allocation has no `instance.running` event. ## Consuming the stream List events with `GET /preview/v2/events`. Events are returned oldest first, up to `limit` per request. `limit` defaults to 50 and is capped at 200. To fetch the next page, pass the response's `cursor` back as `starting_after`. `has_more` tells you whether more events are already available. When `data` is empty and `has_more` is false, you have read everything so far. That response carries no `cursor`, so keep the one you sent and poll with it again later. Filter with `action` for an exact event type, `target` for one resource, `target_type` for one type of resource, and `since` and `until` for inclusive bounds on `occurred_at`, given as Unix timestamps. Filters combine, so a single request can ask for one event type on one resource. ```bash theme={null} # Everything that happened to one instance curl -H "Authorization: Bearer $SF_API_KEY" \ "https://api.sfcompute.com/preview/v2/events?target=inst_9dQpXk2LwZj&target_type=instance" # All terminations since a point in time curl -H "Authorization: Bearer $SF_API_KEY" \ "https://api.sfcompute.com/preview/v2/events?action=instance.terminated&since=1755043200" # When one order filled curl -H "Authorization: Bearer $SF_API_KEY" \ "https://api.sfcompute.com/preview/v2/events?action=order.filled&target=ordr_5Gh8kLm2Np4QwXz" ``` A cursor only works with the filters it was created with, and reusing it with different filters returns 400 Bad Request. If a saved cursor falls outside the 7-day retention window, requests with it return 410 Gone. In that case, start over without a cursor to read from the oldest available event. ## API reference See the [Events API](/preview/api-reference/events/list-events) for every parameter and response field.