Your SIEM asks SightLift for each read of conversation text: who read it, when, where, which conversation and whose. It asks with a token a Protection Owner issues. SightLift sends nothing out.
← Back to the dashboardIn the SIEM feed block, give the token a label (your SIEM's name, say) and choose
Issue a token. The token starts with slrl_. SightLift shows it once
and stores only a hash of it, so copy it into your SIEM straight away. A company holds at most
five active tokens.
GET https://<your SightLift address>/api/read-log/events?after=<next_after>&limit=1000
Authorization: Bearer slrl_…after: the next_after from the page before. Leave it out on the
first pull.limit: how many reads one page may hold, 1 to 5,000. 1,000 when left out.The token is the request's only credential. A signed-in browser session, a WorkOS token or a SightLift connection token is refused here, and a read-log token is refused everywhere else.
Reads come oldest first. Each one carries id, occurred_at,
actor_sub, actor_name, actor_email,
actor_roles, surface, conversation_id,
owner_key, text_surface and store, and own
when SightLift recorded the read as the reader's own. No conversation text is ever in it.
The page also carries has_more, next_after and
settled_through. While has_more is true, ask again with
after set to next_after. When it is false you have every read up to
settled_through. Keep the last next_after and poll with it later.
Why reads arrive 5 minutes late. SightLift stamps a read when it starts
recording it, so a read whose record takes longer can be saved after a read stamped later. A page holds
only reads at least 5 minutes old, which lets that order settle, so walking
next_after returns each read once.
An owner key stands for the person whose conversation was read. Each read of one person's conversations carries the same key, and SightLift does not turn it back into a name here.
Retry-After
header says how many seconds to wait.Each pull that returns reads is on your access trail as "Your SIEM pulled conversation reads", named by the token's label, with how many reads it took and their first and last time. A pull that finds nothing new leaves no row.
A Protection Owner revokes a token in the same block, and it stops working at once. Turning Protected content controls off revokes every token.