API reference · Audit log
List audit log entries, newest first
GET
/v1/orgs/{org}/audit-log- Permission
audit.entries.read- Operation
audit.entries.list
Parameters
| Name | In | Type | Required | Notes |
|---|---|---|---|---|
org | path | string | yes | for example "org_01h455vb4pex5vsknk084sn02q" |
limit | query | integer | no | 1 to 100; default 50 |
cursor | query | string | no | 0 to 200 characters |
action | query | string | no | 0 to 100 characters |
actorKind | query | string | no | one of "user", "api_token", "system" |
actorId | query | "system" or string or string | no | |
resourceType | query | string | no | 0 to 50 characters |
resourceId | query | string | no | 0 to 100 characters |
from | query | string (date-time) | no | UTC, ISO 8601. |
to | query | string (date-time) | no | UTC, ISO 8601. |
x-obhut-management-assignment | header | string | no | Select one staff assignment. Direct membership remains the default. Bound API tokens use their stored source and ignore this selector. For example "masg_01h455vb4pex5vsknk084sn02q" |
Response 200
| Field | Type | Required | Notes |
|---|---|---|---|
items | array of object | yes | |
items[].id | string | yes | for example "audit_01h455vb4pex5vsknk084sn02q" |
items[].sequence | integer | yes | more than 0 |
items[].occurredAt | string (date-time) | yes | UTC, ISO 8601. |
items[].action | string | yes | |
items[].actor | object | yes | |
items[].actor.kind | string | yes | one of "user", "api_token", "system" |
items[].actor.id | string | yes | |
items[].resource | object | yes | |
items[].resource.type | string | yes | |
items[].resource.id | string | yes | |
items[].requestId | string | yes | |
items[].ip | string or null | yes | |
items[].data | object | yes | |
items[].redacted | array of string | yes | |
items[].hash | string | yes | 64 to 64 characters |
nextCursor | string or null | yes |