---
title: "Who did what in the organization, newest first."
method: GET
path: "/v1/organizations/current/audit"
tags: ["organizations"]
---

# Who did what in the organization, newest first.

`GET /v1/organizations/current/audit`

## Request

- Base URL: `https://api.50heads.com`
- URL: `https://api.50heads.com/v1/organizations/current/audit`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://auth.50heads.com/authorize`, token URL `https://auth.50heads.com/token`; client credentials, token URL `https://auth.50heads.com/token`, scopes: `audit:read`)

Organization admins only. Read-only: entries cannot be changed or deleted. 50 a page.

## Query parameters

- `cursor` string: `nextCursor` from the previous page.

## Response `200`

OK

- OrganizationAuditResponse
  - `events` object[], required
    - `id` string, required
    - `at` string, required
    - `actor` object, required
      - `id` string, nullable, required
      - `name` string, nullable, required
    - `action` 'organization.created' | 'organization.renamed' | 'domain.added' | 'domain.removed' | 'domain.verified' | 'domain.check_failed' | 'domain.warning' | 'domain.restored' | 'domain.failed' | 'policy.changed' | 'member.joined' | 'sso.configured' | 'sso.updated' | 'sso.test_started' | 'sso.tested' | 'sso.enabled' | 'sso.disabled' | 'sso.enforced' | 'sso.unenforced' | 'sso.enforcement_suspended' | 'sso.linked' | 'sso.unlinked' | 'break_glass.added' | 'break_glass.removed' | 'break_glass.used' | 'scim.token_created' | 'scim.token_rotated' | 'scim.token_revoked' | 'scim.settings_changed' | 'scim.mapping_created' | 'scim.mapping_changed' | 'scim.mapping_removed' | 'group.created' | 'group.renamed' | 'group.members_changed' | 'group.deleted' | 'member.provisioned' | 'member.linked' | 'member.updated' | 'member.role_changed' | 'member.removed' | 'member.deprovisioned' | 'member.reactivated' | 'member.deleted' | 'member.sessions_revoked' | 'member.credentials_revoked' | 'member.webhooks_stopped' | 'deprovision.failing' | 'workspace.owner_changed' | 'sso.sessions_ended' | 'service_account.created' | 'service_account.updated' | 'service_account.disabled' | 'service_account.enabled' | 'service_account.deleted' | 'service_account.secret_rotated' | 'service_account.secret_revoked' | 'service_account.keys_changed' | 'approval.requested' | 'approval.viewed' | 'approval.reauthenticated' | 'approval.decided' | 'approval.refused' | 'approval.expired' | 'approval.canceled' | 'approval.policy_changed' | 'workspace.created' | 'workspace.renamed' | 'workspace.cost_center_changed' | 'workspace.closed' | 'workspace.move_requested' | 'workspace.move_canceled' | 'workspace.move_declined' | 'workspace.moved_in' | 'workspace.moved_out' | 'organization.default_workspace_changed' | 'organization.closed' | 'invitation.resent' | 'invitation.revoked' | 'warehouse.destination_created' | 'warehouse.destination_updated' | 'warehouse.destination_deleted' | 'warehouse.export_failing' | 'warehouse.export_recovered', required
    - `subject` string, required
    - `data` object, required
  - `nextCursor` string, nullable, required

## Other responses

- `400`: The request is not valid; `error.details.validation` lists the fixes.
- `401`: No key or token, or it expired or was revoked.
- `403`: The key or token lacks the scope (`insufficient_scope`), or the action is not allowed.
- `429`: Too many requests; wait for Retry-After.

---

[API](https://skmtc.dev/50heads/apis/50heads-api.md) · [All operations](https://skmtc.dev/50heads/apis/50heads-api/llms.txt) · [OpenAPI document](https://skmtc.dev/50heads/apis/50heads-api/revisions/20175e8b00e3?raw)