Read consumer's own audit trail for a company

Returns the slice of the immutable Sporingslogg (audit_log table) that THIS consumer wrote against the URL's org_number. Cross-consumer visibility is structurally impossible — the reader filters on consumer_id = <authed-consumer> AND org_number = <url-org> as a parameterized binding before any other predicate, and rows belonging to any other consumer never appear regardless of scope, role, or operator status. Useful for consumers reconciling what their own agents did (reading every delegation.create / gov_api.call row an agent generated for a company — see the closed action enum below for the full vocabulary), AI-agent operators debugging filing flows (filter on initiated_by=agent), and dispute defense (Skatteforvaltningsforskriften and bokføringsloven both impose retention obligations on the agent of record; this endpoint provides the forensic trail). The response surfaces correlation_id (joins to provenance_log, evaluation_snapshots, compliance_state_events from the same request), initiated_byschema_version (the OpenAPI contract version at write time so a future schema break is traceable). Sensitive keys in the details JSONB are AUTO-REDACTED to [REDACTED] by the read-side scrubber (deny-list pattern: any key containing token / secret / password / bearer / authorization / jwt / api_key / private_key / credential / client_secret / refresh_token, case-insensitive); the write-side redactor is the primary defence and the read-side scrubber is belt-and-suspenders for any pre-correlation-id rows. Pagination is keyset on (timestamp DESC, id DESC) with limit + 1 lookahead — next_before and next_before_id from the previous response form the cursor for the next page; rows with identical timestamps tiebreak deterministically on id so a paged scan never duplicates or skips. Empty result for a valid (consumer, org) pair returns 200 with the full envelope data: { data: [], pagination: { limit, has_more: false } } (NEVER 404 — that would leak existence across consumers). Query parameters validated by Zod at route boundary: limit is z.coerce.number().int().min(1).max(200).default(50) — string→number coercion of valid numeric inputs (?limit=50 → 50) IS part of the contract because URL query parameters arrive as strings via URLSearchParams; non-numeric or out-of-range inputs (?limit=abc, ?limit=0, ?limit=999) fail validation explicitly rather than silently normalising; before is z.string().datetime({ offset: true }); before_id is z.string().uuid(); since and until are z.string().datetime({ offset: true }) (the { offset: true } modifier accepts ISO 8601 with explicit Z or +HH:MM offset — bare local times are rejected); action and initiated_by are closed enums (see schemas). Validation uses safeParse returning a structured 400 response with error_code: VALIDATION_FAILED and per-field details[] on any failure — no swallowed errors, no silent dropping of invalid fields. Source:.