---
title: "List activity log events"
method: GET
path: "/v1/audit"
tags: ["audit"]
---

# List activity log events

`GET /v1/audit`

## Request

- Base URL: `https://api.brixsignage.com`
- URL: `https://api.brixsignage.com/v1/audit`
- Auth: HTTP bearer

Returns the workspace's append-only activity log, newest first, with each event's actor shown by name rather than raw id, whether the actor was a person, an API key, or the system. Page with `limit` and `cursor`; `nextCursor` sits beside `data`. There are no filters: use the export for a time window. A caller limited to some locations sees only the events at those locations.

**Notes.**
- Newest first. There are no filters: page with `cursor`.
- A caller limited to some locations sees only events at those locations, so a page can hold fewer than `limit` events while `nextCursor` is still set.

## Query parameters

- `limit` integer
- `cursor` string

## Response `200`

Success.

- object
  - `data` AuditEvent[], required
    - `id` string, required
    - `at` string, required: ISO-8601 timestamp (UTC).
    - `workspaceId` string, required
    - `actor` string, required: `user:<id>`, `apikey:<id>`, `system`, or another internal actor.
    - `actorKind` 'user' | 'api-key' | 'system', required
    - `actorName` string, required: The person's or key's name; `System` for the system.
    - `actorEmail` string, required: The person's email; `n/a` for a key; `system@brix` for the system.
    - `action` string, required: What happened, e.g. `screen.renamed`.
    - `target` string, nullable, required: The id of the thing acted on.
    - `detail` string, nullable, required
    - `nodeId` string, nullable, required: The location the event belongs to; null for the workspace.
    - `nodeName` string, nullable, required
    - `ipAddress` string, nullable, required
    - `userAgent` string, nullable, required
    - `via` 'mcp' | 'api', nullable, required: How it arrived: `mcp` (an MCP tool such as Claude or ChatGPT), `api` (an API key on REST), null (in the Brix app).
    - `viaApp` string, nullable, required: The connector or API key behind an `mcp`/`api` event; null for the app.
  - `nextCursor` string, nullable, required: Pass as `cursor` for the next (older) page; null on the last page.

## Other responses

- `401`: Missing, expired or revoked bearer token.
- `403`: The token lacks the permission this operation needs (see `x-brix-permission`).
- `5XX`: Server error. The body carries a `requestId` to quote to support.

---

[API](https://skmtc.dev/brixsignage/apis/brix-api.md) · [All operations](https://skmtc.dev/brixsignage/apis/brix-api/llms.txt) · [OpenAPI document](https://skmtc.dev/brixsignage/apis/brix-api/revisions/02fd3665dc7d?raw)