---
title: "Append-only audit logs"
method: GET
path: "/audit-logs"
---

# Append-only audit logs

`GET /audit-logs`

## Request

- Base URL: `https://api.caveman.so/api/v1`
- URL: `https://api.caveman.so/api/v1/audit-logs`
- Auth: one of:
  - OAuth 2
    - Authorization code: `/api/v1/oauth/authorize`
    - Token URL: `/api/v1/oauth/token` scopes: `auditlog:read`
  - HTTP bearer
  - API key in cookie `cave_access`
  - API key in cookie `__Secure-cave_identity.session_token`

GET /api/v1/audit-logs on the Caveman Cloud control plane. Requires the auditlog:read scope. Exposed to autonomous agents as the list action of the caveman_audit tool (read access). The tenant audit trail: who changed what, when, and from where. An agent reads it to confirm its own writes actually landed. Separate from caveman_policy because reading it requires an owner/admin-level scope that the rest of policy reading does not.

## Query parameters

- `action` string
- `actor_id` string
- `cursor` string
- `limit` integer
- `since` string
- `until` string

## Response `200`

Audit log page

## Other responses

- `2XX`: Successful response. Exact status depends on synchronous or durable delivery outcome.
- `4XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.
- `5XX`: Structured failure. `error.code` is stable; `error.request_id` is echoed in the x-cave-request-id header.

---

[API](https://skmtc.dev/caveman/apis/caveman-cloud-api.md) - [All operations](https://skmtc.dev/caveman/apis/caveman-cloud-api/llms.txt) - [OpenAPI document](https://skmtc.dev/caveman/apis/caveman-cloud-api/revisions/508312d01cfc?raw)