Audit log

List audit log events

Lists what happened in this organization, newest first: an append-only trail. Open to every member: with audit:view it lists every event in the organization; without it, only the caller's own events plus events on connections they own or can edit. The response says which, as a top-level scope (org or own) beside the list envelope. An own response also carries connection_scope: all, one (a connection_id was given), or too_many (the caller owns or can edit more connections than one query lists, so the page holds only their own events). Anyone who can edit a connection (the owner, or an edit grant direct, through a team, or org-wide) sees every member's tool calls made through it. Filters combine with AND; q additionally matches the actor by name or email. The cursor is opaque: do not parse or construct one. Events are eventually consistent, so one may take a moment to appear after the action that produced it.

get/audit-log

Request

  • Base URL: https://api.elaichi.ai
  • URL: https://api.elaichi.ai/audit-log
  • Auth: HTTP bearer

Query parameters

limitinteger

Page size. Defaults to 50. Values above 200 are silently clamped to 200 rather than rejected; a value below 1, or a non-integer, is a 400. Ignored by the endpoints documented as unpaginated.

cursorstring

Opaque cursor — pass the next_cursor from a previous response. Ignored by unpaginated endpoints.

qstring

Matches the action, the resource, or the actor by name/email. system matches system-generated rows. LIKE wildcards are matched literally. Max 200 characters.

category'auth' | 'assistant' | 'mcp' | 'toolbox' | 'file' | 'connection' | 'access' | 'org' | 'other'

Bucket derived from the action name. Any other value is a 400.

action'created' | 'updated' | 'deleted' | 'read' | 'other'

Verb class of the action, not the full action name.

actorstring

A user id (usr_…), or the literal system for rows with no human actor. Max 128 characters.

connection_idstring

Only events on this connection (conn_…). Needs audit:view, or owning the connection, or edit on it; otherwise 404, the same as an id that does not exist. Max 128 characters.

sincestring date-time

Inclusive lower bound on created_at. ISO-8601; anything unparseable is a 400.

Headers

X-Organization-Idstring

Target organization (org_…). Required for cookie/session auth on org-scoped routes; optional for API tokens, which carry their organization, and rejected when it names a different one.

Response

OK

next_cursorstring nullable required
prev_cursorstring nullable required

Changes

No recorded changes to this operation across all 1 revision of this API.