--- title: "List audit log events" method: GET path: "/audit-log" tags: ["Audit log"] --- # List audit log events `GET /audit-log` ## Request - Base URL: `https://api.elaichi.ai` - URL: `https://api.elaichi.ai/audit-log` - Auth: HTTP bearer Lists what happened in this organization, newest first: an append-only trail. Open to every member: with `audit:view` it lists every event in the organization; without it, only the caller's own events plus events on connections they own or can edit. The response says which, as a top-level `scope` (`org` or `own`) beside the list envelope. An `own` response also carries `connection_scope`: `all`, `one` (a `connection_id` was given), or `too_many` (the caller owns or can edit more connections than one query lists, so the page holds only their own events). Anyone who can edit a connection (the owner, or an `edit` grant direct, through a team, or org-wide) sees every member's tool calls made through it. Filters combine with AND; `q` additionally matches the actor by name or email. The cursor is opaque: do not parse or construct one. Events are eventually consistent, so one may take a moment to appear after the action that produced it. ## Query parameters - `limit` integer - `cursor` string - `q` string - `category` 'auth' | 'assistant' | 'mcp' | 'toolbox' | 'file' | 'connection' | 'access' | 'org' | 'other' - `action` 'created' | 'updated' | 'deleted' | 'read' | 'other' - `actor` string - `connection_id` string - `since` string, date-time ## Headers - `X-Organization-Id` string ## Response `200` OK - object - `result` object[], required - `id` string: Audit entry id (`aud_…`). - `actor_user_id` string, nullable: Null for system-generated entries (`usr_…` otherwise). - `action` string: Dotted action name, e.g. `connection.deleted`. - `resource_type` string, nullable - `resource_id` string, nullable: Prefixed id of the affected resource, when there is one. - `metadata` object: Action-specific detail; shape varies by action. - `created_at` string, date-time - `category` string - `action_kind` string - `actor_kind` 'user' | 'system' | 'staff' | 'scim' | 'api_token' | 'ai_assistant': `staff` means Elaichi support did it: either directly (a `staff.*` action, where `actor_user_id` is the support user, not a member) or while signed in as a member (`actor` is the member and `metadata.impersonated_by_user_id` is the support user). - `actor` object: The person behind this row. Read this rather than resolving `actor_user_id` against the member directory, which is paginated and would only name the actors on the page you happened to fetch. - `user_id` string, nullable - `name` string, nullable: Null (with `email`) when the id is no longer resolvable in this organization — a departed member, which clients render as "Former member". - `email` string, nullable - `avatar_url` string, nullable: The person's picture: their stored profile picture, else a Gravatar URL (`d=404`, 96px) derived from their email (the address itself is not sent), else null. Draw initials when it is null or the image fails to load. - `kind` string: Mirrors `actor_kind`, so a non-human actor stays distinguishable from an unnamed one. - `tool_call` object, nullable: A connected-tool call (`assistant.toolbox_tool`, `assistant.toolbox.execute`) or synthetic-tool run (`synthetic_tool.executed`) in words; null on every other row. Names are resolved when you read, so renaming or deleting a connection or client changes how old rows read. - `summary` string: Outcome-aware sentence, e.g. "Updated a page in Notion" or "Failed to update a page in Notion". - `tool_name` string: The catalog tool name, unqualified, when recorded; else the advertised name. - `connector` object, nullable: Null when no single connector applies (a synthetic tool) or none was recorded or resolvable. - `slug` string - `name` string - `logo` string, nullable - `can_view` boolean: Whether the caller may open this connector (`GET /connector/{slug}`): holds `connector:view` and the catalog resolved the slug. - `toolbox` object, nullable: The stored toolbox the call went through. Null for the built-in all-tools and per-connection sets, for a synthetic-tool row, and for a row that never recorded one. - `id` string - `name` string, nullable: Null when the toolbox is gone or the lookup failed. - `can_view` boolean: Whether the caller may open it (`GET /toolbox/{id}`): owner or a grant. - `synthetic_tool` object, nullable: The synthetic tool the call ran: a `synthetic_tool.executed` row, or a toolbox call whose tool was a synthetic one. Null for every ordinary connector-tool call. - `id` string - `name` string: The name it had when it ran. - `can_view` boolean: Whether the caller may open it (`GET /synthetic-tool/{id}`): its owner only. - `connection` object, nullable - `id` string - `name` string, nullable - `state` 'active' | 'deleted' | 'unknown': `unknown` means the lookup failed — never read it as deleted. - `can_view` boolean: Whether the caller may open this connection (`GET /connection/{id}`). - `via` object - `surface` 'app' | 'mcp' | 'api' | 'console' | 'null', nullable: `app` the Elaichi app's built-in agent, `console` a person using the Elaichi app itself (a synthetic tool's Run), `mcp` an MCP client, `api` an org API token. Null when not recorded, never guessed. - `client_id` string, nullable - `client_name` string, nullable: The verified client name when its redirect URIs prove it, else the self-reported name. - `client_logo` string, nullable - `client_mark` 'claude' | 'chatgpt' | 'cursor' | 'grok' | 'perplexity' | 'mistral' | 'devin' | 'null', nullable: The verified client's bundled-mark slug; set only when `client_verified` is true. - `client_verified` boolean: True only when the name and logo come from the verified client. - `outcome` 'succeeded' | 'failed' - `error` string, nullable: Error code (never a message), e.g. `call_failed:429`. - `error_message` string, nullable: Fixed plain-English sentence for `error`; null on success. - `access` 'read' | 'write' | 'destructive' | 'null', nullable - `approval` 'not_required' | 'approved_by_person' | 'always_allowed' | 'allowed_by_connected_app' | 'direct_run' | 'null', nullable: `direct_run`: a person ran a synthetic tool directly (in the Elaichi app or with `POST /synthetic-tool/{id}/execute`), so no approval gate asked; this is not the same as `not_required` (a read). On `assistant.toolbox.execute` the requirement follows the tool's own tier. Null when the row predates the recorded facts, or the source is not one of these. - `arguments_edited` boolean, nullable - `target` object, nullable: What the call touched. A list, search or query has the type alone (id, name and url null). Null when nothing could be identified. - `type` string, nullable: The catalog resource, singular. - `id` string, nullable: The path id or the created record's id. Never an email address. - `name` string, nullable: The object's title. Always null for a person's record (by resource noun or by response shape), for a message-like record (email, thread, comment, event, post, ...), and when it contains an email address. - `url` string, nullable: http(s), no user:password, origin + path only (query and fragment dropped). Null for a create-like call and for any call whose resource or method names a session, signed/temporary/download link, export, portal, checkout, invite or recipient view. - `result_count` integer, nullable: Items a list, search or query returned. - `next_cursor` string, nullable, required - `prev_cursor` string, nullable, required ## Other responses - `400`: Bad request - `401`: Unauthorized - `403`: Forbidden - `404`: Not found - `429`: Rate limited --- [API](https://skmtc.dev/elaichi/apis/elaichi-api.md) · [All operations](https://skmtc.dev/elaichi/apis/elaichi-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaichi/apis/elaichi-api/revisions/b22cfb7b6d15?raw)