The org's audit log as events (WorkOS Events shape; ?events=&since=&order=&after=)

The organization's audit log as customer-facing events (WorkOS Events API shape): every decision that changed something - node create/stop/delete, job submissions, sandbox creates and deletes (sandbox.create / sandbox.delete, one event per CALL with count inside, so a fork_sandbox(count: 64) is one event and a month of forks reconstructs from the log), invites, role changes, cap changes, credits, dunning - who did it, from which surface, and when. Admin and billing roles see the whole org; members see their own decisions. Newest first by default; pass after from list_metadata.after to page older, or order:"asc" to walk oldest-to-newest (the sync/tail order: keep polling with the last cursor to stream new events). History reaches back 24 months. Every row names its actor, so data.actor.type answers "my key or the platform?": customer/service_token is one of your people, operator is Autoresearch staff, and system is the platform acting on its own - which it does only to END a node nobody asked it to end (idle grace lapsing, the container dying, a host death, a queued wake's hold expiring, your workspace's idle-burn auto-stop as alert.idle_burn_stop, a machine retiring as market.retire.stop or market.retire.preserve_stop). The system rows are org-scoped and nobody's authorship, so reading them needs the admin or billing role; a member sees only their own. data.context.request_id is the same id the API returns in the request-id header, so a row you did cause joins back to the call that caused it. NOTE there is no wake tool: run_command, write_file and node_doctor WAKE a stopped node as a side effect, and the node.wake row's details.trigger names which one did it. Other telemetry (heartbeats, meter ticks, and every non-ending transition - scheduled, ready, sessions attaching) is never here - node history lives on get_node.