---
title: "GET /api/admin/audit_records"
method: GET
path: "/api/admin/audit_records"
tags: ["Admin: Audit"]
---

# GET /api/admin/audit_records

`GET /api/admin/audit_records`

## Request

- The document declares no server URL.
- Auth: API key in cookie `session`

The audit trail, newest first. Needs the capability Permission `audit.read`
on the Staff Role even for an administrator, and is itself recorded as a
read of personal data: records carry addresses and old values.

## Query parameters

- `page` integer
- `perPage` integer
- `actorUserId` integer
- `channel` 'web' | 'mcp'
- `operation` string
- `entityType` string
- `entityId` string
- `from` string, date-time
- `to` string, date-time

## Response `200`

The request has succeeded.

- AuditRecordPage: A page of results. Generic envelope reused by every admin list so the CRUD engine (TanStack Table) can read pagination uniformly.
  - `items` AuditRecord[], required
    - `id` integer, required
    - `occurredAt` string, date-time, required
    - `actorUserId` integer, nullable, required: Null for a refusal of a caller who was not signed in.
    - `channel` 'web' | 'mcp', required
    - `connectedAppId` integer, nullable, required
    - `tokenId` string, nullable, required
    - `requestId` string, nullable, required
    - `address` string, nullable, required
    - `userAgent` string, nullable, required
    - `operation` string, required: The operation name, e.g. `AdminUpdateBlogPost`.
    - `entityType` string, nullable, required
    - `entityId` string, nullable, required
    - `locale` string, nullable, required
    - `outcome` 'succeeded' | 'forbidden' | 'failed', required
    - `changes` AuditChange[], required
      - `entity` string, required: The ent entity type, e.g. `BlogPost`.
      - `id` string
      - `op` string, required: create, update or delete.
      - `fields` AuditFieldChange[]
        - `name` string, required
        - `old` unknown
        - `new` unknown
        - `secret` boolean
    - `reads` AuditReads, required: What a read of personal data touched: how many rows and, up to a cap, their ids. Identifiers and counts only, never a field value.
      - `count` integer, required
      - `ids` string[]
  - `total` integer, required: Total rows across all pages (before pagination).
  - `page` integer, required: 1-based page number this response represents.
  - `perPage` integer, required: Page size used for this response.

## Other responses

- `default`: Default error response shared by every operation. `@error` emits an OpenAPI `default` response, keeping central transport failures typed without enumerating every status on every operation.

## Changes

- **2026-10-18** `9380d4c85a04`: 4 info
  - removed the non-success response with the status `401`
  - removed the non-success response with the status `403`
  - removed the non-success response with the status `422`
  - added the optional property `errors` to the response with the `default` status
- **2026-10-17** `023e7c2cd140`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/changes/api/admin/audit_records/get.md)

---

[API](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api.md) · [All operations](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hexlet-basics/apis/hexlet-basics-api/revisions/51c7f596b47c?raw)