---
title: "List Audit"
method: GET
path: "/api/admin/audit"
tags: ["admin"]
---

# List Audit

`GET /api/admin/audit`

## Request

- Base URL: `https://api.heymetra.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.heymetra.com/api/admin/audit`
- Auth: none declared

What platform staff have done, newest first.

Two filters, because they are the two questions that follow "what
happened": what was done to this customer, and every time this kind of thing
was done. Filtering by actor is available in the library and not published
here — the screen has no picker for it, and an endpoint nothing calls is an
endpoint nothing checks.

## Query parameters

- `action` 'skill.create' | 'skill.import' | 'skill.update' | 'skill.delete' | 'enterprise.grant' | 'enterprise.edit' | 'enterprise.checkout' | 'module.set' | 'module.reset': What a superadmin did, as the audit trail names it (ZEISO-302). A closed vocabulary rather than free text. An audit table whose ``action`` column is whatever the last caller typed cannot be filtered, cannot be counted, and cannot be read a year later by somebody who does not know which spellings were in use that month. The rule for membership: **an action belongs here when it changes what a customer gets or sees.** That is why feedback triage is absent — moving a note from new to triaged changes nothing on the customer's side, and it is also the highest-volume thing staff do here, so logging it would bury the four actions that matter. ``tests/test_admin_audit.py`` enumerates the router and fails if a new writing endpoint is neither audited nor deliberately excluded. The names are ``subject.verb`` so that filtering by prefix is filtering by subject, and they are persisted as strings: adding one is a code change, not a migration that rewrites a type.
- `tenant_id` string, uuid, nullable
- `limit` integer

## Headers

- `authorization` string, nullable
- `x-workspace-id` string, nullable

## Response `200`

Successful Response

- AuditEntryOut[]
  - `id` string, uuid, required
  - `created_at` string, date-time, required
  - `actor_user_id` string, required
  - `actor_email` string, nullable, required
  - `action` 'skill.create' | 'skill.import' | 'skill.update' | 'skill.delete' | 'enterprise.grant' | 'enterprise.edit' | 'enterprise.checkout' | 'module.set' | 'module.reset', required: What a superadmin did, as the audit trail names it (ZEISO-302). A closed vocabulary rather than free text. An audit table whose ``action`` column is whatever the last caller typed cannot be filtered, cannot be counted, and cannot be read a year later by somebody who does not know which spellings were in use that month. The rule for membership: **an action belongs here when it changes what a customer gets or sees.** That is why feedback triage is absent — moving a note from new to triaged changes nothing on the customer's side, and it is also the highest-volume thing staff do here, so logging it would bury the four actions that matter. ``tests/test_admin_audit.py`` enumerates the router and fails if a new writing endpoint is neither audited nor deliberately excluded. The names are ``subject.verb`` so that filtering by prefix is filtering by subject, and they are persisted as strings: adding one is a code change, not a migration that rewrites a type.
  - `subject_type` 'workspace' | 'module' | 'skill', required: What an admin action was done to. Three, because the id in ``subject_id`` is three different kinds of thing: a workspace uuid, a connector key, a skill uuid. Storing the kind beside it is what lets a reader (and a query) tell them apart without guessing from the shape of the string.
  - `subject_id` string, required
  - `subject_label` string, nullable, required
  - `tenant_id` string, uuid, nullable, required
  - `before` object, nullable, required
  - `after` object, nullable, required
  - `changed` FieldChangeOut[], required
    - `field` string, required
    - `before` unknown
    - `after` unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/heymetra/apis/heymetra-api.md) · [All operations](https://skmtc.dev/heymetra/apis/heymetra-api/llms.txt) · [OpenAPI document](https://skmtc.dev/heymetra/apis/heymetra-api/revisions/488ce9683884?raw)