---
title: "Event-frequency histogram for this workspace's audit log"
method: GET
path: "/api/workspaces/{workspaceId}/audit-logs/histogram"
tags: ["Audit Log"]
---

# Event-frequency histogram for this workspace's audit log

`GET /api/workspaces/{workspaceId}/audit-logs/histogram`

## Request

- Base URL: `https://hiveship.app/api`
- URL: `https://hiveship.app/api/api/workspaces/{workspaceId}/audit-logs/histogram`
- Auth: API key in cookie `hiveship_access`

Time-bucketed counts for the chart above the results table. `resolution` is "hour" (short ranges) or "day" (longer ranges); buckets are UTC-aligned. Workspace-scoped: `workspaceId` is forced before delegation. The response carries only `{ bucketStart, count }` aggregates — no per-row fields — so no workspace-boundary redaction is needed. Requires OWNER or ADMIN role; MEMBERs get 403.

## Path parameters

- `workspaceId` string, required

## Response `200`

Time-bucketed audit-event counts for this workspace.

- object
  - `success` boolean, required
  - `data` object, required
    - `buckets` object[], required
      - `bucketStart` string, required
      - `count` integer, required
    - `resolution` 'hour' | 'day', required
    - `total` integer, required

## Other responses

- `400`: Invalid query — `dateFrom`/`dateTo` missing or the range exceeds 90 days
- `403`: Caller is not an OWNER or ADMIN

---

[API](https://skmtc.dev/hiveship/apis/hiveship-api.md) · [All operations](https://skmtc.dev/hiveship/apis/hiveship-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hiveship/apis/hiveship-api/revisions/73d3e26544e4?raw)