---
title: "What admins did (sign-ins, credit changes), newest first. Owner only."
method: GET
path: "/v1/admin/actions"
tags: ["admin"]
---

# What admins did (sign-ins, credit changes), newest first. Owner only.

`GET /v1/admin/actions`

## Request

- Base URL: `https://api.hookdetector.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.hookdetector.com/v1/admin/actions`
- Auth: none declared

The audit: every password sign-in and credit change, newest first, with who
(actor_email), on which account (target_account_id) and the detail (for credits:
delta, note, before and after). Needs the admin scope and an admin account. MCP:
admin_list_actions.

## Query parameters

- `limit` integer, nullable: page size, 1 to 200 (default 50)

## Headers

- `authorization` string, nullable: Bearer hd_... from POST /v1/accounts or POST /v1/keys

## Response `200`

Successful Response

- AdminActionList
  - `actions` AdminActionItem[], required: newest first
    - `id` string, required
    - `action` string, required: signin_password, credits or other
    - `actor_email` string, nullable, required
    - `target_account_id` string, nullable, required
    - `detail` object, required: for credits: delta, note, before and after
    - `created_at` string, required

## Other responses

- `401`: missing, invalid, revoked or expired API key (code key_expired)
- `403`: the key lacks the admin scope (insufficient_scope), or its account is not the owner's (admin_required)
- `413`: request body over the size cap
- `422`: invalid input
- `500`: our fault; names the request id

---

[API](https://skmtc.dev/hookdetector/apis/hook-detector.md) · [All operations](https://skmtc.dev/hookdetector/apis/hook-detector/llms.txt) · [OpenAPI document](https://skmtc.dev/hookdetector/apis/hook-detector/revisions/b136a2804d2b?raw)