---
title: "The team audit log, newest first, filterable and paginated (audit:read; keys need access to all projects)"
method: GET
path: "/orgs/{orgId}/audit"
tags: ["Teams"]
---

# The team audit log, newest first, filterable and paginated (audit:read; keys need access to all projects)

`GET /orgs/{orgId}/audit`

## Request

- Base URL: `https://hostingsurge.com/api/v1`
- URL: `https://hostingsurge.com/api/v1/orgs/{orgId}/audit`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Host-hs_session`

## Path parameters

- `orgId` string, uuid, required

## Query parameters

- `actor` string, uuid: user id of the actor
- `action` string: exact action, or a prefix: "domain" and "domain." match every domain.* action
- `resourceType` string
- `resourceId` string
- `projectId` string, uuid
- `from` string, date-time: inclusive
- `to` string, date-time: exclusive
- `includeAccess` 'true' | 'false': also list access events (every API key use, OAuth token issue/refresh)
- `cursor` string: nextCursor of the previous page
- `limit` integer

## Response `200`

Entries

- object
  - `items` object[], required
    - `id` string, uuid, required
    - `createdAt` string, required: ISO-8601 timestamp
    - `action` string, required: dotted action, e.g. team.member_role_changed, domain.added, sso.login_succeeded
    - `source` 'event' | 'audit', required: event: platform_events; audit: the older audit trail (normalized action name)
    - `actor` object, required
      - `kind` 'session' | 'api_token' | 'mcp_token' | 'system' | 'operator', required
      - `userId` string, uuid, nullable, required
      - `name` string, nullable, required
      - `email` string, nullable, required
      - `credentialId` string, nullable, required
      - `credentialName` string, nullable, required
    - `projectId` string, uuid, nullable, required
    - `projectName` string, nullable, required
    - `resourceType` string, nullable, required
    - `resourceId` string, nullable, required
    - `details` object, required
  - `nextCursor` string, nullable, required

## Other responses

- `400`: Invalid request (code invalid_request; details.reason names a policy rule)
- `401`: Missing or invalid session/token (code unauthorized)
- `403`: Not permitted (code forbidden). details.sessionRequired: changes need a dashboard session; details.reauthenticate: sign in again (changes need a session younger than 5 minutes); details.policy: the team requires mfa/sso. Code ip_not_allowed: the team's IP allow-list does not include your address (details.clientIp)
- `404`: Not found or not visible to the caller (code not_found)
- `409`: Conflicts with the team state, e.g. the last owner (code conflict)
- `429`: Too many requests (code rate_limited); see Retry-After

---

[API](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api.md) · [All operations](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hostingsurge/apis/hostingsurge-platform-api/revisions/4d08337cdff1?raw)