---
title: "Activity feed"
method: GET
path: "/v2/workspaces/{id}/activity"
tags: ["Activity"]
---

# Activity feed

`GET /v2/workspaces/{id}/activity`

## Request

- Base URL: `https://api.infolang.ai`
- URL: `https://api.infolang.ai/v2/workspaces/{id}/activity`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer
  - HTTP bearer

Cursor-paginated audit feed of workspace events. `status` and `latency_ms` are promoted out of each row's freeform `metadata` bag when present; the bag is still returned for extras.

Class B read-only — all three lanes, via the IDOR-safe Kairos preflight.

Requires the `activity:read` scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an `il_*` machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying `activity:read` is still refused where the role does not permit it.

A credential with no scope record resolves to `LEGACY_DEFAULT`, which INCLUDES `activity:read` — every key minted before scoping keeps working here.

## Path parameters

- `id` string, required

## Query parameters

- `limit` number
- `cursor` string

## Response `200`

Activity events, newest first

- object
  - `activity` object[], required
    - `id` string, required
    - `ts` string, required
    - `actor` string, required
    - `action` string, required
    - `target` string
    - `status` 'hit' | 'empty' | 'error' | 'ok'
    - `latency_ms` number
    - `metadata` object
  - `nextCursor` string

## Other responses

- `401`: The credential itself is invalid — absent, unverifiable on the session lane, or rejected by the Kairos preflight on the `il_live_`/`il_test_`/`il_oauth_` lanes — or `credential_expired`, outside its `[not_before, expires_at)` window
- `403`: `forbidden` — the credential is valid but holds NO grant on this workspace, or is not scoped to it. On the il_* lanes this is the IDOR guard: the preflight bound the presented credential to the path `{id}` and it did not match, so no workspace data was read. Or `insufficient_scope` — the credential's scope set or the caller's role does not cover the scope this route requires (named in the message)
- `422`: Invalid limit

---

[API](https://skmtc.dev/infolang/apis/infolang-api.md) · [All operations](https://skmtc.dev/infolang/apis/infolang-api/llms.txt) · [OpenAPI document](https://skmtc.dev/infolang/apis/infolang-api/revisions/d04bf6de72c8?raw)