Audit

List Audit Entries

Changed on

List audit entries with optional filters.

Scoped to the caller: their own entries plus those made by agents they own. Org admins see every entry.

get/audit

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /audit
  • Auth: one of:
    • HTTP bearer
    • OAuth 2 (authorization code, authorization URL /authorize, token URL /oauth/token)

Query parameters

target_type'revision' | 'permission' | 'user' | 'credential' | 'toolkit' | 'agent' | 'job' | 'organisation' | 'invite_token' | 'event' | 'execution_record' | 'service_account' | 'token' | 'overlay' | 'note' | 'api' | 'access_request' | 'toolkit_key' | 'credential_binding' | 'permission_rule_set' | 'session' | 'provider_config' | 'oauth_client' | 'oauth_grant' | 'oauth_app_registration'

Entity types that can be the target of an audited action.

Only return entries for this target type; must be sent together with target_id.

target_idstring nullable

Only return entries for this target ID; must be sent together with target_type.

Example:agnt_6968b3984d1c238dbe7e2e29
actor_idstring nullable

Only return entries made by this actor.

Example:agnt_6968b3984d1c238dbe7e2e29
originstring nullable

Only return entries initiated from this surface, e.g. dashboard or cli.

Example:dashboard
sincestring date-time nullable

Only return entries that occurred at or after this time (RFC 3339).

Example:2026-01-01T00:00:00Z
untilstring date-time nullable

Only return entries that occurred at or before this time (RFC 3339).

Example:2026-01-31T23:59:59Z
cursorstring nullable

Opaque cursor from a previous page's next_cursor; omit for the first page.

Example:eyJ0IjogIjIwMjYtMDEtMTVUMDk6MzA6MDArMDA6MDAiLCAiaWQiOiAiM2YyYjhjMWUtN2Q0YS00ZTliLWE2YzUtMWQyZTNmNGE1YjZjIn0=
limitinteger

Maximum number of entries to return (1-200, default 50).

Example:25

Response

Successful Response

has_moreboolean required

Whether more results exist after this page.

next_cursorstring nullable

Cursor for the next page; null when there are no more results.

Example response

{
  "data": [
    {
      "action": "update",
      "actor_id": "usr_6968b3987ee4c3ec0b4ee3b9",
      "actor_session_id": "5f0c2a9e-3b7d-4c1a-9e8f-2d6b4a1c7e30",
      "actor_type": "user",
      "after": {
        "active": true,
        "name": "Stripe production key"
      },
      "before": {
        "active": true,
        "name": "Stripe test key"
      },
      "diff": {
        "added": {},
        "modified": {
          "name": {
            "new": "Stripe production key",
            "old": "Stripe test key"
          }
        },
        "removed": {}
      },
      "id": "aud_6968b3984275d71e90f7f09f",
      "ip_address": "203.0.113.42",
      "job_id": "job_6968b3985e8c9902207afaeb",
      "occurred_at": "2026-01-15T09:30:00Z",
      "origin": "dashboard",
      "reason": "Rotated to the production key",
      "request_id": "req_6968b3984d1c238d",
      "target_id": "cred_6968b39855d91a3561684b32",
      "target_parent_id": "agnt_6968b3984d1c238dbe7e2e29",
      "target_type": "credential",
      "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736",
      "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15"
    }
  ],
  "has_more": true,
  "next_cursor": "eyJ0IjogIjIwMjYtMDEtMTVUMDk6MzA6MDArMDA6MDAiLCAiaWQiOiAiM2YyYjhjMWUtN2Q0YS00ZTliLWE2YzUtMWQyZTNmNGE1YjZjIn0="
}

Changes

  • c516481e6ed8Revision changes
    • info

      the endpoint scheme security OAuth2 was added to the API

  • 1963116624b1Revision changes
    • info

      added the enum value oauth_app_registration to the property anyOf[subschema #1: AuditTargetType]/ of the query request parameter target_type