---
title: "List Audit"
method: GET
path: "/v1/audit"
tags: ["v1"]
---

# List Audit

`GET /v1/audit`

## Request

- Base URL: `https://api.korely.ai`
- URL: `https://api.korely.ai/v1/audit`
- Auth: HTTP bearer

The events this key's project produced, newest first.

Scoped to the caller's own account AND project by the key, like
everything else here; a key confined to some end users reads their
events only. Each row carries the project its call was made in. The
operator's screen (/admin/audit) reads the whole account.

## Query parameters

- `user_id` string, nullable: Only events touching this end user.
- `action` string, nullable
- `since` string, nullable: ISO date (2026-06-01, midnight) or datetime; no offset is UTC. Inclusive.
- `until` string, nullable: ISO date (2026-06-01, midnight) or datetime; no offset is UTC. Inclusive.
- `limit` integer
- `offset` integer

## Response `200`

Successful Response

- AuditPage
  - `events` AuditRow[], required
    - `ts` string, date-time, required
    - `actor` string, required: Who acted: `rest`, a key over REST, or an admin key on /admin; `mcp`, a key over MCP; `dashboard`, an operator signed in to the dashboard; `manage`, the command line (`manage`); `worker`, the background worker; `oauth`, an app connected over OAuth: its key made, renewed or revoked; `install`, a change to what is the whole install's, filed in every account's trail.
    - `action` string, required: read | write | fact_write | fact_invalidate | erase | key_create | key_revoke | key_change | tenant_create | setting_change | login | logout
    - `result` string, required: ok | denied | error
    - `user_id` string, nullable: The end user the event touched. After their erasure, a keyed pseudonym (`erased:...`): ask with their id and it is found.
    - `target_id` string, nullable: The memory or fact acted on, by public id.
    - `meta` object, nullable: Counts and labels, never content. A read says how many memories and facts it returned (memories_read, facts_read).
    - `ip` string, nullable
    - `read` AuditRead
      - `memories` string[]: Public ids of the memories the call returned, at most 100.
      - `facts` string[]: Public ids of the facts the call returned, at most 100.
  - `total` integer, required

## Other responses

- `401`: `invalid_key`: the `Authorization: Bearer` key is missing, unknown, revoked or expired.
- `403`: `forbidden`: the key lacks the scope this operation needs; `message` names it.
- `422`: `invalid_request`: the body, a query parameter or a path parameter is malformed (`detail` is the list of fields that failed, `message` names the first), or the endpoint refuses a value (an empty content, an unreadable timestamp; `detail` is a sentence or `{code, message}`).
- `429`: `rate_limit_exceeded`: past the request ceiling, the per-minute one set on this install (`RATE_LIMIT_PER_MINUTE`) or, on the hosted service, the plan's minute, hour or day; `message` names the window and `Retry-After` the seconds until it resets.
- `500`: `internal_error`: the server failed on this request; `message` holds no detail of it.
- `503`: A dependency did not answer: the database while the key was checked (`unavailable`, see `Retry-After`), or the one `code` names. Nothing was written; retry.

---

[API](https://skmtc.dev/korely/apis/korely-agents-api.md) · [All operations](https://skmtc.dev/korely/apis/korely-agents-api/llms.txt) · [OpenAPI document](https://skmtc.dev/korely/apis/korely-agents-api/revisions/8a40bf09eca1?raw)