---
title: "OAuth grant-lifecycle audit trail for an org"
method: GET
path: "/oauth/grants/audit"
tags: ["OAuth"]
---

# OAuth grant-lifecycle audit trail for an org

`GET /oauth/grants/audit`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/oauth/grants/audit`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-Mnemom-Api-Key`
  - API key in cookie `mnemom_session`

Lists the governance audit entries for the OAuth grant lifecycle (consent granted, consent denied, owner revocation) scoped to the owner's org, so revocation and consent are accountable. Caller must be an owner or admin of `org_id`. Carries no token material.

## Query parameters

- `org_id` string, required
- `limit` integer

## Response `200`

OAuth-lifecycle audit entries, newest first.

- object
  - `entries` object[]
    - `action` string
    - `actor_user_id` string, nullable
    - `actor_role` string, nullable
    - `target_type` string, nullable
    - `target_id` string, nullable
    - `created_at` string, date-time
    - `metadata` object, nullable
  - `org_id` string
  - `limit` integer

## Other responses

- `400`: Bad request
- `401`: Authentication required
- `403`: Forbidden
- `404`: Resource not found
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)