---
title: "Search the platform-scope (tenantless) audit trail"
method: GET
path: "/v1/admin/platform-audit-logs"
tags: ["admin"]
---

# Search the platform-scope (tenantless) audit trail

`GET /v1/admin/platform-audit-logs`

## Request

- Base URL: `https://api.patricia.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.patricia.app/v1/admin/platform-audit-logs`
- Auth: HTTP bearer

Staff actions that no single team owns: platform-admin grants, service-key mint and revoke, skill-catalog publishing, and the audited email test send. Narrow it with the typed filters below, which are the ONLY query surface; the free-form change and metadata bags are readable in a row but can never be sorted or filtered on. Every search records its own read-audit row. Internal admin users only.

## Query parameters

- `action` string, nullable: Exact action name.
- `principal_id` string, uuid, nullable: Who acted.
- `principal_type` string, nullable: user | service_key
- `tenant_id` string, uuid, nullable: The team the action targeted.
- `resource_type` string, nullable: e.g. user, skill, tenant.
- `created_after` string, date-time, nullable: Inclusive lower bound.
- `created_before` string, date-time, nullable: Inclusive upper bound.
- `limit` integer
- `offset` integer

## Response `200`

Successful Response

- PlatformAuditPageResponse: One page of the trail, plus the id of the read-audit row this request itself produced.
  - `items` PlatformAuditEntry[], required
    - `id` string, required
    - `created_at` string, date-time, required
    - `action` string, required
    - `principal_type` string, required: Which id space the principal lives in: "user" | "service_key".
    - `principal_id` string, nullable, required
    - `tenant_id` string, nullable: The team the action targeted, when it had one.
    - `resource_type` string, nullable
    - `resource_id` string, nullable
    - `result` string, required
    - `changes` object, nullable
    - `metadata` object
    - `request_id` string, nullable
  - `total` integer, required
  - `limit` integer, required
  - `offset` integer, required
  - `read_audit_id` string, required: The platform_read_audit_logs row recording THIS read. Looking at the trail is audited too.

## Other responses

- `401`: Unauthorized
- `403`: Permission denied (PERMISSION_DENIED) or email not verified (EMAIL_NOT_VERIFIED)
- `422`: Validation error

---

[API](https://skmtc.dev/patricia/apis/patricia-api.md) · [All operations](https://skmtc.dev/patricia/apis/patricia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/patricia/apis/patricia-api/revisions/0dfb44495ea1?raw)