Sign in
Audit Logs

List Account audit logs

Returns complete retained project.message_sent events for the Account associated with the presented API key. The Account is determined by the key and cannot be specified in the request.

The first request must provide an occurredAfter and occurredBefore window over occurredAt no longer than 24 hours. The optional messageRef parameter returns only events with an exact match for the opaque messageRef value. Do not parse or transform this value. Continuation cursors expire after one hour. If window, limit, or messageRef parameters accompany a cursor, they must match the original request.

Events are ordered by occurredAt and eventId ascending. Each response contains only complete events and is limited to 8 MiB of uncompressed UTF-8 JSON. If one event exceeds that limit, the request returns 422 audit_log_content_too_large instead of truncating its content.

Events can become available after their occurredAt. The returned observedAt records when Replit received the event, can be later than occurredAt, and is not used to filter this operation. This API does not provide a completion watermark or a guaranteed bound on late arrivals. Polling with overlapping windows reduces the risk of missing late events but cannot guarantee completeness. Deduplicate events by eventId.

Example request:

GET /v1/audit-logs?occurredAfter=2026-08-04T00%3A00%3A00Z&occurredBefore=2026-08-05T00%3A00%3A00Z&messageRef=message123&limit=25

An invalid cursor returns 400 invalid_cursor:

{
  "error": {
    "code": "invalid_cursor",
    "message": "Audit log cursor is invalid for this request.",
    "details": null
  }
}

An event that cannot fit in a complete response returns 422 audit_log_content_too_large:

{
  "error": {
    "code": "audit_log_content_too_large",
    "message": "One audit log event exceeds the response size limit.",
    "details": null
  }
}
get/audit-logs

Query parameters

occurredAfterstring date-time
Example:2026-08-04T00:00:00Z

Inclusive UTC RFC 3339 lower bound on returned events' occurredAt, with at most six fractional digits. Required without a cursor.

occurredBeforestring date-time
Example:2026-08-05T00:00:00Z

Exclusive UTC RFC 3339 upper bound on returned events' occurredAt, with at most six fractional digits. Required without a cursor and no more than 24 hours after occurredAfter.

limitinteger
Example:25

Maximum complete events to return. Defaults to 25.

messageRefstring
Example:message123

Optional opaque message identifier for an exact match. Do not parse or transform this value.

cursorstring
Example:opaque-continuation-cursor

Opaque continuation cursor from the previous response.

Response

Audit log event list.

Example response

{
  "data": [
    {
      "eventId": "8a4be785-24a8-5f65-b544-a5e5b6b4fb26",
      "observedAt": "2026-08-04T10:00:02Z",
      "occurredAt": "2026-08-04T10:00:00Z",
      "schemaVersion": 1,
      "workspace": {
        "id": "workspace123"
      },
      "project": {
        "id": "project123"
      },
      "sessionId": "session123",
      "messageRef": "message123",
      "promptText": "Summarize the deployment changes in this project."
    }
  ]
}

Changes