---
title: "Query the audit log."
method: GET
path: "/v1/compliance/audit"
tags: ["Compliance"]
---

# Query the audit log.

`GET /v1/compliance/audit`

## Request

- Base URL: `https://api.scalix.world`
- URL: `https://api.scalix.world/v1/compliance/audit`
- Auth: HTTP bearer

Returns audit events for the caller's tenant, filterable by action and time
range. The tenant scope is always taken from the token, never the query.

## Query parameters

- `action` string
- `from` string
- `to` string
- `limit` integer

## Response `200`

Audit events for the caller's tenant

- AuditEntry[]
  - `id` string, uuid, required
  - `timestamp` string, date-time, required
  - `tenant_id` string, required
  - `actor` string, required
  - `action` 'data_access' | 'data_modify' | 'data_delete' | 'auth_login' | 'auth_fail' | 'config_change' | 'api_key_create' | 'api_key_revoke' | 'api_key_rotate' | 'member_add' | 'member_remove' | 'compliance_export' | 'compliance_erasure', required
  - `resource` string, required
  - `details` string, nullable
  - `source_ip` string, required
  - `request_id` string, nullable
  - `entry_hash` string
  - `prev_hash` string

## Other responses

- `401`: Missing or invalid credentials
- `403`: Token lacks the compliance:read scope
- `500`: Internal error

---

[API](https://skmtc.dev/scalix/apis/scalix-cloud-api.md) · [All operations](https://skmtc.dev/scalix/apis/scalix-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scalix/apis/scalix-cloud-api/revisions/2c04ca0a90bb?raw)