SHshorebird
organizations

Read an organization's audit log.

Who did what in the organization, as OCSF 1.9.0 API Activity events (class 6003), so a SIEM can ingest it without a Shorebird-specific pipeline.

The log always pages. Newest first (the default), next_cursor is present while older entries remain. Oldest first (order=asc), next_cursor is always present, so a poller can resume from where it stopped: entries younger than 60 seconds are held back until they settle, and a page with no entries echoes the cursor it was sent.

Requires the plan's audit-log feature (shorebird_plan_insufficient_tier otherwise) and the auditLogs.view permission, which the admin, owner and auditor roles hold.

get/organizations/{organizationId}/audit-logs

Request

  • Base URL
    https://api.shorebird.dev/api/v1
  • Auth
    • HTTP bearer
    • or HTTP bearer

Query parameters

per_pageinteger

The number of items per page. Sending per_page (or cursor) opts in to pagination: the response holds one page and, unless it is the last, a next_cursor body field. Without either, the full list is returned with no next_cursor. Values above 100 are treated as 100; values that are not a positive integer are treated as 30.

cursorstring

The next_cursor of the previous page, which this page starts after. Send it with the same other query parameters as the previous request. It is opaque: do not build or parse it. An unreadable cursor is a 400.

order'desc' | 'asc'

The order audit log entries are listed in.

The order entries are listed in. Defaults to desc.

startDatestring date-time

Only entries at or after this time (ISO 8601, inclusive).

endDatestring date-time

Only entries at or before this time (ISO 8601, inclusive).

appIdstring

Only entries about this app.

actorIdinteger

Only entries this user or service account caused. Never matches an entry Shorebird staff caused.

operationstring

Only entries of this event, named as in an entry's api.operation (for example organization.rename). A name that is not an audit event is a 400.

Response

One page of audit log entries.

next_cursorstring

The opaque cursor of the next page; send it back as cursor to get that page. Newest first, absent on the last page. Oldest first, always present: the last entry's position, or the cursor that was sent when the page is empty.

Changes

No recorded changes to this operation across all 1 revision of this API.