---
title: "List the org's audit-log entries"
method: GET
path: "/audit_log"
tags: ["Audit log"]
---

# List the org's audit-log entries

`GET /audit_log`

## Request

- Base URL: `https://thesignup.app/api/v1`
- URL: `https://thesignup.app/api/v1/audit_log`
- Auth: HTTP bearer

Every mutating API call and dashboard action is recorded with credential attribution. Cursor-paginated, descending by `createdAt`. Tier-aware retention: Free tier sees the last 1 day, Pro 30 days, Org 90 days — entries outside that window are filtered at read time. The `audit-log-unlimited` PostHog feature flag overrides the floor per-org for white-glove customers. Requires the `audit_log:read` scope.

## Query parameters

- `action` string: Comma-separated `AuditAction` values. Unknown values fail closed with 400 to surface typos.
- `credential_method` string: Comma-separated `dashboard|api_key|oauth|system` values. Drives the 'agents vs humans' filter in the dashboard.
- `target_type` string: Comma-separated `AuditTargetType` values.
- `actor` string: Filter to actions performed by a single user id.
- `since` string, date-time: ISO-8601 inclusive lower bound. Tier retention is always applied as the floor; `since` can only narrow the window.
- `until` string, date-time: ISO-8601 inclusive upper bound.
- `cursor` string
- `limit` integer

## Response `200`

Audit-log entries for the caller's org

- ListAuditLogResponse
  - `data` AuditLogEntry[], required
    - `id` string, uuid, required
    - `action` 'signup.created' | 'signup.updated' | 'signup.published' | 'signup.canceled' | 'signup.duplicated' | 'participant.registered' | 'participant.canceled' | 'participant.updated' | 'participant.removed' | 'webhook.endpoint.created' | 'webhook.endpoint.updated' | 'webhook.endpoint.deleted' | 'webhook.endpoint.paused' | 'webhook.endpoint.resumed' | 'webhook.endpoint.rotated' | 'api_key.created' | 'api_key.rotated' | 'api_key.revoked' | 'member.invited' | 'member.invitation_revoked' | 'member.role_changed' | 'member.removed' | 'member.owner_transferred' | 'member.invitation_accepted' | 'signup.messaged' | 'member.access_revoked' | 'account.password_changed' | 'account.two_factor_enabled' | 'account.two_factor_disabled', required
    - `credentialMethod` 'dashboard' | 'api_key' | 'oauth' | 'system', required
    - `credentialId` string, nullable, required: API-key id or OAuth access-token id, depending on `credentialMethod`. `null` for dashboard actions.
    - `credentialLabel` string, nullable, required: Human-readable credential name at the time of the action (snapshot — rotating or revoking the credential does not alter past audit entries).
    - `userAgent` string, nullable, required
    - `actorUserId` string, nullable, required
    - `actorName` string, nullable, required
    - `actorEmail` string, email, nullable, required
    - `targetType` 'signup' | 'participant' | 'slot' | 'item' | 'webhook_endpoint' | 'api_key' | 'member' | 'oauth_client', required
    - `targetId` string, required
    - `targetLabel` string, nullable, required
    - `diff` object, nullable, required: Field-level before/after pairs. Present on update / publish / cancel; omitted on bare create / delete actions where the row itself is the diff.
    - `createdAt` string, date-time, required
  - `nextCursor` string, nullable, required: Opaque cursor for the next page; `null` when this is the last page. Pass back verbatim as `?cursor=`.

## Other responses

- `400`: Bad request — body or path could not be parsed
- `401`: Unauthenticated — credentials missing, malformed, invalid, or revoked
- `403`: Forbidden — credentials valid but lack the required scope
- `422`: Validation failed — request body / query / path is structurally wrong
- `429`: Rate limited or daily ceiling exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/thesignup/apis/thesignup-api.md) · [All operations](https://skmtc.dev/thesignup/apis/thesignup-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thesignup/apis/thesignup-api/revisions/c6da7cf92172?raw)