---
title: "The account's audit log, newest first: members, keys, credit, network rules, secrets and deletions, with who, when and from where."
method: GET
path: "/v1/audit"
tags: ["audit"]
---

# The account's audit log, newest first: members, keys, credit, network rules, secrets and deletions, with who, when and from where.

`GET /v1/audit`

## Request

- Base URL: `https://api.withruntime.com`
- URL: `https://api.withruntime.com/v1/audit`
- Auth: HTTP bearer

Needs a key for every product or a read-only key, made by an owner or admin. Kept at least 400 days.

## Query parameters

- `before` string: A next from the previous page.
- `limit` integer: Page size, 1 to 200.
- `action` string: An action (key.created), or a group ending in a dot: member., invitation., key., connection., limit., credit., network., secret., preview., resource., account., sso., scim..

## Response `200`

Success

- object
  - `events` object[], required
    - `seq` string, required: Position in the log; page with before.
    - `id` string, required
    - `at` string, required: When, ISO 8601 UTC.
    - `action` string, required: What happened, like member.role_changed or key.created.
    - `actor` object, required
      - `kind` 'person' | 'agent' | 'app' | 'group' | 'runtime', required: runtime: Runtime itself, such as a payment or an expiry.
      - `id` string, nullable, required
      - `name` string, nullable, required
      - `person` string, nullable, required: For an agent: the member whose key it is.
    - `target` object, required
      - `type` string, nullable, required
      - `id` string, nullable, required
    - `detail` object, required: The facts that matter.
    - `ip` string, nullable, required: The client address the request came from.
    - `requestId` string, nullable, required
    - `via` 'web' | 'api' | 'mcp' | 'runtime', required
    - `sandbox` string, nullable, required: The sandbox the request came from, when code in it called the API at http://runtime.internal.
  - `next` string, nullable, required: Pass as before for the next, older page; null ends the log.

## Other responses

- `default`: Error

---

[API](https://skmtc.dev/withruntime/apis/runtime-cloud-api.md) · [All operations](https://skmtc.dev/withruntime/apis/runtime-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/withruntime/apis/runtime-cloud-api/revisions/6f4012286988?raw)