---
title: "List audit log entries"
method: GET
path: "/v1/audit_log"
tags: ["Audit"]
---

# List audit log entries

`GET /v1/audit_log`

## Request

- Base URL: `https://api.yardstick.team`
- URL: `https://api.yardstick.team/v1/audit_log`
- Auth: HTTP bearer

List audit log entries

**Required scopes:** `audit_logs:read`

**Example (curl):**

```bash
curl 'https://api.yardstick.team/v1/audit_log?limit=20' \
  -H 'Authorization: Bearer ys_sk_live_…'
```

**Example (TypeScript):**

```ts
await fetch("https://api.yardstick.team/v1/audit_log?limit=20", {
  headers: { Authorization: `Bearer ${process.env.YS_API_KEY}` },
}).then((r) => r.json());
```

## Query parameters

- `limit` integer
- `starting_after` string

## Headers

- `X-Request-Id` string

## Response `200`

Success

- object: Cursor-paginated list envelope.
  - `object` 'list', required
  - `data` AuditLogEntry[], required
    - `id` string, required: Display id, e.g. `audit_<base32>`
    - `object` 'audit_log_entry', required
    - `created` string, required
    - `actor_token_id` string, nullable, required
    - `action` string, required
    - `resource_type` string, required
    - `resource_id` string, nullable, required
    - `resource_display_id` string, nullable, required: The public display id of the audited resource — the same id the caller holds, e.g. `can_<base32>`. Null when the resource type has no public id namespace; no prefix is invented for one.
    - `changes` object, required
    - `request_id` string, nullable, required: Correlation id for the request that produced this entry — the same value returned in that request's `X-Request-Id` response header. Null for entries written before the id was recorded.
    - `authenticated_actor` object, nullable: Verified immutable platform-runtime lineage derived from the consumed credential and ledger context. It never contains the credential secret.
      - `kind` 'platform_runtime', required
      - `principal_ref` string, required
      - `display_label` string, required
      - `principal_generation` integer, required
      - `credential_id` string, uuid, required
      - `organization_display_id` string, required: Public organization display id, e.g. `org_<base32>`
      - `execution_mode` 'live' | 'test' | 'mode_neutral', required
      - `livemode` boolean, nullable, required
      - `run_id` integer, required
      - `step_id` integer, required
      - `intent_id` integer, required
      - `idempotency_key` string, required
      - `operation_name` string, required
      - `department_read_mode` 'none' | 'explicit', required
      - `department_read_scope` string[], required
    - `authentication` object: Bounded runtime authentication evidence. A pre-auth row always has authenticated_actor=null and any claimed subject is explicitly unverified.
      - `state` 'pre_auth' | 'post_auth', required
      - `mechanism` 'runtime_credential', required
      - `reason_code` string, nullable, required
      - `claimed_subject` object, nullable, required
        - `principal_ref` string, required
        - `verified` false, required
    - `outcome` string, nullable
    - `reason` string, nullable
  - `has_more` boolean, required

## Other responses

- `400`: Invalid request
- `401`: Authentication failure
- `403`: Permission denied (scope or feature flag)
- `404`: Resource not found. The error uses the resource-specific code and param names the exact body field or path parameter that referenced it.
- `409`: Conflict (e.g. idempotency key reuse with different body)
- `429`: Rate limited
- `500`: Internal error

---

[API](https://skmtc.dev/yardstick/apis/yardstick-public-api.md) · [All operations](https://skmtc.dev/yardstick/apis/yardstick-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/yardstick/apis/yardstick-public-api/revisions/bef1d2eaaaa1?raw)