Audit API
Query and export organization or workspace activity (audit) logs.
Activity Log in the portal reads these endpoints. Events cover membership changes, secret reveals, auth changes, and other control-plane actions.
See also: Activity Log
Organization audit
GET /v1/accounts/{account_id}/audit?limit=50&offset=0Pass the organization's ID as account_id; organizations used to be called accounts.
| Query parameter | Default | Description |
|---|---|---|
limit | 50 | Events per page, 1 to 200 |
offset | 0 | Events to skip |
from, to | none | ISO-8601 time range |
q | none | Text filter, up to 128 characters |
include_workspaces | false | Also return events from the organization's workspaces (app creation, provisioning, and so on). Skipped for a Billing admin, who has no workspace access |
Permission: read on organization
Workspace audit
GET /v1/workspaces/{workspace_id}/audit?limit=50&offset=0Takes the same limit, offset, from, to and q parameters as the organization route, without include_workspaces.
Permission: read on workspace
Response
Both routes return events newest first:
{
"events": [
{
"id": "…",
"scope_type": "workspace",
"scope_id": "…",
"actor_user_id": "…",
"action": "workspace_user.added",
"target_type": "workspace_user",
"target_id": "…",
"details": { "actor_display_name": "Ada Lovelace", "actor_email": "ada@example.com" },
"occurred_at": "2026-01-01T12:00:00Z"
}
],
"total_count": 120,
"has_more": true
}total_count is the number of matching events across all pages. has_more is true when offset plus the events returned is less than total_count. When the actor is a known user, details includes their actor_display_name and actor_email.
Secret-like values are removed from details when you read or export events: keys such as passwords, secrets, tokens, credentials, API keys and key hashes are left out with their values. The q filter doesn't search them either.
Audit events are kept for a retention period set per cell (30 days by default), then deleted.
Export
POST /v1/audit/export| Field | Required | Description |
|---|---|---|
scope_type | Yes | account (organization) or workspace |
scope_id | Yes | The organization or workspace ID |
format | No | csv (default) or json |
from_dt, to_dt | No | ISO-8601 time range |
q | No | Text filter, up to 128 characters |
Returns the file in the response body as an attachment (audit_<scope_type>_<scope_id>_<timestamp>.csv or .json). An export contains at most the 10,000 most recent matching events and has no paging; narrow the range with from_dt and to_dt for more. It does not include workspace events when exporting an organization. The upload field some older clients send is accepted and ignored.
Permission: read on the requested scope.
Related
- Process Log API — runtime logs, not audit
- Workspace auth API — auth config changes appear in audit