API reference/Ops: audit

List audit events, newest first

GET /ops/audit

Who did what to which resource, and whether it worked. Filters combine; paginate with cursor.

Authorization

bearer

Authorizationheader · stringrequired

Session token from POST /v1/auth/login with "transport": "bearer". Browsers use the session cookie that login sets instead.

Query

actor_kindstring

user, service, system or anonymous

maxLength: 32

actor_idstring

maxLength: 200

actionstring

Exact action

maxLength: 200

action_prefixstring

Actions starting with this

maxLength: 200

resource_typestring

maxLength: 100

resource_idstring

maxLength: 200

org_idstring

maxLength: 200

outcomestring

success, failure or denied

maxLength: 16

request_idstring

maxLength: 128

fromstring

Only events that occurred at or after this time (RFC 3339)

format: date-time

tostring

Only events that occurred before this time (RFC 3339)

format: date-time

limitinteger

format: int64default: 50minimum: 1maximum: 100

cursorstring

next_cursor from the previous page

maxLength: 30

Responses

errors: application/problem+json

200

400

Bad Request

401

Unauthorized

403

Forbidden

422

Unprocessable Entity

500

Internal Server Error

Match errors on the problem's code, which stays the same, not on its message.

req, err := http.NewRequestWithContext(ctx, http.MethodGet, apiURL + "/ops/audit", nil) if err != nil { return err } req.Header.Set("Authorization", "Bearer "+token) res, err := http.DefaultClient.Do(req) if err != nil { return err } defer res.Body.Close()

{ "events": [ { "action": "settings.value.changed", "actor_kind": "user", "id": 0, "metadata": {}, "occurred_at": "2026-09-15T12:00:00Z", "outcome": "success", "recorded_at": "2026-09-15T12:00:00Z", "actor_id": "usr_mfrggzdfmztwq2lk", "actor_label": "string", "ip": "string", "org_id": "string", "request_id": "string", "resource_id": "example.ping_message", "resource_type": "setting", "trace_id": "string", "user_agent": "string" } ], "next_cursor": "string" }

{ "code": "string", "status": 422, "title": "Unprocessable Entity", "detail": "string", "errors": [ { "message": "expected length >= 1", "location": "body.name" } ], "request_id": "req_9f86d081884c7d65", "type": "string" }