Lists the actions in the organisation, the newest first. By default you get the 100 most recent entries.
HTTP
GET /org/auditAccess: Session token only. API keys get 403 with insufficient_scope.
Role: Organisation owner or admin.
Query parameters #
All are optional.
| Parameter | Type | Description |
|---|---|---|
action | string | Only entries with this action code, for example project.deleted. End it with a dot to match a whole group, for example auth.. |
user | string | Only entries by this user id. |
from | string | Only entries at or after this time. A date (2026-10-01) or an ISO 8601 timestamp. Without a time zone it is UTC. |
to | string | Only entries at or before this time. A bare date includes the whole day. |
limit | integer | The number of entries, from 1 to 500. Default 100. |
before | string | The id of the last entry of the previous page. Returns the entries older than it. |
To read all entries, request a page, then repeat with before set to the id of the last entry until a page comes back with fewer entries than limit. To get everything in one go, use the export.
Response 200 #
A list of entries.
JSON
[
{
"id": "0197a3c4-2b31-7e22-b5d9-7f1c3a8e0b42",
"person": { "id": "0197a3c2-5b1e-7c4a-9d2f-3e8b6a1f0c55", "name": "Ada Lovelace", "email": "ada@example.com", "initials": "AL", "gradient": "...", "from": "#06b6d4", "to": "#7c3aed" },
"action": "org.member_invited",
"verb": "invited ",
"subject": "grace@example.com",
"suffix": " as Member",
"ip": "203.0.113.7",
"userAgent": "Mozilla/5.0 (X11; Linux x86_64) ...",
"at": "2026-10-16T09:30:00+00:00"
}
]Response fields #
| Field | Type | Description |
|---|---|---|
id | string | The id of the entry. Ids sort by time. |
person | object or null | Who did it, with the same fields as a member without role, teams, joinedAt and you. null when the user no longer exists. |
action | string | A stable code for what happened, see action codes. Empty for entries written before codes existed. |
verb | string | The start of the sentence. |
subject | string | The thing it was done to. |
suffix | string | The end of the sentence. |
ip | string or null | The address of the client that made the request. Behind a reverse proxy it is read from X-Forwarded-For, but only the part added by a trusted proxy. null for entries written before addresses were recorded. |
userAgent | string or null | The User-Agent of the request, cut to 300 characters. null for older entries. |
at | string | When it happened. |
Action codes #
| Code | When |
|---|---|
auth.login | Someone signed in. |
auth.sso_login | Someone signed in with single sign-on. |
auth.login_failed | Someone tried to sign in to an account with the wrong password. |
auth.password_changed | Someone changed their password. |
auth.password_reset | Someone reset their password with the emailed link. |
auth.session_revoked | Someone signed out one of their sessions. |
auth.mfa_enabled | Someone turned on two-factor authentication. |
auth.mfa_disabled | Someone turned off two-factor authentication. |
auth.mfa_failed | Someone gave a wrong two-factor code when signing in. |
auth.recovery_code_used | Someone signed in with a recovery code. |
auth.recovery_codes_regenerated | Someone made new recovery codes. |
account.deleted | Someone deleted their account. |
account.exported | Someone downloaded a copy of their personal data. |
api_key.created | An API key was created, personal or for a project. |
api_key.rotated | An API key was rotated. |
api_key.revoked | An API key was revoked. |
org.created | The organisation was created. |
org.member_invited | Someone was invited. |
org.invite_revoked | An invitation was revoked. |
org.member_joined | Someone joined through an invitation. |
org.member_role_changed | A member’s organisation role changed. |
org.member_removed | A member was removed. |
org.member_mfa_reset | An admin reset the two-factor authentication of a member. |
org.ownership_transferred | Ownership was transferred. |
org.settings_changed | The name or settings of the organisation changed. |
org.security_changed | The security settings changed. |
org.sso_changed | The single sign-on settings changed. |
org.sso_domain_verified | A domain was verified for single sign-on. |
org.sso_domain_removed | A domain was removed from single sign-on. |
org.data_region_changed | The preferred data region was chosen, changed or removed. |
org.mt_key_set | A machine translation key was added or replaced. The log never contains the key. |
org.mt_key_removed | The machine translation key was removed. |
org.mt_limit_changed | The monthly machine translation limit changed. |
chat.connected | A Slack, Mattermost or Teams channel was connected. The log never contains the webhook address. |
chat.updated | A chat channel was changed. |
chat.removed | A chat channel was removed. |
mt.autofill | New strings were queued for automatic machine translation after a push. |
mt.autofill_stopped | Automatic machine translation stopped, with the reason in the subject, such as mt_key_rejected, mt_limit_reached, mt_provider_quota or mt_not_configured. Recorded at most once an hour for the same reason. |
org.scim_token_created | A SCIM token was created. |
org.scim_token_revoked | The SCIM token was revoked. |
scim.user_provisioned | The identity provider added a member over SCIM. |
scim.user_updated | The identity provider changed a member over SCIM. |
scim.user_deprovisioned | The identity provider removed a member over SCIM. |
project.created | A project was created, also from a repository. |
project.deleted | A project was deleted. |
project.duplicated | A project was duplicated. |
project.archived | A project was archived. |
project.restored | A project was restored. |
project.repository_linked | A project was linked to a repository. |
team.created | A team was created. |
team.deleted | A team was deleted. |
integration.connected | GitHub or GitLab was connected. |
integration.disconnected | GitHub or GitLab was disconnected. |
webhook.created | A webhook was added to a project. |
webhook.deleted | A webhook was removed. |
billing.plan_changed | The plan was switched. |
billing.plan_chosen | The plan was chosen for the first time. |
audit.exported | The audit log was exported. |
Errors #
| Status | error | When |
|---|---|---|
| 401 | unauthenticated | The token is missing or not valid. |
| 403 | forbidden | You are not an owner or admin. |
| 422 | invalid_request | A query parameter is not valid. fields names it. |
| 429 | rate_limited | Too many requests, see Rate limiting. |
See Errors for the error format.
Notes #
Read an entry as person + verb + subject + suffix. Use action when you need to act on an entry in code, because the sentence can change.