Get workspace audit logs
Returns audit-log entries across the workspace, newest first, covering models, chains, and workspace-level actions. Use the filters to narrow by event type, actor, resource, environment, source, or time window, and the cursor to page. In workspaces with multiple teams, only organization admins can read the workspace audit log.
Authorizations
Send Authorization: Bearer <api_key>. The legacy Authorization: Api-Key <api_key> scheme is also accepted.
Query Parameters
Opaque cursor returned by a previous page. Omit to fetch the first page.
Maximum number of entries to return per page. Defaults to 20, and must be between 1 and 200.
1 <= x <= 200Sort order by the time the action occurred. Defaults to DESC (newest first). Ignored when paginating with a cursor. Sort order of returned entries, by creation time.
DESC, ASC Case-insensitive substring matched against resource names and IDs in the entry.
When set, returns only entries whose event type falls in one of these groups.
Coarse grouping of event types, used to filter the audit log.
DEPLOYED, PROMOTED, ACTIVATED_DEACTIVATED, AUTOSCALING_SETTINGS, INSTANCE_TYPE_CHANGED, ENVIRONMENT_SETTINGS, REPLICA_TERMINATED, DELETED, SECRETS, API_KEYS, GATEWAY, WEBHOOK_SIGNING_SECRETS, USER_MANAGEMENT, DIRECTORY_GROUP_MANAGEMENT, SSH When set, returns only entries whose acting user is one of these IDs.
When set, returns only entries referencing one of these model deployment IDs.
When set, returns only entries referencing one of these chain deployment IDs.
When set, returns only entries for one of these environments.
When set, returns only entries issued from one of these surfaces.
Surface that issued the audited action.
UI, API, MCP, OTHER Epoch milliseconds for the start of the window. Defaults to the beginning of the audit-log history.
Epoch milliseconds for the end of the window. Defaults to the current time.