List audit logs

Query Parameters

• limit - Number of events to return (1-100, default 10)
• cursor - Cursor from a previous response for pagination
• action - Filter by action type (e.g. webhook.deleted, security.sso_enabled)
• domain - Filter by domain/category (e.g. security, messenger)
• startDate - Filter events created on or after this ISO 8601 datetime
• endDate - Filter events created on or before this ISO 8601 datetime

Filtering by Action

The action parameter filters by event type. Each action follows the {domain}.{verb} convention. See the action enum in this schema for the full list of supported values.

Examples:

• ?action=security.sso_enabled — only SSO enablement events
• ?action=webhook.deleted — only webhook deletion events

Filtering by Domain

Use the domain parameter to narrow results to one category of audit event.

Examples:

• ?domain=security — only security-related audit events
• ?domain=messenger — only messenger-related audit events

Filtering by Date Range

Use startDate and endDate together or individually to narrow results to a time window.

Examples:

• ?startDate=2025-01-01T00:00:00Z&endDate=2025-01-31T23:59:59Z — January 2025 only
• ?startDate=2025-06-01T00:00:00Z — from June 1st onward

Pagination

Results are ordered by createdAt descending (newest first). Use the nextCursor value from each response as the cursor parameter in the next request to paginate forward.

GET /v2/audit-logs?limit=20
→ { "nextCursor": "eyJ..." }

GET /v2/audit-logs?limit=20&cursor=eyJ...
→ { "nextCursor": null }   ← no more results

Metadata

The metadata field contains event-specific details (e.g. before/after state for updates). Its shape depends on the action type and is not strictly modeled in the schema — treat it as a free-form object.

Response Format

Returns a list object with:

• object - Always "list"
• data - Array of audit log objects
• nextCursor - Cursor for the next page, or null if no more results

Audit Log Object

Each audit log includes:

• id - Unique event identifier (UUID)
• correlationId - Groups related events from a single operation (e.g. bulk import)
• action - What happened (e.g. webhook.deleted)
• domain - Category the action belongs to (e.g. integrations)
• description - Human-readable description
• actor - Who performed the action (id, type, email, name, apiKey)
• resource - What was affected (type, id, name)
• request - Request context (ipAddress, userAgent)
• metadata - Event-specific payload
• createdAt - When the event occurred

Version Availability

This endpoint is only available in API version 2026-01-01.nova and newer.