Audit log

The organization's audit log: who did what, when, from where, on what — and, for actions taken through this API, with which token. It is the same log the portal shows, and it is append-only: no endpoint edits or deletes an entry.

Both routes need an owner who is currently an organization Admin; a Member's token gets 403 insufficient_scope. An organization sees its own log and nothing else.

What is recorded

Which action each call records

The action names are the portal's, so some differ from the API verbs:

A project's guardrails, and a key's allowed_models, rpm_limit, expires_at and description, are not yet recorded as separate entries when they change.

Ordinary reads are not individually audited — an Admin reading their own organization's data is not a privacy event. Exports are the exception, because an export is what a leak looks like when it is one.

The audit entry

Which token acted. An entry written by a call made with a personal access token carries the token in metadata, next to the action's own detail:

Portal actions have none of these keys.

{
  "id": "0b1c2d3e-4f5a-4b6c-8d7e-9f0a1b2c3d4e",
  "created_at": "2026-09-24T10:05:31Z",
  "actor": { "user_id": "8e7d6c5b-4a39-4281-9f0e-1d2c3b4a5968", "email": "[email protected]" },
  "action": "key_rotate",
  "resource_type": "api_key",
  "resource_id": "c41d8e2a-7b90-4f3c-a6e5-2d1f0b9c8a74",
  "metadata": {
    "grace_expires_at": "2026-09-24T12:05:31Z",
    "credential": "pat",
    "pat_id": "d9e8f7a6-b5c4-4d3e-9f2a-1b0c9d8e7f6a",
    "pat_name": "CI · payments-deploy",
    "scope": "keys:write"
  },
  "ip_address": "203.0.113.24"
}

List audit entries

GET /api/v1/mgmt/audit

Newest first, cursor-paginated.

Any other parameter returns 422 unsupported_filter; a malformed actor, from or to is 400 invalid_request with param naming it.

curl -G https://portal.<domain>/api/v1/mgmt/audit \
  -H "Authorization: Bearer $TF_PAT" \
  -d [email protected] \
  -d from=2026-09-23T00:00:00Z \
  -d limit=200

import os
import requests

params = {"actor": "[email protected]", "from": "2026-09-23T00:00:00Z", "limit": 200}
headers = {"Authorization": f"Bearer {os.environ['TF_PAT']}"}
while True:
    page = requests.get("https://portal.<domain>/api/v1/mgmt/audit", headers=headers, params=params, timeout=30).json()
    for e in page["data"]:
        via = e["metadata"].get("pat_name", "portal")
        print(e["created_at"], e["action"], e["resource_id"], via)
    if not page["has_more"]:
        break
    params["cursor"] = page["next_cursor"]

Export the audit log

GET /api/v1/mgmt/audit/export

Streams every matching entry, newest first, in one response — for SIEM ingestion or an evidence request.

The CSV columns are id, created_at, actor_user_id, actor_email, action, resource_type, resource_id, ip_address and metadata (the metadata object as JSON).

At most 10,000 entries per call. A filter that matches more is refused with 422 export_too_large before anything streams — narrow from/to and export in windows, or page through GET /audit. Every completed export is itself recorded as audit_export with the row_count.

curl -G https://portal.<domain>/api/v1/mgmt/audit/export \
  -H "Authorization: Bearer $TF_PAT" \
  -d format=jsonl \
  -d from=2026-09-01T00:00:00Z \
  -d to=2026-10-01T00:00:00Z \
  -o audit-2026-09.jsonl

with requests.get(
    "https://portal.<domain>/api/v1/mgmt/audit/export",
    headers=headers,
    params={"format": "jsonl", "from": "2026-09-01T00:00:00Z", "to": "2026-10-01T00:00:00Z"},
    stream=True,
    timeout=90,
) as resp, open("audit-2026-09.jsonl", "wb") as out:
    resp.raise_for_status()
    for chunk in resp.iter_content(chunk_size=65536):
        out.write(chunk)

Errors specific to the audit log