Pagination

How list endpoints page through results.

Every list endpoint is cursor-paginated. There is no offset pagination anywhere on this surface: the audit log changes while you read it, and offset pages in a shifting list silently skip records — which is exactly the record someone is looking for.

GET /usage is a report rather than a list, and the two exports (/usage/export, /audit/export) stream in one response; none of them takes limit or cursor.

Parameters

Parameter	Type	Default	Notes
`limit`	integer	`50`	1–200. Outside that range, or not an integer → `400 invalid_request`, `param: "limit"`.
`cursor`	string	—	The `next_cursor` from the previous page. Opaque: do not parse or construct it. An invalid cursor → `400 invalid_request`, `param: "cursor"`.

Response shape

{
  "data": [
    { "id": "5b3e9a41-0c7d-4e2f-8a16-9d4b7c2e1f08", "name": "payments", "created_at": "2026-09-20T08:14:03Z" },
    { "id": "a17c2f90-6e4b-4d1a-b3c5-0f8e2d9a7b61", "name": "search", "created_at": "2026-09-18T16:02:47Z" }
  ],
  "has_more": true,
  "next_cursor": "MjAyNi0wOS0xOFQxNjowMjo0N1p8YTE3YzJmOTA"
}

Field	Notes
`data`	The page of objects.
`has_more`	`true` if another page exists.
`next_cursor`	Pass as `cursor` to get the next page; `null` on the last page.

Results are ordered newest first (created_at descending, ties broken by id descending), so a new object never shifts a page you have already read. The catalog has no creation time, so /catalog/models and /catalog/regions are ordered by id descending instead.

Iterating through a list

curl -G https://portal.<domain>/api/v1/mgmt/audit \
  -H "Authorization: Bearer $TF_PAT" \
  -d limit=200 \
  -d cursor=MjAyNi0wOS0xOFQxNjowMjo0N1p8YTE3YzJmOTA

import os
import requests

def list_all(path, **params):
    headers = {"Authorization": f"Bearer {os.environ['TF_PAT']}"}
    params = {"limit": 200, **params}
    while True:
        resp = requests.get(f"https://portal.<domain>/api/v1/mgmt{path}", headers=headers, params=params, timeout=30)
        resp.raise_for_status()
        page = resp.json()
        yield from page["data"]
        if not page["has_more"]:
            return
        params["cursor"] = page["next_cursor"]

for entry in list_all("/audit", action="key_create"):
    print(entry["created_at"], entry["actor"]["email"], entry["resource_id"])

Filtering

Filters are per collection and listed on each resource page (for example actor, action, from and to on the audit log).

A query parameter that an endpoint does not support is rejected with 422 unsupported_filter, never silently ignored. Ignoring a filter would answer a different question than the one you asked, which on a usage query becomes a wrong number in someone's report.

{
  "error": {
    "message": "unsupported query parameter region for this collection",
    "type": "validation_error",
    "code": "unsupported_filter",
    "param": "region",
    "request_id": "req_44e85412d33443378ea22ffc821820e4"
  }
}

A supported filter with a value outside its set — status=archived on /projects, say — is 422 validation_failed, with param naming the filter.