# audit

The organization's audit log. Each record states who acted, what was done, to which class of governed object, and how it ended.

**Amfelt REST API** · v1.13.0 · `https://api.amfelt.com`

---
### GET `/v1/audit-events` {#listauditevents}

**List audit events.**

Returns one page of the caller's organization's audit log, newest first: ordered by occurred_at and then id, both descending. Filters combine with AND; since is inclusive and until is exclusive. Page with the opaque cursor — pass back next_cursor to read the next page. A cursor marks a position in that ordering, so events recorded while a client is paging do not shift the pages that follow. The actor is returned as recorded: a kind and a bare identifier.

#### Parameters

| Name | In  | Required | Type | Description |
| ---- | --- | -------- | ---- | ----------- |
| `X-Tenant-Slug` | header | Yes | string | Slug of the organization to scope the request to; required for user-authenticated requests. |
| `since` | query | No | string | Only events at or after this instant (inclusive). |
| `until` | query | No | string | Only events before this instant (exclusive). |
| `actor_kind` | query | No | AuditActorKind | Only events by this kind of actor. |
| `actor_id` | query | No | string | Only events by the account or agent with this identifier. |
| `action` | query | No | AuditAction | Only events of this action. |
| `object_type` | query | No | AuditObjectType | Only events that addressed this class of governed object. |
| `object_id` | query | No | string | Only events that addressed the object with this identifier. |
| `outcome` | query | No | AuditOutcome | Only events with this outcome. |
| `cursor` | query | No | string | Opaque cursor for the next page; pass back the 'next_cursor' from a prior response. |
| `limit` | query | No | integer | Maximum number of items to return per page. |

#### Responses

**200** — A page of audit events.

`application/json`

| Property | Type | Required | Description |
|---|---|---|---|
| `data` | [AuditEvent](#audit-event)[] | Yes | The page of events, newest first. |
| `next_cursor` | [string null] | No | Opaque cursor for the next page, or null when this is the final page. |


**400** — The request was malformed or failed validation.

`application/json`

| Property | Type | Required | Description |
|---|---|---|---|
| `code` | string | Yes | Stable, snake_case token identifying the error condition. See ErrorCode for the api's canonical named vocabulary — this field is deliberately not restricted to it, since handlers may emit other ad-hoc codes not listed there (e.g. not_implemented). Examples: `invalid_argument`. |
| `field` | string | No | Optional hint identifying the request field the error refers to, in snake_case (e.g. "slug", "display_name", "token"). Set by handlers that validate multiple fields and want to enable field-targeted UX in clients. Absent when the error does not map to a single field. Examples: `slug`. |
| `message` | string | Yes | Human-readable description of the error. Examples: `limit must be between 1 and 100`. |


**401** — The request lacks valid credentials.

`application/json`

| Property | Type | Required | Description |
|---|---|---|---|
| `code` | string | Yes | Stable, snake_case token identifying the error condition. See ErrorCode for the api's canonical named vocabulary — this field is deliberately not restricted to it, since handlers may emit other ad-hoc codes not listed there (e.g. not_implemented). Examples: `invalid_argument`. |
| `field` | string | No | Optional hint identifying the request field the error refers to, in snake_case (e.g. "slug", "display_name", "token"). Set by handlers that validate multiple fields and want to enable field-targeted UX in clients. Absent when the error does not map to a single field. Examples: `slug`. |
| `message` | string | Yes | Human-readable description of the error. Examples: `limit must be between 1 and 100`. |


**403** — The caller is authenticated but not permitted to perform the request.

`application/json`

| Property | Type | Required | Description |
|---|---|---|---|
| `code` | string | Yes | Stable, snake_case token identifying the error condition. See ErrorCode for the api's canonical named vocabulary — this field is deliberately not restricted to it, since handlers may emit other ad-hoc codes not listed there (e.g. not_implemented). Examples: `invalid_argument`. |
| `field` | string | No | Optional hint identifying the request field the error refers to, in snake_case (e.g. "slug", "display_name", "token"). Set by handlers that validate multiple fields and want to enable field-targeted UX in clients. Absent when the error does not map to a single field. Examples: `slug`. |
| `message` | string | Yes | Human-readable description of the error. Examples: `limit must be between 1 and 100`. |


#### Security

bearer_jwt

---