List audit log entries

Query Parameters

Results are paged. When has_more is true, pass next_cursor from the response as cursor to fetch the next page.

• limitinteger

  Default 25. Maximum 100. Minimum 1.

• cursorstring
• actionstring

  One action, or a group prefix with a trailing dot (team., api_key.) Example: api_key.created.

• actorstring

  Actor id (exact) or part of the actor email (case-insensitive) Example: dev@example.com.

• target_typestring

  Target type, e.g. api_key, member, invite, webhook, number, phone Example: webhook.

• created_afterstring (date-time)

  Entries at or after this time (ISO 8601) Example: 2026-09-01T00:00:00Z.

• created_beforestring (date-time)

  Entries at or before this time (ISO 8601); a bare date means the end of that day (UTC) Example: 2026-09-30T23:59:59Z.

Details

Filters apply before paging. One request scans at most 5,000 entries, so a rarely matching filter can return a short or empty page with has_more true: follow next_cursor until has_more is false.

Scope: audit_logs:read.

Responses

• 200Page of AuditLog

  Audit log entries, newest first

• 400Error

  Invalid filter

• 401Error

  Missing, malformed, or revoked API key

• 402Error

  Billable live calls only: the prepaid credit balance cannot cover the call (insufficient_credits); nothing was done or charged

• 429Error

  Rate limit or quota exceeded

Response Fields

The body is a page: data (the array), has_more, and next_cursor (null on the last page). Each item in data:

• idstring

  Example: aud_a1B2c3D4e5F6g7H8.

• objectaudit_log
• actionapi_key.created, api_key.revoked, api_key.rolled, cli_login.approved, cli_login.denied, team.invite_created, team.invite_accepted, team.invite_revoked, team.member_left, team.member_removed, team.role_changed, webhook.created, webhook.updated, webhook.deleted, webhook.secret_rotated, webhook.secret_viewed, spend_limit.updated, credits.topped_up, credits.settings_updated, number.purchased, number.released, number.assigned, number.attached, number.toll_free_updated, number.registration_set, number.sender_linked, number.sender_unlinked, registration.approved, registration.approval_undone, business.attested, business.verified, business.rejected, registration.marketing_paused, registration.marketing_resumed, opt_in_page.enabled, opt_in_page.disabled, live_access.approved, live_access.denied, consent.updated, consent.imported, migration.opt_outs_attested, quiet_hours.updated, reconfirmation.updated, settings.updated, contacts.imported, contact.topic_updated, segment.created, segment.updated, segment.deleted, topic.created, topic.updated, topic.deleted, automation.created, automation.updated, automation.activated, automation.paused, automation.deleted, automation.identity_unlinked, privacy.phone_erased, privacy.email_erased, message.deleted, message.redacted, schedule.created, schedule.updated, schedule.paused, schedule.resumed, schedule.deleted, account.closed, account.reopened, link_domain.created, link_domain.deleted, link_domain.activated, link_domain.deactivated
• actorobject
• actor.typeuser, api_key, system
• actor.idstring
• actor.emailstring
• actor.namestring
• actor.modetest, live

  API keys: which mode of key acted.

• targetobject
• target.typestring
• target.idstring
• metadataobject
• ipstring
• created_atstring (date-time)

Errors

Every error has the same JSON shape, and request_id matches the X-Request-Id response header. Errors lists every code and what to do about it.

• 400

  Invalid filter

• 401

  Missing, malformed, or revoked API key

• 402

  Billable live calls only: the prepaid credit balance cannot cover the call (insufficient_credits); nothing was done or charged

• 429

  Rate limit or quota exceeded