# List audit log entries Source: https://jointextkit.com/docs/api/audit-logs/list Index: https://jointextkit.com/llms.txt `GET /v1/audit-logs` Account changes (keys, team, webhooks, spend limit, numbers, consent, settings) with actor and IP, newest first. Filters apply before paging. One request scans at most 5,000 entries, so a rarely matching filter can return a short or empty page with has_more true: follow next_cursor until has_more is false. Scope: audit_logs:read. Send your API key as a bearer token: `Authorization: Bearer ssms_sk_...`. Test keys run this endpoint against the [sandbox](/docs/sandbox); see [Authentication](/docs/authentication) for key modes and scopes. ## Query parameters | Name | Type | Required | Description | | --- | --- | --- | --- | | `limit` | integer | No | Default 25. Maximum 100. Minimum 1. | | `cursor` | string | No | | | `action` | string | No | One action, or a group prefix with a trailing dot (team., api_key.) Example: `api_key.created`. | | `actor` | string | No | Actor id (exact) or part of the actor email (case-insensitive) Example: `dev@example.com`. | | `target_type` | string | No | Target type, e.g. api_key, member, invite, webhook, number, phone Example: `webhook`. | | `created_after` | string (date-time) | No | Entries at or after this time (ISO 8601) Example: `2026-09-01T00:00:00Z`. | | `created_before` | string (date-time) | No | Entries at or before this time (ISO 8601); a bare date means the end of that day (UTC) Example: `2026-09-30T23:59:59Z`. | Results are paged. When `has_more` is true, pass `next_cursor` from the response as `cursor` to fetch the next page. ## Responses | Status | Meaning | Body | | --- | --- | --- | | 200 | Audit log entries, newest first | Page of `AuditLog` | | 400 | Invalid filter | `Error` | | 401 | Missing, malformed, or revoked API key | `Error` | | 402 | Billable live calls only: the prepaid credit balance cannot cover the call (insufficient_credits); nothing was done or charged | `Error` | | 429 | Rate limit or quota exceeded | `Error` | ### 200: each item in `data` (AuditLog) The body is a page: `data` (the array), `has_more`, and `next_cursor` (null on the last page). | Field | Type | Description | | --- | --- | --- | | `id` | string | Example: `aud_a1B2c3D4e5F6g7H8`. | | `object` | `audit_log` | | | `action` | `api_key.created`, `api_key.revoked`, `api_key.rolled`, `cli_login.approved`, `cli_login.denied`, `team.invite_created`, `team.invite_accepted`, `team.invite_revoked`, `team.member_left`, `team.member_removed`, `team.role_changed`, `webhook.created`, `webhook.updated`, `webhook.deleted`, `webhook.secret_rotated`, `webhook.secret_viewed`, `spend_limit.updated`, `credits.topped_up`, `credits.settings_updated`, `number.purchased`, `number.released`, `number.assigned`, `number.attached`, `number.toll_free_updated`, `number.registration_set`, `number.sender_linked`, `number.sender_unlinked`, `registration.approved`, `registration.approval_undone`, `business.attested`, `business.verified`, `business.rejected`, `registration.marketing_paused`, `registration.marketing_resumed`, `opt_in_page.enabled`, `opt_in_page.disabled`, `live_access.approved`, `live_access.denied`, `consent.updated`, `consent.imported`, `migration.opt_outs_attested`, `quiet_hours.updated`, `reconfirmation.updated`, `settings.updated`, `contacts.imported`, `contact.topic_updated`, `segment.created`, `segment.updated`, `segment.deleted`, `topic.created`, `topic.updated`, `topic.deleted`, `automation.created`, `automation.updated`, `automation.activated`, `automation.paused`, `automation.deleted`, `automation.identity_unlinked`, `privacy.phone_erased`, `privacy.email_erased`, `message.deleted`, `message.redacted`, `schedule.created`, `schedule.updated`, `schedule.paused`, `schedule.resumed`, `schedule.deleted`, `account.closed`, `account.reopened`, `link_domain.created`, `link_domain.deleted`, `link_domain.activated`, `link_domain.deactivated` | | | `actor` | object | | | `actor.type` | `user`, `api_key`, `system` | | | `actor.id` | string | | | `actor.email` | string | | | `actor.name` | string | | | `actor.mode` | `test`, `live` | API keys: which mode of key acted. | | `target` | object | | | `target.type` | string | | | `target.id` | string | | | `metadata` | object | | | `ip` | string | | | `created_at` | string (date-time) | | ## Errors | Status | When | | --- | --- | | 400 | Invalid filter | | 401 | Missing, malformed, or revoked API key | | 402 | Billable live calls only: the prepaid credit balance cannot cover the call (insufficient_credits); nothing was done or charged | | 429 | Rate limit or quota exceeded | Every error has the same JSON shape, and `request_id` matches the `X-Request-Id` response header. [Errors](/docs/errors) lists every code and what to do about it. ```json { "error": { "code": "invalid_request", "message": "What went wrong, in plain words.", "param": "the_field", "request_id": "req_a1B2c3D4e5F6g7H8" } } ``` ## Examples ### Node.js The Node.js SDK does not wrap this endpoint yet; call it over HTTP. ```javascript const res = await fetch('https://api.jointextkit.com/v1/audit-logs?limit=10', { method: 'GET', headers: { Authorization: `Bearer ${process.env.TEXTKIT_API_KEY}`, }, }); if (!res.ok) throw new Error((await res.json()).error.message); const data = await res.json(); ``` ### PHP ```php 'GET', CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => [ 'Authorization: Bearer ' . getenv('TEXTKIT_API_KEY'), ], ]); $data = json_decode(curl_exec($ch), true); ``` ### Python The Python SDK does not wrap this endpoint yet; call it over HTTP. ```python import json, os, urllib.request req = urllib.request.Request( "https://api.jointextkit.com/v1/audit-logs?limit=10", method="GET", headers={ "Authorization": f"Bearer {os.environ['TEXTKIT_API_KEY']}", }, ) with urllib.request.urlopen(req) as res: data = json.load(res) ``` ### Ruby ```ruby require "net/http" require "json" uri = URI("https://api.jointextkit.com/v1/audit-logs?limit=10") req = Net::HTTP::Get.new(uri) req["Authorization"] = "Bearer #{ENV["TEXTKIT_API_KEY"]}" res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |http| http.request(req) } data = JSON.parse(res.body) ``` ### Go ```go package main import ( "fmt" "io" "net/http" "os" ) func main() { req, _ := http.NewRequest("GET", "https://api.jointextkit.com/v1/audit-logs?limit=10", nil) req.Header.Set("Authorization", "Bearer "+os.Getenv("TEXTKIT_API_KEY")) res, err := http.DefaultClient.Do(req) if err != nil { panic(err) } defer res.Body.Close() data, _ := io.ReadAll(res.Body) fmt.Println(res.Status, string(data)) } ``` ### Rust ```rust // cargo add reqwest --features blocking,json // cargo add serde_json fn main() -> Result<(), Box> { let key = std::env::var("TEXTKIT_API_KEY")?; let res = reqwest::blocking::Client::new() .get("https://api.jointextkit.com/v1/audit-logs?limit=10") .bearer_auth(key) .send()? .error_for_status()?; let data: serde_json::Value = res.json()?; println!("{data}"); Ok(()) } ``` ### Java ```java import java.net.URI; import java.net.http.*; public class Main { public static void main(String[] args) throws Exception { var request = HttpRequest.newBuilder(URI.create("https://api.jointextkit.com/v1/audit-logs?limit=10")) .header("Authorization", "Bearer " + System.getenv("TEXTKIT_API_KEY")) .GET() .build(); var response = HttpClient.newHttpClient().send(request, HttpResponse.BodyHandlers.ofString()); System.out.println(response.statusCode() + " " + response.body()); } } ``` ### .NET ```csharp using System.Net.Http.Headers; var http = new HttpClient(); http.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue( "Bearer", Environment.GetEnvironmentVariable("TEXTKIT_API_KEY")); var res = await http.GetAsync("https://api.jointextkit.com/v1/audit-logs?limit=10"); res.EnsureSuccessStatusCode(); var data = await res.Content.ReadAsStringAsync(); ``` ### cURL ```bash curl -X GET "https://api.jointextkit.com/v1/audit-logs?limit=10" \ -H "Authorization: Bearer $TEXTKIT_API_KEY" ``` ## Related - Guide: [Audit log](/docs/audit-logs) - [All audit log endpoints](/docs/api#audit-logs) - [API reference](/docs/api)