Audit log
get_audit_logReads the append-only audit trail for an organisation, newest first. Each entry says what happened (action, e.g. create/approve/sync/flag), to what (entity_type + entity_id), by whom (actor_type: human/system/api), why (reason), and when (created_at, ISO 8601). Use it to answer "who approved this", "what happened to event X" (filter by entity_id), or "what has the pipeline done recently". Filter with entity_type (e.g. classified_event) and/or entity_id. Paginate by passing the returned next_cursor as cursor; next_cursor is null on the last page. total_count is the full match count ignoring pagination. Detailed before/after state is never returned through this tool.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Entries per page, default 50, max 200. | |
| cursor | No | The next_cursor value from the previous page (last seen entry id). | |
| org_id | No | Optional. Defaults to the organisation the authenticated API key is bound to, so you normally omit it and never need to ask the user for their organisation UUID. If provided, it must match the key’s org or the request is rejected. | 0e91146d-511c-469f-bdee-5c867b26ae0d |
| entity_id | No | Filter to one entity by UUID. | |
| entity_type | No | Filter to one entity type, e.g. "classified_event" or "integration". |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| entries | Yes | ||
| next_cursor | Yes | ||
| total_count | Yes |