list_audit_events
Search the organization's audit log, newest first by default: who did what to which subject and how it ended, every approval decision, pipeline outcome, configuration change and API key action included. Filters combine; page with next_cursor. total_count is how many events match.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| q | No | Free text over the event type, the actor's name and id, the subject id, the event id and the event's data. | |
| sort | No | occurred (the default), event_type or actor. | |
| limit | No | How many events per page, 1 to 500. Defaults to 100. | |
| order | No | desc for newest first (the default) or asc. | |
| to_at | No | Only events before this RFC 3339 time. | |
| cursor | No | The next_cursor of the previous page; keep the same filters, sort and order. | |
| from_at | No | Only events at or after this RFC 3339 time. | |
| outcome | No | Only events whose action ended this way: approved, denied, expired, cancelled, human or blocked. | |
| actor_id | No | Only events by one actor: a membership or user id, an agent's slug, or an API key's id. | |
| actor_type | No | Only events by this kind of actor: human, agent, system or api_key. | |
| subject_id | No | Only events about one subject; requires subject_type. An agent is given by its slug, everything else by its id. | |
| event_types | No | Only events of these types, from list_audit_event_types. | |
| subject_type | No | Only events about this kind of thing, such as approval_request, membership or request_approval_pipeline. |