export_audit_log
Read org audit log entries (ENTERPRISE+ feature). Requires OWNER or ADMIN org role. Returns up to 200 entries per call with optional filters: action, resource, userId, date range (from/to as ISO strings), and pagination (limit/offset). Each entry carries clientSurface (which client made the request: WEB, MAKER, EXTENSION, DESKTOP, MOBILE, MCP, PAT, SYSTEM, UNKNOWN) and clientLabel (the precise client). Distinct from actorType, which is the actor's privilege. Null on rows predating client attribution; that history is deliberately not backfilled, so a missing value means unknown rather than web.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | ISO date upper bound (inclusive). | |
| from | No | ISO date lower bound (inclusive). | |
| limit | No | Max entries to return. Default 50, max 200. | |
| action | No | Filter by exact action name. | |
| offset | No | Skip this many entries. Default 0. | |
| userId | No | Filter to entries where this user is the actor. | |
| resource | No | Filter by resource type (e.g. Task, Project). |