list_audit_log
List AuditLog rows for the caller's org with common filters: userId, action, resource, since (ISO), until (ISO), search (matches userEmail / action / resource). Default limit 50, max 200. Requires OWNER or ADMIN org role, auditLogs feature (ENTERPRISE+). PREFER export_audit_log for bulk CSV/JSON export. Each row carries clientSurface (which client the request came from: WEB, MAKER, EXTENSION, DESKTOP, MOBILE, MCP, PAT, SYSTEM or UNKNOWN) and clientLabel (the precise client, e.g. "Claude Code"). These are a DIFFERENT axis from actorType, which is the actor's privilege. Both are null on rows written before client attribution shipped; that history is deliberately not backfilled, so absence means "unknown", never "web".
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Default 50, max 200. | |
| since | No | ISO date. | |
| until | No | ISO date. | |
| action | No | ||
| offset | No | Default 0. | |
| search | No | Matches userEmail / action / resource. | |
| userId | No | ||
| resource | No |