mcp-easy-ai__wp_audit_list
List entries from the MCP audit log: every tool call (reads included), refusals, authentication failures and OAuth authorize/device/refresh events, newest first. Each entry carries the acting user, the credential source (legacy API key or oauth), the OAuth client, the redacted arguments, the result status, the tool duration in milliseconds and the client IP. Filter by free text over tool name and arguments, tool, user, client, source, status, token id or date range. Admin only. For before/after snapshots of what a call changed, use wp_history_list with the entry id as audit_id. Through Royally: its server marks it read-only, so it runs straight away.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| since | No | GMT datetime, e.g. 2026-05-01 00:00:00 | |
| until | No | ||
| offset | No | ||
| search | No | Free-text match over the tool name and the redacted arguments (case-insensitive substring). | |
| site_id | No | Site to run this tool on: 8ef2e52b-bd07-4671-a363-ebe8b480b65c (https://demo.royalplugins.com) | |
| token_id | No | Credential row id. Combine with auth_source: the id is from the API-key table for legacy rows and from the OAuth access-token table for oauth rows. | |
| before_id | No | Snapshot bound for paging: only rows with id <= this value. Omit on the first page; the response returns the before_id it used, pass that back with the next offset so later pages cannot shift when new rows (including this call's own audit row) arrive. | |
| tool_name | No | Exact tool name, e.g. wp_update_post. Internal events use a leading underscore: _auth_failure, _oauth_authorize, _oauth_device, _oauth_refresh. | |
| wp_user_id | No | WordPress user the credential belongs to. | |
| auth_source | No | legacy = API key, oauth = OAuth 2.1 grant, unknown = rows written before the source was recorded. | |
| result_status | No | success, error, pending, refused, auth_failure, or an OAuth refresh event name. | |
| oauth_client_id | No |