list_audit_logs
Read-onlyIdempotent
Retrieve paginated action-level audit events with actor, resource, metadata, and timestamps for compliance or incident review. Use individual records rather than analytics aggregates to trace specific actions.
Instructions
List audit log events for a Portkey workspace or organization. Returns paginated action-level records with actor, resource, metadata, and timestamps for compliance or incident review; use this instead of analytics when you need individual events, not aggregates. Enterprise-gated. Returns 403 on non-Enterprise Portkey plans.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | Filter by action type (e.g., 'create', 'update', 'delete', 'login') | |
| actor_id | No | Filter by the user ID who performed the action | |
| end_time | No | End of time range filter (ISO 8601 format, e.g., '2024-01-31T23:59:59Z') | |
| page_size | No | Number of results per page (max 100) | |
| start_time | No | Start of time range filter (ISO 8601 format, e.g., '2024-01-01T00:00:00Z') | |
| resource_id | No | Filter by specific resource ID | |
| current_page | No | Page number for pagination (starts at 1) | |
| workspace_id | No | Filter audit logs by workspace ID | |
| resource_type | No | Filter by resource type (e.g., 'user', 'workspace', 'config', 'virtual_key') |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ok | Yes | Whether the tool call succeeded and returned structured data | |
| data | No | Structured success payload when ok is true | |
| error | No | Structured error payload when ok is false |