list_audit
Read the append-only audit log, newest first, to trace who did what, when, to which document, and from which surface.
Instructions
Read the append-only audit log, newest first: who did what (create, publish, delete, login, export…), when, to which document, from which surface (ip 'mcp' = agent). Use it to find out who changed something. Requires audit.read and a token not limited to one site.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | Latest time, ISO 8601. | |
| from | No | Earliest time, ISO 8601, e.g. '2026-10-01T00:00:00Z'. | |
| site | No | Site slug or id to act in (multisite). Omit to use this server's default site. Call list_sites to see what exists — an empty tree or search usually means the wrong site, not missing content. | |
| limit | No | Rows to return, 1-500 (default 100). | |
| action | No | Action prefix, e.g. 'content.' (a whole category) or 'content.publish'. | |
| before | No | Paging cursor: the id of the oldest row you already have. | |
| documentId | No | Only actions on this document. | |
| actorUserId | No | Only actions by this user id (from list_users). |