Read Audit Log
cascade_read_auditsRetrieve Cascade CMS audit log entries with filters for user, date, action type, and asset. Supports pagination to navigate through results.
Instructions
Read Cascade audit log entries matching the specified filters.
Queries Cascade's system audit log for events like edits, publishes, logins, check-outs, deletes, and workflow transitions. All auditParameters fields are optional — providing none returns every recorded event (expect large volumes; always apply a date range filter). Results are always returned newest-first by Cascade; this MCP layer then slices the page.
Args:
auditParameters (object, required, shape varies — see Cascade docs): Filter conditions
identifier (object, optional): Limit to events on a specific asset
username (string, optional): Limit to events by a specific user
groupname (string, optional): Limit to events by users in a group
rolename (string, optional): Limit to events by users with a role
startDate (string, optional): ISO-ish date; earliest event to include
endDate (string, optional): ISO-ish date; latest event to include
auditType (string, optional): One of: "login", "login_failed", "logout", "start_workflow", "advance_workflow", "edit", "copy", "create", "reference", "delete", "delete_unpublish", "check_in", "check_out", "activate_version", "publish", "unpublish", "recycle", "restore", "move"
limit (number, optional): Max results per page, 1-500 (default 50)
offset (number, optional): Skip N results for pagination (default 0)
Returns: The response is a page: { success: true, total: , count: , offset: , has_more: , next_offset: <offset for next page, if has_more>, audits: [ { user, action, identifier?: { ... }, date }, ... ] } On failure: { success: false, message: "" }
Examples:
Use when: "Who edited /about today?" -> { auditParameters: { identifier: { type: "folder", path: { path: "/about", siteName: "www" } }, auditType: "edit", startDate: "2026-04-13T00:00:00Z" } }
Use when: "All logins in April 2026" -> { auditParameters: { auditType: "login", startDate: "2026-04-01T00:00:00Z", endDate: "2026-04-30T23:59:59Z" } }
Don't use when: You want the current state — use cascade_read.
Don't use when: You want user inbox messages — use cascade_list_messages.
Pagination:
Default limit of 50 works for most queries. Increase up to 500 for larger pages.
If has_more is true and you need all audits, call again with offset: next_offset.
For a complete enumeration (e.g., all audits in a date range), loop until has_more: false.
For focused queries where you only need the most recent, stop as soon as you have what you need.
Error Handling:
"Invalid date format" when startDate/endDate don't parse
"Invalid auditType" when auditType isn't in the allowed set
"Permission denied" when credentials lack audit-read rights. Responses are JSON text; structuredContent is authoritative when the response fits. Oversized responses return bounded _cache metadata for cascade_read_response. For cascade_read, read_mode controls preview versus raw Cascade payload shape.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| auditParameters | No | REQUIRED: Audit filters (identifier, username, groupname, role, auditType, start/end dates). Matches Cascade's AuditParameters shape. | |
| limit | No | Maximum results per page (default: 50, max: 500). Check has_more and use next_offset to iterate. For a complete enumeration, loop until has_more=false. | |
| offset | No | Skip this many results for pagination (default: 0). Use with limit + has_more to iterate through large result sets. |