List audit log entries
Returns the workspace’s audit trail, newest first. Filter by resource type, resource id or user
id; the filters combine with AND. Each row says who (user_id) did what (action) to which
resource, from which IP and client, and when. Rejected attempts appear with a FAILED_MUTATION:
or FAILED_READ: prefix on action.
List rows leave out the request body (changes) and the integrity fields; fetch
GET /api/audit/{id} for those. To check that the log was not tampered with, use
GET /api/audit/verify-chain.
Uses offset pagination with limit and offset. The response has no total and no cursor: keep
requesting pages until one comes back with fewer than limit rows. See Pagination.
For a full copy, an audit_log export (POST /api/exports) is cheaper than paging.
Idempotency. A read with no side effects, and not itself written to the audit log. Safe to retry.
Access
- Required scope:
full. Human users need the owner role; admins are refused. - Rate limit: Audit — 20 requests/min per workspace, shared with the other audit routes, plus the general API limit (120–600/min by plan). The audit limiter counts a request even when the role check then refuses it. See Rate limits.
- Plan: Available on every plan.
Authentication
Workspace API key: jl_ followed by 64 lowercase hex characters, created by the workspace owner in the
dashboard (Settings → API Keys) and sent as Authorization: Bearer jl_.... The plaintext is shown once,
at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys.
Operations restricted to admins or owners reject keys without the full scope with 403, and say so in
their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret —
that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds.
See Authentication.
Query parameters
Exact match on resource_type, for example agent, campaign, outbound_webhook, export, report, integration or contact. Longer than 100 characters answers 400.
Exact match on resource_id. Must be a UUID or the request fails with 400. Resources with non-UUID ids have no resource_id; their id is kept in changes._resource_ref.
Exact match on user_id. A dashboard user id (user_…), or apikey:<keyId> for requests made with an API key. Up to 200 characters.
Page size, 1 to 100. Out-of-range or non-numeric values silently fall back to 50 (not to the nearest bound).
Rows to skip. Negative or non-numeric values silently fall back to 0.
Response
Rows ordered by created_at descending.