List audit log entries | Ara Documentation

{
  "items": [
    {
      "id": "a1b2c3d4-e5f6-7890-ab12-cd34ef567890",
      "action": "secret.created",
      "actor": "user_12345",
      "target": "secret_98765",
      "metadata": {
        "environment": "production",
        "ip_address": "192.168.1.100"
      },
      "created_at": "2024-01-15T09:30:00Z"
    }
  ],
  "has_next_page": true,
  "end_cursor": "2024-01-15T09:30:00Z",
  "entries": [
    {
      "id": "a1b2c3d4-e5f6-7890-ab12-cd34ef567890",
      "action": "secret.created",
      "actor": "user_12345",
      "target": "secret_98765",
      "metadata": {
        "environment": "production",
        "ip_address": "192.168.1.100"
      },
      "created_at": "2024-01-15T09:30:00Z"
    }
  ],
  "next_before": "2024-01-15T09:30:00Z"
}

Returns audit log entries newest first.

_{Scope: analytics:read}

Authentication

AuthorizationBearer

Your ara_ API key from Settings > Ara API. Keys are capability-scoped: run, plugins:read, secrets:read, secrets:write, sessions:read, knowledge:read, repos:read, repos:write, reviews:read, reviews:write, analytics:read, org:read, org:write, attachments:read, attachments:write, plugins:write, guardrails:read, guardrails:write.

Path parameters

orgIdstringRequired

Organization id or slug. Resolve it with GET /v3/self.

Query parameters

limitintegerOptionalDefaults to 50

Maximum entries to return (default 50, max 200).

beforedatetimeOptional

Return only entries created before this timestamp.

actionstringOptional

Return only entries with this exact action.

actorstringOptional

Return only entries performed by this actor user id.

sincedatetimeOptional

Return only entries created at or after this ISO timestamp.

Response

Audit log entries.

itemslist of objectsOptional

has_next_pagebooleanOptional

end_cursorstring or nullOptional

Pass back as after for the next page.

entrieslist of objectsOptional

Legacy twin of items.

next_beforestring or nullOptional

Legacy twin of end_cursor.

$	curl https://api.ara.so/v3/organizations/orgId/audit-logs \
>	-H "Authorization: Bearer <token>" \
>	-H "Content-Type: application/json"