Audit log
Query the workspace audit log — a record of configuration changes (creates, updates, deletes, and draft publishes) to agents, data connections, semantic data models, MCP servers, and other configured entities, with the acting user and the before/after state of each change.
All paths are relative to the base URL and require an Authorization: Bearer YOUR_API_KEY header.
The audit log endpoint is admin only.
The audit entry object
PublicAuditEntry is a single row in the log.
| Field | Type | Description |
|---|---|---|
| id | string | Entry ID. |
| ts | string | Timestamp of the change. |
| audit_event | object | The recorded event (see below). |
| relation_kind | string | On deep queries, how this entry's entity relates to the queried entity (nullable). |
The audit_event object:
| Field | Type | Description |
|---|---|---|
| actor | string | Who made the change. |
| entity_type | string | Type of the changed entity, e.g. agent, data_connection. |
| entity_id | string | ID of the changed entity. |
| operation | string | One of create, update, delete, publish_draft, discard_draft. |
| before_state | object | Entity state before the change (nullable, e.g. for creates). |
| after_state | object | Entity state after the change (nullable, e.g. for deletes). |
List audit entries
GET /audits
Lists audit log entries, newest first. Use since/until for a time range, and entity_type/entity_id to scope to one entity. Set deep=true to also include changes to that entity's dependent entities over the time the relationship existed — deep requires both entity_type and entity_id.
Query parameters
| Parameter | Type | Description |
|---|---|---|
| entity_type | string | Entity type to filter by — one of agent, branding, configuration, data_connection, mcp_server, observability, platform_params, semantic_data_model. |
| entity_id | string | Entity ID to filter by. |
| deep | boolean | Include changes to the entity's dependent entities (transitive timeline). Requires entity_type and entity_id. Default false. |
| operation | string | Filter by operation — create, update, delete, publish_draft, or discard_draft. |
| since | string | Start of time range, inclusive (timestamp). |
| until | string | End of time range, exclusive (timestamp). |
| limit | integer | Max entries to return (default 100, max 1000). |
| offset | integer | Offset for pagination (default 0). |
The response is a paginated envelope — { "next": ..., "has_more": ..., "data": [ /* entries */ ] } — paged with limit and offset.
curl 'https://{your-deployment-host}/api/v2/audits?entity_type=agent&entity_id={agent_id}&deep=true&since=2026-07-01T00:00:00Z' \
-H 'Authorization: Bearer YOUR_API_KEY'