Version 2.5
Audit log

Audit log

Query the workspace audit log — a record of configuration changes (creates, updates, deletes, and draft publishes) to agents, data connections, semantic data models, MCP servers, and other configured entities, with the acting user and the before/after state of each change.

All paths are relative to the base URL and require an Authorization: Bearer YOUR_API_KEY header.

The audit log endpoint is admin only.

The audit entry object

PublicAuditEntry is a single row in the log.

FieldTypeDescription
idstringEntry ID.
tsstringTimestamp of the change.
audit_eventobjectThe recorded event (see below).
relation_kindstringOn deep queries, how this entry's entity relates to the queried entity (nullable).

The audit_event object:

FieldTypeDescription
actorstringWho made the change.
entity_typestringType of the changed entity, e.g. agent, data_connection.
entity_idstringID of the changed entity.
operationstringOne of create, update, delete, publish_draft, discard_draft.
before_stateobjectEntity state before the change (nullable, e.g. for creates).
after_stateobjectEntity state after the change (nullable, e.g. for deletes).

List audit entries

GET /audits

Lists audit log entries, newest first. Use since/until for a time range, and entity_type/entity_id to scope to one entity. Set deep=true to also include changes to that entity's dependent entities over the time the relationship existed — deep requires both entity_type and entity_id.

Query parameters

ParameterTypeDescription
entity_typestringEntity type to filter by — one of agent, branding, configuration, data_connection, mcp_server, observability, platform_params, semantic_data_model.
entity_idstringEntity ID to filter by.
deepbooleanInclude changes to the entity's dependent entities (transitive timeline). Requires entity_type and entity_id. Default false.
operationstringFilter by operation — create, update, delete, publish_draft, or discard_draft.
sincestringStart of time range, inclusive (timestamp).
untilstringEnd of time range, exclusive (timestamp).
limitintegerMax entries to return (default 100, max 1000).
offsetintegerOffset for pagination (default 0).

The response is a paginated envelope — { "next": ..., "has_more": ..., "data": [ /* entries */ ] } — paged with limit and offset.

curl 'https://{your-deployment-host}/api/v2/audits?entity_type=agent&entity_id={agent_id}&deep=true&since=2026-07-01T00:00:00Z' \
  -H 'Authorization: Bearer YOUR_API_KEY'