Pre-1.0 · one maintainer · Stripe and cards only · no SDKs (client libraries) yet · no production users yet. Docs describe v0.9.1 (29 Oct 2026) · What’s new →

List audit log entries

GET

/v1/audit-log

const url = 'http://localhost:8080/v1/audit-log?order=created_at&limit=50&offset=0';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'http://localhost:8080/v1/audit-log?order=created_at&limit=50&offset=0' \
  --header 'Authorization: Bearer <token>'

Returns the tenant’s audit entries in the caller’s mode, newest first (by created_at, then id). All filters are exact matches and can be combined.

Paged with limit and offset, like every list. Here total stops counting at 10,001, so a value above 10,000 means “more than 10,000”.

Settings changes are always recorded in test mode, so they do not appear when you read the log in live mode.

Authorizations

BearerAuth

Parameters

Query Parameters

resource_type

string

For example invoice, api_key, setting. See /v1/audit-log/filters.

resource_id

string

action

string

For example create, update, revoke. See /v1/audit-log/filters.

actor_id

string

A user id or an API key id.

date_from

string

Lower bound on created_at, inclusive. RFC3339 or YYYY-MM-DD (start of day, UTC).

date_to

string

Upper bound on created_at, inclusive. RFC3339 or YYYY-MM-DD (23:59:59.999999 UTC, the end of that day).

test_clock_id

string

Only entries made inside this test clock’s simulation. Works for deleted clocks too.

sim_from

string

Lower bound on sim_effective_at (simulated time), inclusive. Excludes entries with no simulated time.

sim_to

string

Upper bound on sim_effective_at, inclusive.

order

string

Allowed values: created_at

The only supported order. Any other value is a 400.

limit

integer

default: 50 >= 1 <= 100

Rows per page, from 1 to 100. Default 50. Any other value, or one that is not a whole number, is a 422 with param: limit.

offset

integer

Rows to skip, 0 or more. Default 0. A negative value, or one that is not a whole number, is a 422 with param: offset.

Responses

200

Audit entries

application/json

object

data

required

Array<object>

object

required

string

tenant_id

string

actor_type

required

string

Allowed values: user api_key system

actor_id

required

User id, API key id, or system.

string

actor_name

Name of the API key, when the actor is a key.

string

action

required

For example create, update, revoke, finalize.

string

resource_type

required

string

resource_id

required

Can be empty for tenant-wide resources such as settings.

string

resource_label

string

metadata

Action details. A settings change lists each changed field with from and to.

object

key

additional properties

any

ip_address

string

request_id

Matches the Hardcount-Request-Id header of the request that made the change.

string

created_at

required

string format: date-time

sim_effective_at

Simulated time, for entries made inside a test clock.

string format: date-time

test_clock_id

string

subject_deleted

The resource no longer exists because its test clock was deleted. The entry is kept.

boolean

total

required

How many rows match the request’s filters, on every page, not only this one. The audit log and the customer list’s search and name or email sort say where they stop counting.

integer

Example

{
  "data": [
    {
      "actor_type": "user"
    }
  ]
}

400

Unsupported order

application/json

object

error

object

type

One of invalid_request_error, authentication_error, rate_limit_error or api_error. Every error the API answers has this shape, including an unknown path (404, code route_not_found) and a method the path does not take (405, code method_not_allowed, with an Allow header). The few exceptions are listed in docs/api-surface.md.

string

code

string

message

string

request_id

string

param

The request field the error is about. Sent only when the error names one. A request body may hold only the fields its operation lists, spelled and cased as listed: any other field, or one the server sets (such as id), is refused with 422 and param naming it. An operation with no request body lists no fields: send no body, {} or null. The Stripe and Postmark webhooks and the LiteLLM callback take their sender’s body as it comes.

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}

403

Caller lacks the apikey:read permission

application/json

object

error

object

type

string

code

string

message

string

request_id

string

param

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}

422

A date is not RFC3339 or YYYY-MM-DD, a range ends before it starts, or limit or offset is out of range

application/json

object

error

object

type

string

code

string

message

string

request_id

string

param

string

Example

{
  "error": {
    "type": "invalid_request_error"
  }
}