Skip to main content
GET
Export the workspace audit log

Authorizations

Authorization
string
header
required

Workspace read key whose stored grant explicitly names the operation. Existing grants are not expanded.

Path Parameters

workspace
integer
required

The workspace ID

Query Parameters

limit
integer
default:100

Events per page, ordered by sequence.

Required range: 1 <= x <= 500
cursor
string

Opaque next_cursor with after_sequence semantics; keep the same workspace, from and to.

Maximum string length: 4096
from
string<date-time>

Inclusive created_at lower bound, years 0001 through 9999; optional, with no default time restriction.

to
string<date-time>

Inclusive created_at upper bound, years 0001 through 9999; must be at or after from when both are supplied.

Response

Exact web export event fields, in ascending sequence order.

data
ActionAuditExportEvent · object[]
required
Maximum array length: 500
next_cursor
string | null
required
note
string
required

hash_version 2 uses SHA-256 of the canonical durable event fields. Null hash_version marks a legacy segment whose original hashes cannot be recomputed. Its single audit.legacy_checkpoint freezes a canonical snapshot digest of that segment. Verification covers the current database snapshot; detecting tail deletion requires comparing a previously saved head hash and sequence. Recognised assignments: name=value (also name[]= and parent[name]=) in URLs, fragments and form bodies; "name": value in JSON, including JSON nested in strings; name: value and name => value for compound names or quoted, bracketed or braced names; payload key names. Names are trimmed and matched case-insensitively: access_token, appsecret_proof, client_secret, refresh_token, signature, token, secret and password. Bare token, signature, secret and password colon/arrow forms require quotes, brackets or braces. The JSON object key code is preserved; code is redacted only as a parameter. Up to six rounds of JSON-escape, percent and HTML-entity decoding are applied. Recognised remaining assignments are exported whole as [redacted]; changed payload keys are renamed without overwriting other entries. Independently, substrings matching /EAA[A-Za-z0-9]{30,}/ are redacted from Meta provider response bodies before storage and hashing, and from exported payloads, actor names and summaries, without requiring a credential name. HTTP(S) URL user-info is redacted from exported payload strings, including JSON strings; an @ in a URL query or fragment does not trigger this user-info rule. This URL user-info rule does not change stored provider response bodies. thumbnail_url query strings are removed. Other encodings of non-Meta secrets are not guaranteed to be caught: the assignment rules do not recognise look-alike names, base64/base64url, name/value pairs, Authorization headers, JS hex escapes or unnamed free text. The EAA backstop covers these only where the matching token text is intact. A changed event includes redacted: true. Clients cannot recompute its event_hash and should use the verify endpoint, which checks the original stored bytes. Member export consent proof: signal.consent_decision_recorded and signal.consent_withdrawal_received payloads include visitor-linked event_id, consent_state and timestamps. event_id is pseudonymous to outsiders but may be a merchant order or Stripe identifier.