Audit logs
Read the record of changes made in your workspace.
The audit log records changes in your workspace as they happen: configuration updates, imports, exports, deletion requests and more, each with what happened, whether a member or AbuseZero made the change, and when. Use it to answer what changed during a review, or feed it into your own tooling.
With an OAuth token, the signed-in member also needs permission to manage the workspace.
Examples on this page use a server client:
import { AbuseZero } from "abusezero/server";
const abusezero = new AbuseZero({ key: process.env.ABUSEZERO_SECRET_KEY!, outage: "throw" });The audit event object
{
"object": "audit_event",
"id": "aud_48213",
"action": "browser_collection.updated",
"actor": "member",
"created_at": "2026-10-29T15:11:46.000Z"
}| Field | Type | Description |
|---|---|---|
object | "audit_event" | The object type. |
id | string | The event ID: aud_ followed by a number. |
action | string | What happened, such as import.confirmed, evaluations.export_requested or browser_collection.updated. New actions are added as AbuseZero grows, so treat unfamiliar values as valid. |
actor | member or system | member when a person or one of the workspace's API keys made the change. system when AbuseZero's own background work did, such as a scheduled job or a data deletion. |
created_at | string | When it happened. |
List audit events
Returns audit events newest first.
| Method | Path | Scope | Idempotency-Key |
|---|---|---|---|
GET | /v1/audit-logs | audit_logs:read | Not used |
Also available as abusezero audit-logs list in the AbuseZero CLI, abusezero_list_audit_logs on the AbuseZero MCP server and auditLogs() in the AbuseZero Node.js SDK.
Query parameters
| Parameter | Type | Required | Limits | Description |
|---|---|---|---|---|
limit | integer | No | 1 to 100, default 50 | How many events to return. |
cursor | string | No | The next_cursor from the previous page, unchanged. |
Example
const page = await abusezero.auditLogs({ limit: 100 });Response
Returns 200.
{
"object": "list",
"data": [
{
"object": "audit_event",
"id": "aud_48213",
"action": "browser_collection.updated",
"actor": "member",
"created_at": "2026-10-29T15:11:46.000Z"
},
{
"object": "audit_event",
"id": "aud_48190",
"action": "import.confirmed",
"actor": "member",
"created_at": "2026-10-29T11:24:02.000Z"
}
],
"next_cursor": "…"
}When next_cursor is a string, pass it as cursor to read the next page. See Pagination.
Errors
| Code | Status | Meaning |
|---|---|---|
PERMISSION_REQUIRED | 403 | With an OAuth token, the signed-in member doesn't have permission to manage the workspace. Ask the workspace owner. |
Retrieve an audit event
| Method | Path | Scope | Idempotency-Key |
|---|---|---|---|
GET | /v1/audit-logs/{id} | audit_logs:read | Not used |
Also available as abusezero audit-logs get in the AbuseZero CLI, abusezero_get_audit_log on the AbuseZero MCP server and call() in the AbuseZero Node.js SDK.
Path parameters
| Parameter | Type | Description |
|---|---|---|
id | string | The event ID, such as aud_48213. |
Example
const event = await abusezero.call("/v1/audit-logs/aud_48213");Response
Returns 200 with an audit event object.
Errors
| Code | Status | Meaning |
|---|---|---|
RESOURCE_NOT_FOUND | 404 | No audit event with this ID exists in the workspace. |
PERMISSION_REQUIRED | 403 | With an OAuth token, the signed-in member doesn't have permission to manage the workspace. Ask the workspace owner. |
For every other code, see REST API errors.
Related
How is this guide?
Last updated on