Returns one page of a workspace's audit log, optionally narrowed to a category and a date range, with member names attached and timestamps in UTC.
AccessRequires a permission in the workspaceVIEW_LOGS
This is the call behind the Reports page. Each entry is an AuditLogEntry,
documented under Shared objects: a timestamp in UTC, the
event category, the specific action, a description, and the member who triggered
it, with user_name filled in where the name can be resolved. The log records
the categories the operator documentation lists under
Activity and audit log:
authentication, governance, policy, workflow, signing, Bitcoin network, SCL,
tenant, system, and audit. category narrows the results to one of them, and
matches the value entries carry in their own category field.
The response is paginated. page is 1-based and echoes back the page you asked
for, page_size is how many entries a page holds, total_logs is how many
entries match your filters in total, and total_pages is how many requests it
takes to read them all. To walk a range end to end, keep org_uid,
workspace_uid, and the filters the same and request pages 1 through
total_pages.
prev_hash and event_hash are base64 hashes that chain the entries together:
each entry's prev_hash is the event_hash of the entry before it. Alter a row
or take one out and the chain no longer joins up, which is what makes this an
evidentiary record rather than a convenient one. It is also why the log is
read-only: no endpoint in this reference edits or removes an entry.
Query parameters
org_uidstringrequired
The organisation the workspace belongs to, as a string rather than a number.
workspace_uidnumberrequired
The workspace whose audit log to read. You must hold VIEW_LOGS in it.
categorystringoptional
Narrows the results to a single event category, matching the value entries carry in their category field.
