# Audit Logs ## List audit logs **get** `/v2/audit-logs` Returns a list of audit log events in your organization using cursor-based pagination (newest first). ### Query Parameters - `limit` - Number of events to return (1-100, default 10) - `cursor` - Cursor from a previous response for pagination - `action` - Filter by action type (e.g. `webhook.deleted`, `security.sso_enabled`) - `domain` - Filter by domain/category (e.g. `security`, `messenger`) - `startDate` - Filter events created on or after this ISO 8601 datetime - `endDate` - Filter events created on or before this ISO 8601 datetime ### Filtering by Action The `action` parameter filters by event type. Each action follows the `{domain}.{verb}` convention. See the `action` enum in this schema for the full list of supported values. **Examples:** - `?action=security.sso_enabled` — only SSO enablement events - `?action=webhook.deleted` — only webhook deletion events ### Filtering by Domain Use the `domain` parameter to narrow results to one category of audit event. **Examples:** - `?domain=security` — only security-related audit events - `?domain=messenger` — only messenger-related audit events ### Filtering by Date Range Use `startDate` and `endDate` together or individually to narrow results to a time window. **Examples:** - `?startDate=2025-01-01T00:00:00Z&endDate=2025-01-31T23:59:59Z` — January 2025 only - `?startDate=2025-06-01T00:00:00Z` — from June 1st onward ### Pagination Results are ordered by `createdAt` descending (newest first). Use the `nextCursor` value from each response as the `cursor` parameter in the next request to paginate forward. ``` GET /v2/audit-logs?limit=20 → { "nextCursor": "eyJ..." } GET /v2/audit-logs?limit=20&cursor=eyJ... → { "nextCursor": null } ← no more results ``` ### Metadata The `metadata` field contains event-specific details (e.g. before/after state for updates). Its shape depends on the `action` type and is not strictly modeled in the schema — treat it as a free-form object. ### Response Format Returns a list object with: - `object` - Always `"list"` - `data` - Array of audit log objects - `nextCursor` - Cursor for the next page, or `null` if no more results ### Audit Log Object Each audit log includes: - `id` - Unique event identifier (UUID) - `correlationId` - Groups related events from a single operation (e.g. bulk import) - `action` - What happened (e.g. `webhook.deleted`) - `domain` - Category the action belongs to (e.g. `integrations`) - `description` - Human-readable description - `actor` - Who performed the action (id, type, email, name, apiKey) - `resource` - What was affected (type, id, name) - `request` - Request context (ipAddress, userAgent) - `metadata` - Event-specific payload - `createdAt` - When the event occurred ### Version Availability This endpoint is only available in API version 2026-01-01.nova and newer. ### Query Parameters - `action: optional "auth.login" or "auth.logout" or "auth.login_failed" or 144 more` Filter audit logs by action type - `"auth.login"` - `"auth.logout"` - `"auth.login_failed"` - `"auth.password_reset_requested"` - `"auth.password_changed"` - `"auth.mfa_enabled"` - `"auth.mfa_disabled"` - `"auth.sso_login"` - `"auth.password_reset_completed"` - `"auth.unauthorized_method"` - `"auth.recovery_code_regenerated"` - `"auth.sso_enforcement_blocked"` - `"auth.sso_enforcement_session_invalidated"` - `"auth.managed_account_link_blocked"` - `"auth.cross_org_invite_accepted"` - `"auth.sso_enforcement_shadow"` - `"teammate.invited"` - `"teammate.joined"` - `"teammate.removed"` - `"teammate.email_changed"` - `"teammate.name_changed"` - `"teammate.seat_changed"` - `"teammate.deactivated"` - `"teammate.invite_changed"` - `"teammate.invite_deleted"` - `"teammate.scim_provisioned"` - `"teammate.scim_deprovisioned"` - `"teammate.scim_unlinked"` - `"teammate.scim_relinked"` - `"teammate.scim_operation_blocked"` - `"teammate.scim_seat_capacity_blocked"` - `"teammate.scim_email_updated"` - `"teammate.scim_exclusion_list_updated"` - `"teammate.restored"` - `"teammate.scim_restored"` - `"teammate.scim_auto_claimed"` - `"teammate.scim_claim_role_preserved"` - `"teammate.permanently_removed"` - `"member.role_changed"` - `"organization.owner_transferred"` - `"article.created"` - `"article.updated"` - `"article.body_edited"` - `"article.published"` - `"article.unpublished"` - `"article.deleted"` - `"changelog.created"` - `"changelog.published"` - `"changelog.deleted"` - `"changelog.unpublished"` - `"settings.name_changed"` - `"settings.branding_updated"` - `"settings.custom_domain_changed"` - `"settings.language_changed"` - `"settings.timezone_changed"` - `"settings.email_settings_changed"` - `"settings.help_center_updated"` - `"settings.moderation_changed"` - `"settings.voting_changed"` - `"settings.statuses_updated"` - `"settings.boards_updated"` - `"settings.privacy_changed"` - `"settings.subdomain_changed"` - `"settings.subdomain_change_requested"` - `"settings.grace_period_changed"` - `"security.scim_override_blocked"` - `"security.sso_enabled"` - `"security.sso_disabled"` - `"security.sso_configured"` - `"security.sso_jit_provisioning_blocked"` - `"security.directory_sync_enabled"` - `"security.directory_sync_disabled"` - `"security.directory_sync_reconciled"` - `"security.two_factor_enforced"` - `"security.auth_method_changed"` - `"security.ip_allowlist_changed"` - `"security.ip_allowlist_blocked"` - `"security.identity_verification_changed"` - `"security.sso_url_changed"` - `"security.sso_jit_provisioning_changed"` - `"security.sso_enforcement_enabled"` - `"security.sso_enforcement_disabled"` - `"security.dsync_group_mappings_changed"` - `"security.dsync_mapping_priority_changed"` - `"security.user_banned"` - `"security.user_unbanned"` - `"integration.installed"` - `"integration.uninstalled"` - `"integration.configured"` - `"webhook.created"` - `"webhook.updated"` - `"webhook.deleted"` - `"webhook.secret_rotated"` - `"api_key.created"` - `"api_key.regenerated"` - `"api_key.deleted"` - `"organization.deletion_scheduled"` - `"organization.deletion_cancelled"` - `"data.export_initiated"` - `"data.import_initiated"` - `"data.bulk_delete"` - `"data.user_data_deleted"` - `"data.csv_exported"` - `"billing.plan_changed"` - `"billing.plan_cancelled"` - `"billing.seat_limit_changed"` - `"billing.seat_activated"` - `"workflow.created"` - `"workflow.activated"` - `"workflow.deactivated"` - `"workflow.deleted"` - `"workflow.updated"` - `"messenger.look_and_feel_changed"` - `"messenger.spaces_changed"` - `"messenger.language_changed"` - `"messenger.platform_availability_changed"` - `"messenger.search_browse_changed"` - `"messenger.email_collection_changed"` - `"messenger.welcome_message_changed"` - `"messenger.launcher_changed"` - `"messenger.inbound_conversations_changed"` - `"messenger.office_hours_changed"` - `"messenger.identity_verification_changed"` - `"messenger.privacy_policy_changed"` - `"brand.created"` - `"brand.updated"` - `"brand.deleted"` - `"brand.messenger_look_and_feel_changed"` - `"brand.messenger_launcher_changed"` - `"brand.messenger_welcome_message_changed"` - `"brand.messenger_privacy_policy_changed"` - `"brand.default_changed"` - `"ai_agent.enabled"` - `"ai_agent.disabled"` - `"ai_agent.identity_changed"` - `"ai_agent.customization_changed"` - `"ai_agent.guidance_changed"` - `"ai_agent.multilingual_changed"` - `"ai_agent.data_context_changed"` - `"email.sending_address_created"` - `"email.sending_address_updated"` - `"email.sending_address_deleted"` - `"email.domain_registered"` - `"email.domain_deleted"` - `"email.reply_to_changed"` - `"email.ignored_address_added"` - `"email.ignored_address_removed"` - `cursor: optional string` An opaque cursor for pagination. Use the nextCursor value from a previous response to fetch the next page of results. - `domain: optional "authentication" or "team_management" or "permissions" or 12 more` Filter audit logs by domain/category - `"authentication"` - `"team_management"` - `"permissions"` - `"articles"` - `"changelog"` - `"workspace_settings"` - `"security"` - `"integrations"` - `"data_management"` - `"billing"` - `"workflows"` - `"messenger"` - `"brands"` - `"ai_agent"` - `"email_config"` - `endDate: optional string` Filter events created on or before this ISO 8601 datetime - `limit: optional number` A limit on the number of objects to be returned, between 1 and 100. - `startDate: optional string` Filter events created on or after this ISO 8601 datetime ### Header Parameters - `"Featurebase-Version": optional "2026-01-01.nova" or "2025-12-12.clover"` - `"2026-01-01.nova"` - `"2025-12-12.clover"` ### Returns - `data: array of object { id, action, actor, 8 more }` Array of audit log events - `id: string` Unique event identifier - `action: "auth.login" or "auth.logout" or "auth.login_failed" or 144 more` The type of action that was performed - `"auth.login"` - `"auth.logout"` - `"auth.login_failed"` - `"auth.password_reset_requested"` - `"auth.password_changed"` - `"auth.mfa_enabled"` - `"auth.mfa_disabled"` - `"auth.sso_login"` - `"auth.password_reset_completed"` - `"auth.unauthorized_method"` - `"auth.recovery_code_regenerated"` - `"auth.sso_enforcement_blocked"` - `"auth.sso_enforcement_session_invalidated"` - `"auth.managed_account_link_blocked"` - `"auth.cross_org_invite_accepted"` - `"auth.sso_enforcement_shadow"` - `"teammate.invited"` - `"teammate.joined"` - `"teammate.removed"` - `"teammate.email_changed"` - `"teammate.name_changed"` - `"teammate.seat_changed"` - `"teammate.deactivated"` - `"teammate.invite_changed"` - `"teammate.invite_deleted"` - `"teammate.scim_provisioned"` - `"teammate.scim_deprovisioned"` - `"teammate.scim_unlinked"` - `"teammate.scim_relinked"` - `"teammate.scim_operation_blocked"` - `"teammate.scim_seat_capacity_blocked"` - `"teammate.scim_email_updated"` - `"teammate.scim_exclusion_list_updated"` - `"teammate.restored"` - `"teammate.scim_restored"` - `"teammate.scim_auto_claimed"` - `"teammate.scim_claim_role_preserved"` - `"teammate.permanently_removed"` - `"member.role_changed"` - `"organization.owner_transferred"` - `"article.created"` - `"article.updated"` - `"article.body_edited"` - `"article.published"` - `"article.unpublished"` - `"article.deleted"` - `"changelog.created"` - `"changelog.published"` - `"changelog.deleted"` - `"changelog.unpublished"` - `"settings.name_changed"` - `"settings.branding_updated"` - `"settings.custom_domain_changed"` - `"settings.language_changed"` - `"settings.timezone_changed"` - `"settings.email_settings_changed"` - `"settings.help_center_updated"` - `"settings.moderation_changed"` - `"settings.voting_changed"` - `"settings.statuses_updated"` - `"settings.boards_updated"` - `"settings.privacy_changed"` - `"settings.subdomain_changed"` - `"settings.subdomain_change_requested"` - `"settings.grace_period_changed"` - `"security.scim_override_blocked"` - `"security.sso_enabled"` - `"security.sso_disabled"` - `"security.sso_configured"` - `"security.sso_jit_provisioning_blocked"` - `"security.directory_sync_enabled"` - `"security.directory_sync_disabled"` - `"security.directory_sync_reconciled"` - `"security.two_factor_enforced"` - `"security.auth_method_changed"` - `"security.ip_allowlist_changed"` - `"security.ip_allowlist_blocked"` - `"security.identity_verification_changed"` - `"security.sso_url_changed"` - `"security.sso_jit_provisioning_changed"` - `"security.sso_enforcement_enabled"` - `"security.sso_enforcement_disabled"` - `"security.dsync_group_mappings_changed"` - `"security.dsync_mapping_priority_changed"` - `"security.user_banned"` - `"security.user_unbanned"` - `"integration.installed"` - `"integration.uninstalled"` - `"integration.configured"` - `"webhook.created"` - `"webhook.updated"` - `"webhook.deleted"` - `"webhook.secret_rotated"` - `"api_key.created"` - `"api_key.regenerated"` - `"api_key.deleted"` - `"organization.deletion_scheduled"` - `"organization.deletion_cancelled"` - `"data.export_initiated"` - `"data.import_initiated"` - `"data.bulk_delete"` - `"data.user_data_deleted"` - `"data.csv_exported"` - `"billing.plan_changed"` - `"billing.plan_cancelled"` - `"billing.seat_limit_changed"` - `"billing.seat_activated"` - `"workflow.created"` - `"workflow.activated"` - `"workflow.deactivated"` - `"workflow.deleted"` - `"workflow.updated"` - `"messenger.look_and_feel_changed"` - `"messenger.spaces_changed"` - `"messenger.language_changed"` - `"messenger.platform_availability_changed"` - `"messenger.search_browse_changed"` - `"messenger.email_collection_changed"` - `"messenger.welcome_message_changed"` - `"messenger.launcher_changed"` - `"messenger.inbound_conversations_changed"` - `"messenger.office_hours_changed"` - `"messenger.identity_verification_changed"` - `"messenger.privacy_policy_changed"` - `"brand.created"` - `"brand.updated"` - `"brand.deleted"` - `"brand.messenger_look_and_feel_changed"` - `"brand.messenger_launcher_changed"` - `"brand.messenger_welcome_message_changed"` - `"brand.messenger_privacy_policy_changed"` - `"brand.default_changed"` - `"ai_agent.enabled"` - `"ai_agent.disabled"` - `"ai_agent.identity_changed"` - `"ai_agent.customization_changed"` - `"ai_agent.guidance_changed"` - `"ai_agent.multilingual_changed"` - `"ai_agent.data_context_changed"` - `"email.sending_address_created"` - `"email.sending_address_updated"` - `"email.sending_address_deleted"` - `"email.domain_registered"` - `"email.domain_deleted"` - `"email.reply_to_changed"` - `"email.ignored_address_added"` - `"email.ignored_address_removed"` - `actor: object { id, apiKey, email, 2 more }` - `id: string` Featurebase user ID of the actor, or null for system actors - `apiKey: object { id, name }` API key that authenticated the request, or null for dashboard sessions - `id: string` API key ID - `name: string` API key name - `email: string` Email address of the actor - `name: string` Display name of the actor - `type: "admin" or "system" or "api_key" or "integration"` The type of actor that performed the action - `"admin"` - `"system"` - `"api_key"` - `"integration"` - `correlationId: string` Groups related events from a single operation (e.g. bulk import) - `createdAt: string` ISO 8601 timestamp of when the event occurred - `description: string` Pre-rendered human-readable description of the event - `domain: "authentication" or "team_management" or "permissions" or 12 more` The domain/category the action belongs to - `"authentication"` - `"team_management"` - `"permissions"` - `"articles"` - `"changelog"` - `"workspace_settings"` - `"security"` - `"integrations"` - `"data_management"` - `"billing"` - `"workflows"` - `"messenger"` - `"brands"` - `"ai_agent"` - `"email_config"` - `metadata: map[unknown]` Event-specific payload with before/after state when applicable. The shape of this object depends on the action type. - `object: "audit_log"` Object type identifier - `"audit_log"` - `request: object { ipAddress, userAgent }` - `ipAddress: string` IP address the request originated from - `userAgent: string` User-Agent header from the request - `resource: object { id, name, type }` - `id: string` ID of the affected resource, or null for organization-level events - `name: string` Display name of the affected resource - `type: string` Type of the affected resource - `nextCursor: string` Cursor for fetching the next page. Null if there are no more results. - `object: "list"` Object type identifier - `"list"` ### Example ```http curl https://do.featurebase.app/v2/audit-logs \ -H "Authorization: Bearer $FEATUREBASE_API_KEY" ``` #### Response ```json { "data": [ { "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "action": "webhook.deleted", "actor": { "id": "507f1f77bcf86cd799439011", "apiKey": { "id": "507f1f77bcf86cd799439012", "name": "Production Key" }, "email": "admin@example.com", "name": "Jane Admin", "type": "admin" }, "correlationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901", "createdAt": "2025-06-15T10:30:00.000Z", "description": "Deleted webhook for https://hooks.slack.com/services/T000/B000/XXXXXXXX (webhook: 507f1f77bcf86cd799439013)", "domain": "integrations", "metadata": { "webhookId": "bar", "url": "bar" }, "object": "audit_log", "request": { "ipAddress": "192.168.1.1", "userAgent": "Mozilla/5.0" }, "resource": { "id": "507f1f77bcf86cd799439013", "name": "https://hooks.slack.com/services/T000/B000/XXXXXXXX", "type": "webhook" } } ], "nextCursor": "eyJjcmVhdGVkQXQiOiIyMDI1LTA2LTE1VDEwOjMwOjAwLjAwMFoiLCJpZCI6IjUwN2YxZjc3YmNmODZjZDc5OTQzOTAxMSJ9", "object": "list" } ``` ## Domain Types ### Audit Log List Response - `AuditLogListResponse object { id, action, actor, 8 more }` - `id: string` Unique event identifier - `action: "auth.login" or "auth.logout" or "auth.login_failed" or 144 more` The type of action that was performed - `"auth.login"` - `"auth.logout"` - `"auth.login_failed"` - `"auth.password_reset_requested"` - `"auth.password_changed"` - `"auth.mfa_enabled"` - `"auth.mfa_disabled"` - `"auth.sso_login"` - `"auth.password_reset_completed"` - `"auth.unauthorized_method"` - `"auth.recovery_code_regenerated"` - `"auth.sso_enforcement_blocked"` - `"auth.sso_enforcement_session_invalidated"` - `"auth.managed_account_link_blocked"` - `"auth.cross_org_invite_accepted"` - `"auth.sso_enforcement_shadow"` - `"teammate.invited"` - `"teammate.joined"` - `"teammate.removed"` - `"teammate.email_changed"` - `"teammate.name_changed"` - `"teammate.seat_changed"` - `"teammate.deactivated"` - `"teammate.invite_changed"` - `"teammate.invite_deleted"` - `"teammate.scim_provisioned"` - `"teammate.scim_deprovisioned"` - `"teammate.scim_unlinked"` - `"teammate.scim_relinked"` - `"teammate.scim_operation_blocked"` - `"teammate.scim_seat_capacity_blocked"` - `"teammate.scim_email_updated"` - `"teammate.scim_exclusion_list_updated"` - `"teammate.restored"` - `"teammate.scim_restored"` - `"teammate.scim_auto_claimed"` - `"teammate.scim_claim_role_preserved"` - `"teammate.permanently_removed"` - `"member.role_changed"` - `"organization.owner_transferred"` - `"article.created"` - `"article.updated"` - `"article.body_edited"` - `"article.published"` - `"article.unpublished"` - `"article.deleted"` - `"changelog.created"` - `"changelog.published"` - `"changelog.deleted"` - `"changelog.unpublished"` - `"settings.name_changed"` - `"settings.branding_updated"` - `"settings.custom_domain_changed"` - `"settings.language_changed"` - `"settings.timezone_changed"` - `"settings.email_settings_changed"` - `"settings.help_center_updated"` - `"settings.moderation_changed"` - `"settings.voting_changed"` - `"settings.statuses_updated"` - `"settings.boards_updated"` - `"settings.privacy_changed"` - `"settings.subdomain_changed"` - `"settings.subdomain_change_requested"` - `"settings.grace_period_changed"` - `"security.scim_override_blocked"` - `"security.sso_enabled"` - `"security.sso_disabled"` - `"security.sso_configured"` - `"security.sso_jit_provisioning_blocked"` - `"security.directory_sync_enabled"` - `"security.directory_sync_disabled"` - `"security.directory_sync_reconciled"` - `"security.two_factor_enforced"` - `"security.auth_method_changed"` - `"security.ip_allowlist_changed"` - `"security.ip_allowlist_blocked"` - `"security.identity_verification_changed"` - `"security.sso_url_changed"` - `"security.sso_jit_provisioning_changed"` - `"security.sso_enforcement_enabled"` - `"security.sso_enforcement_disabled"` - `"security.dsync_group_mappings_changed"` - `"security.dsync_mapping_priority_changed"` - `"security.user_banned"` - `"security.user_unbanned"` - `"integration.installed"` - `"integration.uninstalled"` - `"integration.configured"` - `"webhook.created"` - `"webhook.updated"` - `"webhook.deleted"` - `"webhook.secret_rotated"` - `"api_key.created"` - `"api_key.regenerated"` - `"api_key.deleted"` - `"organization.deletion_scheduled"` - `"organization.deletion_cancelled"` - `"data.export_initiated"` - `"data.import_initiated"` - `"data.bulk_delete"` - `"data.user_data_deleted"` - `"data.csv_exported"` - `"billing.plan_changed"` - `"billing.plan_cancelled"` - `"billing.seat_limit_changed"` - `"billing.seat_activated"` - `"workflow.created"` - `"workflow.activated"` - `"workflow.deactivated"` - `"workflow.deleted"` - `"workflow.updated"` - `"messenger.look_and_feel_changed"` - `"messenger.spaces_changed"` - `"messenger.language_changed"` - `"messenger.platform_availability_changed"` - `"messenger.search_browse_changed"` - `"messenger.email_collection_changed"` - `"messenger.welcome_message_changed"` - `"messenger.launcher_changed"` - `"messenger.inbound_conversations_changed"` - `"messenger.office_hours_changed"` - `"messenger.identity_verification_changed"` - `"messenger.privacy_policy_changed"` - `"brand.created"` - `"brand.updated"` - `"brand.deleted"` - `"brand.messenger_look_and_feel_changed"` - `"brand.messenger_launcher_changed"` - `"brand.messenger_welcome_message_changed"` - `"brand.messenger_privacy_policy_changed"` - `"brand.default_changed"` - `"ai_agent.enabled"` - `"ai_agent.disabled"` - `"ai_agent.identity_changed"` - `"ai_agent.customization_changed"` - `"ai_agent.guidance_changed"` - `"ai_agent.multilingual_changed"` - `"ai_agent.data_context_changed"` - `"email.sending_address_created"` - `"email.sending_address_updated"` - `"email.sending_address_deleted"` - `"email.domain_registered"` - `"email.domain_deleted"` - `"email.reply_to_changed"` - `"email.ignored_address_added"` - `"email.ignored_address_removed"` - `actor: object { id, apiKey, email, 2 more }` - `id: string` Featurebase user ID of the actor, or null for system actors - `apiKey: object { id, name }` API key that authenticated the request, or null for dashboard sessions - `id: string` API key ID - `name: string` API key name - `email: string` Email address of the actor - `name: string` Display name of the actor - `type: "admin" or "system" or "api_key" or "integration"` The type of actor that performed the action - `"admin"` - `"system"` - `"api_key"` - `"integration"` - `correlationId: string` Groups related events from a single operation (e.g. bulk import) - `createdAt: string` ISO 8601 timestamp of when the event occurred - `description: string` Pre-rendered human-readable description of the event - `domain: "authentication" or "team_management" or "permissions" or 12 more` The domain/category the action belongs to - `"authentication"` - `"team_management"` - `"permissions"` - `"articles"` - `"changelog"` - `"workspace_settings"` - `"security"` - `"integrations"` - `"data_management"` - `"billing"` - `"workflows"` - `"messenger"` - `"brands"` - `"ai_agent"` - `"email_config"` - `metadata: map[unknown]` Event-specific payload with before/after state when applicable. The shape of this object depends on the action type. - `object: "audit_log"` Object type identifier - `"audit_log"` - `request: object { ipAddress, userAgent }` - `ipAddress: string` IP address the request originated from - `userAgent: string` User-Agent header from the request - `resource: object { id, name, type }` - `id: string` ID of the affected resource, or null for organization-level events - `name: string` Display name of the affected resource - `type: string` Type of the affected resource