List audit events

GEThttps://api.fortwatch.ai/app/audit-log

Scope audit:readOperation ID listAuditEvents

Every change in the workspace, newest first, by members, API keys, OAuth apps, FortWatch AI, support and FortWatch itself, and every sign-in. Filter by category, action, actor, target or period. Owners and admins only. Paged in the body (items, total).

Parameters

Name	In	Type	Description
`page`	query	number
`limit`	query	number
`category`	query	string	One of: `auth`, `team`, `settings`, `project`, `asset`, `discovery`, `scan`, `schedule`, `issue`, `assessment`, `ai`, `billing`, `integration`, `workspace`, `platform`, `audit`
`action`	query	string	One of: `auth.register`, `auth.register_blocked`, `auth.verify_email`, `auth.forgot_password`, `auth.reset_password`, `auth.resend_verification`, `auth.login_success`, `auth.login_failed`, `auth.login_throttled`, `auth.login_mfa_required`, `auth.mfa_failed`, `auth.mfa_throttled`, `auth.mfa_setup_started`, `auth.mfa_enabled`, `auth.mfa_disabled`, `auth.mfa_codes_regenerated`, `auth.provider_login`, `auth.provider_login_failed`, `auth.provider_signup_started`, `auth.provider_linked`, `auth.provider_unlinked`, `auth.invite_accepted`, `auth.email_change_requested`, `auth.email_change_cancelled`, `auth.email_changed`, `auth.password_changed`, `auth.password_set`, `auth.profile_updated`, `auth.logout`, `auth.session_revoked`, `auth.other_sessions_revoked`, `auth.session_replay_revoked`, `auth.admin_login_success`, `auth.admin_login_failed`, `auth.admin_login_throttled`, `auth.admin_login_mfa_required`, `auth.admin_mfa_failed`, `auth.admin_mfa_throttled`, `auth.admin_mfa_setup_started`, `auth.admin_mfa_enabled`, `auth.admin_mfa_disabled`, `auth.admin_mfa_codes_regenerated`, `auth.admin_email_change_requested`, `auth.admin_email_change_cancelled`, `auth.admin_email_changed`, `auth.admin_password_changed`, `auth.admin_profile_updated`, `auth.admin_logout`, `auth.admin_session_revoked`, `auth.admin_other_sessions_revoked`, `auth.admin_session_replay_revoked`, `account.notification_preferences_updated`, `account.unsubscribed`, `invite.sent`, `invite.cancelled`, `invite.resent`, `member.created`, `member.updated`, `member.role_changed`, `member.password_reset`, `member.removed`, `member.deleted_all`, `workspace.ownership_transferred`, `settings.sla_updated`, `settings.security_updated`, `settings.notifications_updated`, `settings.updated`, `api_key.created`, `api_key.revoked`, `oauth_app.created`, `oauth_app.updated`, `oauth_app.secret_rotated`, `oauth_app.deleted`, `oauth_app.disabled`, `oauth_app.enabled`, `oauth_app.connected`, `oauth_app.disconnected`, `project.created`, `project.updated`, `project.deleted`, `project.deleted_all`, `asset.created`, `asset.updated`, `asset.deleted`, `asset.revalidated`, `asset.ownership_verified`, `asset.ownership_set`, `asset.scanners_changed`, `asset.deleted_all`, `discovery.run_started`, `discovery.hosts_added`, `discovery.host_ignored`, `discovery.host_restored`, `scan.started`, `scan.refused`, `scan.deleted`, `scan.deleted_all`, `schedule.created`, `schedule.updated`, `schedule.deleted`, `issue.status_changed`, `issue.resolved`, `issue.reopened`, `issue.in_progress`, `issue.dismissed`, `issue.undismissed`, `issue.assigned`, `issue.unassigned`, `issue.due_date_changed`, `issue.updated`, `issue.comment_added`, `issue.comment_edited`, `issue.comment_deleted`, `issue.opened`, `issue.auto_resolved`, `issue.auto_reopened`, `issue.severity_changed`, `issue.dismissal_expired`, `issue.created`, `issue.deleted`, `issue.deleted_all`, `finding.deleted`, `finding.deleted_all`, `assessment.generated`, `assessment.shared`, `assessment.share_revoked`, `assessment.deleted`, `ai.conversation_renamed`, `ai.conversation_deleted`, `ai.action_declined`, `billing.plan_chosen`, `billing.upgrade_requested`, `billing.change_scheduled`, `billing.change_cancelled`, `billing.cancelled`, `billing.resumed`, `billing.details_updated`, `billing.card_made_default`, `billing.card_removed`, `billing.plan_set`, `billing.discount_set`, `billing.limits_set`, `billing.invoice_created`, `billing.tax_set`, `billing.invoice_marked_paid`, `billing.invoice_voided`, `billing.receipt_resent`, `billing.unapplied_resolved`, `workspace.created`, `workspace.updated`, `workspace.suspended`, `workspace.reactivated`, `workspace.deleted`, `workspace.deleted_all`, `administrator.created`, `administrator.updated`, `administrator.deleted`, `scanner.updated`, `emerging_threat.released`, `ai_settings.updated`, `ai_logs.cleared`, `scanner_logs.cleared`, `service_logs.cleared`, `ticket.updated`, `ticket.deleted`, `blog.post_created`, `blog.post_updated`, `blog.post_deleted`, `blog.posts_deleted_all`, `blog.image_uploaded`, `integration.connected`, `integration.updated`, `integration.route_created`, `integration.route_updated`, `integration.route_deleted`, `integration.tested`, `integration.paused`, `integration.resumed`, `integration.reconnect_needed`, `integration.reconnected`, `integration.disconnected`, `integration.delivery_resent`, `integration.issues_sent`, `integration.identity_linked`, `integration.identity_unlinked`, `integration.ticket_created`, `integration.ticket_linked`, `integration.ticket_unlinked`, `integration.ticket_closed`, `integration.ticket_reopened`, `issue.fix_reported`, `audit.exported`
`actor`	query	string
`hideAutomatic`	query	string	One of: `true`, `false`
`targetType`	query	string
`targetId`	query	string
`from`	query	string
`to`	query	string
`q`	query	string

Example request

curl -X GET "https://api.fortwatch.ai/app/audit-log" \
  -H "Authorization: Bearer $FORTWATCH_API_KEY"

Response 200

The request succeeded.

Field	Type	Description
`items`required	object[]
`id`required	number
`createdAt`required	string (date-time)
`action`required	string	The catalogue action, e.g. asset.deleted
`category`required	string
`categoryLabel`required	string
`summary`required	string	The sentence after the actor's label: "deleted asset api.example.com"
`actor`required	object
`type`required	string	One of: `user`, `admin`, `system`, `anonymous`
`id`required	number \| null
`name`required	string \| null
`email`required	string \| null
`label`required	string
`source`required	string	One of: `app`, `management`, `ai_agent`, `public`, `worker`, `api`, `oauth`
`viaAi`required	boolean	Done by FortWatch AI for the actor (source ai_agent)
`via`required	object
`type`required	string	One of: `api_key`, `oauth_app`
`id`required	number \| null
`name`required	string \| null
`target`required	object
`type`required	string \| null
`id`required	string \| null
`label`required	string \| null
`changes`required	object \| null	{ field: [before, after] }
`metadata`required	object \| null
`ip`required	string \| null
`userAgent`required	string \| null
`total`required	number

json

{
  "items": [
    {
      "id": 42,
      "createdAt": "2026-10-16T12:00:00.000Z",
      "action": "string",
      "category": "string",
      "categoryLabel": "string",
      "summary": "string",
      "actor": {
        "type": "user",
        "id": null,
        "name": null,
        "email": null,
        "label": null
      },
      "source": "app",
      "viaAi": true,
      "via": {
        "type": "api_key",
        "id": null,
        "name": null
      },
      "target": {
        "type": null,
        "id": null,
        "label": null
      },
      "changes": {},
      "metadata": {},
      "ip": "string",
      "userAgent": "string"
    }
  ],
  "total": 1
}

Errors

`400`	The request is not valid: a field is missing or has the wrong shape (the message names it).
`401`	No valid credentials: the API key or access token is missing, revoked or expired (INVALID_API_KEY, INVALID_TOKEN).
`403`	Not allowed: the key or token lacks this scope (SCOPE_REQUIRED), the route is dashboard-only (SESSION_REQUIRED), or a plan limit applies.
`429`	Too many requests (RATE_LIMITED): wait the seconds Retry-After gives.

Every code is explained in Errors.

This page as Markdown