# List audit events

`GET /app/audit-log`

Every change in the workspace, newest first, by members, API keys, OAuth apps, FortWatch AI, support and FortWatch itself, and every sign-in. Filter by category, action, actor, target or period. Owners and admins only. Paged in the body (items, total).

Scope: `audit:read`.

## Parameters

- `page` (query, number)
- `limit` (query, number)
- `category` (query, string) One of: `auth`, `team`, `settings`, `project`, `asset`, `discovery`, `scan`, `schedule`, `issue`, `assessment`, `ai`, `billing`, `integration`, `workspace`, `platform`, `audit`.
- `action` (query, string) One of: `auth.register`, `auth.register_blocked`, `auth.verify_email`, `auth.forgot_password`, `auth.reset_password`, `auth.resend_verification`, `auth.login_success`, `auth.login_failed`, `auth.login_throttled`, `auth.login_mfa_required`, `auth.mfa_failed`, `auth.mfa_throttled`, `auth.mfa_setup_started`, `auth.mfa_enabled`, `auth.mfa_disabled`, `auth.mfa_codes_regenerated`, `auth.provider_login`, `auth.provider_login_failed`, `auth.provider_signup_started`, `auth.provider_linked`, `auth.provider_unlinked`, `auth.invite_accepted`, `auth.email_change_requested`, `auth.email_change_cancelled`, `auth.email_changed`, `auth.password_changed`, `auth.password_set`, `auth.profile_updated`, `auth.logout`, `auth.session_revoked`, `auth.other_sessions_revoked`, `auth.session_replay_revoked`, `auth.admin_login_success`, `auth.admin_login_failed`, `auth.admin_login_throttled`, `auth.admin_login_mfa_required`, `auth.admin_mfa_failed`, `auth.admin_mfa_throttled`, `auth.admin_mfa_setup_started`, `auth.admin_mfa_enabled`, `auth.admin_mfa_disabled`, `auth.admin_mfa_codes_regenerated`, `auth.admin_email_change_requested`, `auth.admin_email_change_cancelled`, `auth.admin_email_changed`, `auth.admin_password_changed`, `auth.admin_profile_updated`, `auth.admin_logout`, `auth.admin_session_revoked`, `auth.admin_other_sessions_revoked`, `auth.admin_session_replay_revoked`, `account.notification_preferences_updated`, `account.unsubscribed`, `invite.sent`, `invite.cancelled`, `invite.resent`, `member.created`, `member.updated`, `member.role_changed`, `member.password_reset`, `member.removed`, `member.deleted_all`, `workspace.ownership_transferred`, `settings.sla_updated`, `settings.security_updated`, `settings.notifications_updated`, `settings.updated`, `api_key.created`, `api_key.revoked`, `oauth_app.created`, `oauth_app.updated`, `oauth_app.secret_rotated`, `oauth_app.deleted`, `oauth_app.disabled`, `oauth_app.enabled`, `oauth_app.connected`, `oauth_app.disconnected`, `project.created`, `project.updated`, `project.deleted`, `project.deleted_all`, `asset.created`, `asset.updated`, `asset.deleted`, `asset.revalidated`, `asset.ownership_verified`, `asset.ownership_set`, `asset.scanners_changed`, `asset.deleted_all`, `discovery.run_started`, `discovery.hosts_added`, `discovery.host_ignored`, `discovery.host_restored`, `scan.started`, `scan.refused`, `scan.deleted`, `scan.deleted_all`, `schedule.created`, `schedule.updated`, `schedule.deleted`, `issue.status_changed`, `issue.resolved`, `issue.reopened`, `issue.in_progress`, `issue.dismissed`, `issue.undismissed`, `issue.assigned`, `issue.unassigned`, `issue.due_date_changed`, `issue.updated`, `issue.comment_added`, `issue.comment_edited`, `issue.comment_deleted`, `issue.opened`, `issue.auto_resolved`, `issue.auto_reopened`, `issue.severity_changed`, `issue.dismissal_expired`, `issue.created`, `issue.deleted`, `issue.deleted_all`, `finding.deleted`, `finding.deleted_all`, `assessment.generated`, `assessment.shared`, `assessment.share_revoked`, `assessment.deleted`, `ai.conversation_renamed`, `ai.conversation_deleted`, `ai.action_declined`, `billing.plan_chosen`, `billing.upgrade_requested`, `billing.change_scheduled`, `billing.change_cancelled`, `billing.cancelled`, `billing.resumed`, `billing.details_updated`, `billing.card_made_default`, `billing.card_removed`, `billing.plan_set`, `billing.discount_set`, `billing.limits_set`, `billing.invoice_created`, `billing.tax_set`, `billing.invoice_marked_paid`, `billing.invoice_voided`, `billing.receipt_resent`, `billing.unapplied_resolved`, `workspace.created`, `workspace.updated`, `workspace.suspended`, `workspace.reactivated`, `workspace.deleted`, `workspace.deleted_all`, `administrator.created`, `administrator.updated`, `administrator.deleted`, `scanner.updated`, `emerging_threat.released`, `ai_settings.updated`, `ai_logs.cleared`, `scanner_logs.cleared`, `service_logs.cleared`, `ticket.updated`, `ticket.deleted`, `blog.post_created`, `blog.post_updated`, `blog.post_deleted`, `blog.posts_deleted_all`, `blog.image_uploaded`, `integration.connected`, `integration.updated`, `integration.route_created`, `integration.route_updated`, `integration.route_deleted`, `integration.tested`, `integration.paused`, `integration.resumed`, `integration.reconnect_needed`, `integration.reconnected`, `integration.disconnected`, `integration.delivery_resent`, `integration.issues_sent`, `integration.identity_linked`, `integration.identity_unlinked`, `integration.ticket_created`, `integration.ticket_linked`, `integration.ticket_unlinked`, `integration.ticket_closed`, `integration.ticket_reopened`, `issue.fix_reported`, `audit.exported`.
- `actor` (query, string)
- `hideAutomatic` (query, string) One of: `true`, `false`.
- `targetType` (query, string)
- `targetId` (query, string)
- `from` (query, string)
- `to` (query, string)
- `q` (query, string)

## Example

```bash
curl -X GET "https://api.fortwatch.ai/app/audit-log" \
  -H "Authorization: Bearer $FORTWATCH_API_KEY"
```

## Response 200

The request succeeded.

- `items` (object[], required)
  - `id` (number, required)
  - `createdAt` (string (date-time), required)
  - `action` (string, required): The catalogue action, e.g. asset.deleted
  - `category` (string, required)
  - `categoryLabel` (string, required)
  - `summary` (string, required): The sentence after the actor's label: "deleted asset api.example.com"
  - `actor` (object, required)
    - `type` (string, required) One of: `user`, `admin`, `system`, `anonymous`.
    - `id` (number | null, required)
    - `name` (string | null, required)
    - `email` (string | null, required)
    - `label` (string, required)
  - `source` (string, required) One of: `app`, `management`, `ai_agent`, `public`, `worker`, `api`, `oauth`.
  - `viaAi` (boolean, required): Done by FortWatch AI for the actor (source ai_agent)
  - `via` (object, required)
    - `type` (string, required) One of: `api_key`, `oauth_app`.
    - `id` (number | null, required)
    - `name` (string | null, required)
  - `target` (object, required)
    - `type` (string | null, required)
    - `id` (string | null, required)
    - `label` (string | null, required)
  - `changes` (object | null, required): { field: [before, after] }
  - `metadata` (object | null, required)
  - `ip` (string | null, required)
  - `userAgent` (string | null, required)
- `total` (number, required)

```json
{
  "items": [
    {
      "id": 42,
      "createdAt": "2026-10-16T12:00:00.000Z",
      "action": "string",
      "category": "string",
      "categoryLabel": "string",
      "summary": "string",
      "actor": {
        "type": "user",
        "id": null,
        "name": null,
        "email": null,
        "label": null
      },
      "source": "app",
      "viaAi": true,
      "via": {
        "type": "api_key",
        "id": null,
        "name": null
      },
      "target": {
        "type": null,
        "id": null,
        "label": null
      },
      "changes": {},
      "metadata": {},
      "ip": "string",
      "userAgent": "string"
    }
  ],
  "total": 1
}
```

## Errors

- 400: The request is not valid: a field is missing or has the wrong shape (the message names it).
- 401: No valid credentials: the API key or access token is missing, revoked or expired (INVALID_API_KEY, INVALID_TOKEN).
- 403: Not allowed: the key or token lacks this scope (SCOPE_REQUIRED), the route is dashboard-only (SESSION_REQUIRED), or a plan limit applies.
- 429: Too many requests (RATE_LIMITED): wait the seconds Retry-After gives.