API reference

API reference: Audit

Cloud Control audit API: read your organization's own audit trail — actor, action, detail, IP and timestamp — always scoped to the caller's org, via session or Bearer token.

Read your organization's audit trail. Events are always limited to the caller's org.

GET/api/auditSession or Bearer

List recent audit events for your org.

Parameters

Name	In	Required	Description
`limit`	query	no	1–500 (default 100).

Example response

json

{ "events": [ { "id": 991, "action": "auth.login", "detail": "ada.lovelace@example.com",
  "ip": "203.0.113.4", "actorName": "Ada Lovelace", "actorEmail": "ada.lovelace@example.com",
  "createdAt": "2026-07-18T22:03:00.000Z" } ] }

Errors

Status	When
`400`	limit out of 1–500.
`401`	Not signed in / invalid token.

Actions follow an auth.* / org.* / cloud.* / finops.* / admin.* naming scheme — for example auth.login, auth.login_locked, org.user_added, org.ownership_transferred, cloud.account_created, cloud.rbac_denied, finops.anomaly_detected, admin.org_status_changed.