REST API: audit logs
Query the organization audit trail and its filter vocabularies.
The audit log records administrative and configuration changes across your organization: who made a change, what action they took, which resource it touched, and when. Use GET /audit-logs to query entries. Filter by action, resource type, or actor to narrow a large organization's history to the change you are investigating.
Narrow entries to a time window with startDate and endDate. A date-only endDate value (YYYY-MM-DD) includes the full UTC day, through its end. Timestamp inputs need an explicit time zone, such as Z or +05:30; epoch milliseconds, RFC 2822 dates, timestamps without a zone, and dates outside the years 0001 to 9999 return 400. A reversed date range, where startDate is after endDate, causes a validation error.
The three list endpoints for actions, resource types, and user emails do not return log entries. Each returns the distinct set of values currently present in your organization's log, so you can populate a filter control without guessing at a fixed vocabulary in advance. These lists reflect only values that have actually occurred, so a brand-new action or resource type appears only after the first matching event is logged.
Treat the audit log as an investigation and compliance tool, not an application data source. Do not build a feature that depends on every historical action remaining queryable forever, and do not use the audit log as a substitute for your own application-level event tracking. Pull entries into your own long-term store if you need retention beyond what AgentStack guarantees.
Audit-log access is an organization-administration capability. Scope any integration that reads this endpoint as narrowly as the rest of your admin tooling. The audit-log endpoints need an Enterprise plan. On any other plan, each one is refused with 402 and the error code FEATURE_NOT_AVAILABLE.