Activity log API

The activity log is a read-only record of changes made to your account: who did what, from where, and when. It is the trail behind the Activity tab in Account Settings.

Every request needs a bearer token and the audit:read permission.

List activity

GET /api/audit-logs?page=1&limit=20

Paginated, newest first. Returns the standard { data, total, page, limit, totalPages } envelope:

{
  "data": [
    {
      "id": "6a4d5b83b7006ccae6391850",
      "accountId": "6a4d5b83b7006ccae6391800",
      "userId": "6a4d5b83b7006ccae6391801",
      "username": "alice",
      "actorType": "user",
      "displayName": "Alice Smith",
      "method": "DELETE",
      "path": "/api/pods/:id",
      "params": { "id": "6a4d5b83b7006ccae6391810" },
      "status": 200,
      "ip": "203.0.113.7",
      "createdAt": "2026-07-16T14:02:11Z",
      "updatedAt": null
    },
    {
      "id": "6a4d5b83b7006ccae6391851",
      "accountId": "6a4d5b83b7006ccae6391800",
      "userId": "6a4d5b83b7006ccae6391801",
      "username": "api:ci-deploy",
      "actorType": "apikey",
      "displayName": "API key: ci-deploy",
      "method": "POST",
      "path": "/api/pods/",
      "params": {},
      "status": 201,
      "ip": "203.0.113.4",
      "createdAt": "2026-07-16T13:55:40Z",
      "updatedAt": null
    }
  ],
  "total": 214,
  "page": 1,
  "limit": 20,
  "totalPages": 11
}

Field	Meaning
actorType	Who acted: user (a person's session) or apikey (an API key or MCP client). A third value, system, is reserved for automated actions and is not written today
displayName	The friendly label the console shows: a person's full name, or API key: <name>
username	The account user behind the change. API-key callers are recorded as api:<key name>
method	HTTP method of the change
path	The route pattern, not the literal URL - /api/pods/:id, not /api/pods/6a4d5b83b7006ccae6391810
params	The path parameters filled in, so you can see which resource was touched
status	HTTP status the change returned
ip	Where the request came from
createdAt	When it happened

There is no search filter on this endpoint - page through and filter on your side. Entries are kept for 90 days, then age out.

What gets recorded

Only successful changes - a POST, PUT, PATCH or DELETE that returned below 400. Read-only requests (just looking) are not logged, and neither are failed attempts, so the log is a record of what happened rather than what was tried.

We record what was touched, never the contents: request bodies are not stored, so no passwords, keys, or payloads end up in the log. That is also why path and params are the only description of the target.

MCP tool calls

A mutating tool call through the automation endpoint lands in the same log, with the tool name in place of a route:

{
  "actorType": "apikey",
  "displayName": "API key: claude-desktop",
  "method": "POST",
  "path": "/mcp:create_snapshot",
  "params": { "podId": "6a4d5b83b7006ccae6391810" },
  "status": 200,
  "ip": "203.0.113.9"
}

Read-only tools are not logged, matching the rule for read-only REST calls.

Example

curl "https://cloud-api.microapps.io/api/audit-logs?page=1&limit=50" \
  -H "Authorization: Bearer $MICROAPPS_API_KEY"

Everything an API key did, across the last page:

curl -s "https://cloud-api.microapps.io/api/audit-logs?limit=100" \
  -H "Authorization: Bearer $MICROAPPS_API_KEY" \
  | jq '.data[] | select(.actorType == "apikey") | {displayName, method, path, createdAt}'

See also

• API keys
• User & account