List the workspace's audit log
Returns the security audit log for the caller's workspace — who did what, through which surface, and whether it succeeded — newest first. Only workspace admins see entries; a non-admin receives an empty page. The workspace is resolved from the request: an API key uses its own workspace; a user token selects one via the Passo-Workspace header. Each entry has actorType (customer — a workspace user; vendor — Passo staff acting via a support grant or admin tool; system — an automated action), actorUserId, actorDisplayName (resolved where known, including former members), supportGrantReason (for a vendor row, the reason the staff access was granted), action (a namespaced verb, e.g. "workspace_user.removed"), objectType/objectId (the target), success, channel and redacted metadata. Optional filters: actorId (one user's actions), action (one exact verb), from/to (inclusive ISO-8601 bounds on the time). Paginate with limit (default 50, max 200; a larger value is clamped, not rejected) and either offset or the opaque cursor from a previous page's nextCursor (null on the last page). total is the unpaginated count.
A Supabase-issued OAuth user access token. On collection endpoints, pair with a Passo-Workspace header to pick a workspace.
In: header
Header Parameters
The workspace's public id (e.g. wsp_abc) to operate in. OAuth callers with more than one workspace must send it; a single-workspace caller may omit it. Ignored for API keys (the key is pinned to its workspace). A uuid or another resource's id is rejected with a 400.
^wsp_Response Body
application/json
curl -X GET "https://example.com/audit"{ "entries": [ { "id": "string", "createdAt": "string", "actorType": "customer", "actorUserId": "string", "actorDisplayName": "string", "supportGrantReason": "string", "action": "string", "objectType": "string", "objectId": "string", "success": true, "channel": "dashboard", "metadata": null } ], "total": -9007199254740991, "limit": -9007199254740991, "offset": -9007199254740991, "nextCursor": "string"}