FurniOpsDocs
API referenceAudit

List audit events

The organisation's audit timeline, newest first: what members, API keys, connected apps and FurniOps staff did, from sign-in policy to API keys and data operations. Filter by action, actor or time (since, until). Addresses are shown as a /24 or /48 prefix only. FurniOps AI acting for a member is the actor agent assistant with on_behalf_of the member. FurniOps staff acting through support access are the actor staff, with the member in data.acting_for and the grant in data.support_grant; data.agent.conversation_id names the assistant conversation when FurniOps AI made the change.

  • Scopesaudit:read
  • Rate classread
GET/v1/audit-events

The organisation's audit timeline, newest first: what members, API keys, connected apps and FurniOps staff did, from sign-in policy to API keys and data operations. Filter by action, actor or time (since, until). Addresses are shown as a /24 or /48 prefix only. FurniOps AI acting for a member is the actor agent assistant with on_behalf_of the member. FurniOps staff acting through support access are the actor staff, with the member in data.acting_for and the grant in data.support_grant; data.agent.conversation_id names the assistant conversation when FurniOps AI made the change.

Authorization

apiKey
AuthorizationBearer <token>

An API key (fo_live_… / fo_test_…) as a bearer token

In: header

Query Parameters

limit?integer

Page size

Range1 <= value <= 100
Default20
starting_after?string

Opaque position returned by a previous page

Match^[A-Za-z0-9_-]{1,512}$
ending_before?string

Opaque position returned by a previous page

Match^[A-Za-z0-9_-]{1,512}$
action?string

What happened: <object>.<past-tense verb>

Match^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$
Lengthlength <= 100
actor?string

Only entries by this actor (a public ID or client ID)

Length1 <= length <= 200
since?string

Only entries made at or after this

Match^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
Formatdate-time
until?string

Only entries made before this

Match^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z))$
Formatdate-time

Header Parameters

FurniOps-Version?string

Dated API version; pinned per organisation on first use and overridable per request

Value in

  • "2026-10-01"
  • "2026-10-04"
FurniOps-Mode?string

The data the request acts on: test is the organisation's sandbox. An OAuth token picks it (live by default); an API key's mode is fixed, and naming the other one is refused

Value in

  • "live"
  • "test"
If-None-Match?string

ETag of a cached representation; a match returns 304

Response Body

application/json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

application/problem+json

curl -X GET "https://example.com/v1/audit-events"
{  "object": "list",  "data": [    {      "object": "audit_event",      "id": "string",      "action": "string",      "actor": {        "kind": "user",        "id": "string",        "on_behalf_of": null      },      "target": {        "type": "string",        "id": "string"      },      "ip": "string",      "user_agent": "string",      "request_id": "string",      "data": {        "property1": null,        "property2": null      },      "created_at": "2019-08-24T14:15:22Z",      "source": "identity",      "undo": {        "kind": "inverse",        "available": true,        "unavailable_reason": "undone",        "expires_at": "2019-08-24T14:15:22Z"      },      "undo_of": "string"    }  ],  "has_more": true,  "next_cursor": "string"}

List request logs GET

The organisation's API requests in the request's mode (live or test), newest first, kept 31 days: who called what and the answer. Filter by status class, method, actor, path prefix or time. A request appears within seconds; reading the logs is not logged.

Undo an audited change POST

Puts back the change an audit entry records, by running the operation that undoes it as you: besides `audit:write`, you need the permission and scopes that operation needs, and the undo is recorded with `undo_of`. An entry's `undo` says whether it can be undone. A target changed since, or an entry already undone, answers 409; a change that cannot be undone, or older than 30 days, answers 422. So an undo never runs twice: a retry answers 409. To redo the change, undo the undo's own entry. An entry identity recorded (`source: identity`) answers 422 here: undo it with identity's `POST /v1/org/audit-events/{id}/undo`. With `FurniOps-Dry-Run` the undo is previewed.