Who can use this: Any signed-in accountAs Markdown
Sign-ins and changes made through the fleet's services: ending a session, blocking an address, deleting a file, sending mail through this API and so on. Looking at things isn't recorded. Each entry says what was done (action), to what (resource_type, resource_id), by which service, and from which network address and program. At most 500 entries come back.
Parameters
Name
Where
What it is
user
query
Only entries this account did. Anyone but yourself needs the audit.view permission.
affecting
query
Only entries that touched this account, including what a site admin did to it. Anyone but yourself needs the audit.view permission.
since
query
Only entries at or after this time, such as 2026-11-01 or 2026-11-01 16:00:00-06.e.g. 2026-11-01
until
query
Only entries at or before this time, written the same way.
action
query
Only entries with this action, such as auth.login or file.delete.
Good to know
Asking for someone else's entries without the audit.view permission answers 403.
With audit.view and neither user nor affecting, you see everyone's entries.
