Opbox
Sign inBook a demo

Audit Log API

Query the workspace audit log. Every state-changing operation across the platform is recorded with action, resource type, actor, IP address, and metadata. Overseers can query across subordinate workspaces.

Endpoints

MethodPathDescription
GET/api/auditList audit log entries

Query Parameters

ParameterTypeDefaultDescription
limitnumber50Records per page (1-100)
offsetnumber0Pagination offset
actionstring-Filter by action (e.g. CREATE, DELETE, APPROVE)
entityTypestring-Filter by resource type (e.g. FORM, TABLE, MATTER)
searchstring-Case-insensitive text search across action, resource, user name, and email
crossWorkspacebooleanfalseInclude subordinate workspace logs (overseer only)
excludeNoisybooleantrueExclude system events (page views, presence, favourites, emoji responses)

Example Response

{
  "logs": [
    {
      "id": "cm_audit_abc123",
      "action": "CREATE",
      "resource": "FORM",
      "resourceId": "cm_form_def456",
      "metadata": { "name": "Contact Us" },
      "ipAddress": "203.0.113.42",
      "userAgent": "Mozilla/5.0...",
      "createdAt": "2026-02-27T10:30:00.000Z",
      "user": {
        "name": "Will Lilley",
        "email": "will@example.com"
      },
      "organization": {
        "id": "cm_org_ghi789",
        "name": "Acme Corp"
      }
    }
  ],
  "pagination": {
    "total": 1234,
    "limit": 50,
    "offset": 0,
    "hasMore": true
  }
}

Common Action Values

The action field uses a mix of generic CRUD verbs and domain-specific identifiers. Common values:

ActionDescription
CREATE / UPDATE / DELETEStandard CRUD operations
ARCHIVE / RESTORESoft delete and recovery
APPROVE / REJECTApproval workflows
SHARE / SUBMITSharing and submissions
SYNC / TRIGGERPipelines and integrations
AI_CHAT_MESSAGEAI assistant interactions
addon.install / addon.uninstallAddon lifecycle

Common Resource Values

The resource field identifies what was acted on. Uses both SCREAMING_CASE and snake_case:

ResourceDescription
FORM, SUBMISSION, TABLECore data models
MATTER, MATTER_STEPMatter lifecycle
DOCUMENT, WORKFLOWKnowledge base and automations
table_row, table_columnTable sub-resources
INVOICE, DASHBOARDAccounting and reporting
EXTERNAL_CONNECTION, PIPELINE_RUNExternal integrations

Notes

  • Audit log entries are immutable during their retention period and cannot be deleted via the API.
  • The metadata field is automatically sanitised to redact sensitive values (passwords, tokens, API keys).
  • Cross-workspace queries require the calling user to have active oversight relationships.
  • The Settings UI at Settings -> Audit Log provides a human-readable view with filtering and search.
  • Retention: Audit logs are retained per workspace configuration (default 180 days). Five tiers available: Standard (180d), Extended (1yr), Finance (7yr), Legal (25yr), Indefinite. Configure at Settings -> Organisation -> Retention.
  • Archive-before-delete: Expired logs are archived to JSON (AuditArchive table) before deletion. Archives are retained indefinitely for compliance evidence.
  • Retention API: GET/PUT /api/organizations/[orgId]/audit-retention. See SSO & SCIM docs for full reference.