Skip to content

Query the audit log

GET
/v1/audit
curl --request GET \
--url http://localhost:8080/v1/audit

Paged (page, size up to 200, default 50) audit view in the { items, page, size, total } envelope. source=data (default) returns row-level changes recorded by Tuxedo.Auditor; filter by table, entityId and actor; with before/after values and changed columns. source=auth returns authentication and MCP events (sign-ins and failures, token refresh and revocation, API-key issue and revocation, role changes, MCP tool calls); filter by eventType and userId. Admin or manager.

source
string
table
string
entityId
string
actor
string
eventType
string
userId
string format: uuid
page
integer | string format: int32
/^-?(?:0|[1-9]\d*)$/
size
integer | string format: int32
/^-?(?:0|[1-9]\d*)$/

OK

Media typeapplication/json

Page envelope: { items, page, size, total }.

object
items
required
Array<object>

One row of the combined audit view: data (Tuxedo.Auditor row-level changes) or auth (sign-ins, API-key use, MCP calls).

object
id
required
integer | string format: int64
/^-?(?:0|[1-9]\d*)$/
source
required
string
eventType
required
string
table
required
null | string
entityId
required
null | string
actor
required
null | string
at
required
string format: date-time
detail
required
One of:
null
before
required
One of:
null
after
required
One of:
null
changedColumns
required
Array<string>
page
required
integer | string format: int32
/^-?(?:0|[1-9]\d*)$/
size
required
integer | string format: int32
/^-?(?:0|[1-9]\d*)$/
total
required
integer | string format: int32
/^-?(?:0|[1-9]\d*)$/
hasNext
boolean
Examplegenerated
{
"items": [
{
"id": 1,
"source": "example",
"eventType": "example",
"table": "example",
"entityId": "example",
"actor": "example",
"at": "2026-04-15T12:00:00Z",
"detail": "example",
"before": "example",
"after": "example",
"changedColumns": [
"example"
]
}
],
"page": 1,
"size": 1,
"total": 1,
"hasNext": true
}