GET /v1/console/orgs/{org_id}/audit

Call	GET /v1/console/orgs/{org_id}/audit
Price	free
Scope	console session cookie (not an API key)
Operation id	listConsoleAudit

What it does

The organization’s append-only audit log, newest first, exactly as GET /v1/audit returns it to a key with account:read. In the console it is limited to owners and admins (ADR-0010). Roles: owner, admin (checked server-side). When the user has TOTP on, the session must have passed POST /v1/console/totp/verify; an owner of an organization with more than one member must have TOTP on (spec 9.1), otherwise 403.

Example request

Copy it as curl. Set VERDICT_API_KEY first; uuidgen makes a fresh Idempotency-Key.

Request

curl -X GET 'https://api.askverdict.io/v1/console/orgs/org_01JC3Z4Y8R9K2M5N7P1Q3S5T7V/audit' \
  --cookie "verdict_session=$VERDICT_SESSION"

Example response

200: A page of audit entries.

200 response

{
  "data": [
    {
      "id": "aud_01JC3Z4Y8R9K2M5N7P1Q3S5T7V",
      "action": "key_rotated",
      "actor": {
        "kind": "user",
        "id": "usr_01JC3Z4Y8R9K2M5N7P1Q3S5T7V",
        "role": "owner"
      },
      "target": {
        "type": "key",
        "id": "key_01JC3Z4Y8R9K2M5N7P1Q3S5T7V"
      },
      "ip": "203.0.113.7",
      "metadata": {
        "grace_period_hours": 24
      },
      "created_at": "2026-11-07T14:30:00Z"
    }
  ],
  "next_cursor": null,
  "has_more": false
}

Parameters

Name	In	Type	Required	Description
org_id	path	string	yes	The organization.
cursor	query	string	no	Opaque cursor from the next_cursor of the previous page. Omit it for the first page.
limit	query	integer	no	Page size, 1 to 200. Default 50.
action	query	enum (21 values)	no	Only this action.
from	query	string (date-time)	no	Only entries at or after this time.
to	query	string (date-time)	no	Only entries before this time.
x-verdict-version	header	string	no	API version to use, a date. Defaults to the version current when the key was created. The current version is 2026-11-01.

Response fields (200)

Field	Type	Required	Description
data	array of AuditEntry	yes	Audit entries, newest first.
data[].id	string	yes	The audit entry id.
data[].action	enum (21 values)	yes	What happened.
data[].actor	object	yes	Who did it.
data[].actor.kind	enum: “user”, “key”, “system”	yes	Kind of actor.
data[].actor.id	string or string or null	yes	The usr_ or key_ id, or null for system.
data[].actor.role	enum: “owner”, “admin”, “developer”, “billing”, “read_only”, null	yes	The user’s role at the time, for user actors.
data[].target	object or null	yes	What it was done to, if a single resource.
data[].target.type	string	yes	Kind of resource, for example key or icp.
data[].target.id	string	yes	The resource id.
data[].ip	string or null	yes	Client IP address, if the action came over the network.
data[].metadata	object	yes	Action details (for example old and new scopes). Never secrets.
data[].created_at	string (date-time)	yes	When it happened.
next_cursor	string or null	yes	Pass as cursor to fetch the next page. null when this is the last page.
has_more	boolean	yes	Whether another page follows.

Errors

Errors are RFC 9457 problem details and are never billed. Branch on type. See Errors.

Status	Meaning
400	Invalid request: malformed JSON, an unknown field, a failed constraint or a size limit (invalid_request).
401	Missing, malformed, revoked or expired API key, or a bad webhook signature (unauthorized).
403	The key lacks the scope this operation needs (forbidden_scope).
404	The resource does not exist in this organization (not_found).
429	Rate limited (rate_limited). Wait Retry-After seconds.
500	Unexpected server error (internal). Not billed; retry with the same Idempotency-Key.

Try it

Open the interactive reference to send this request from the browser. The full document is at /openapi.json.