List audit logs

curl --request GET \
  --url https://api.mobileboost.io/audit/logs \
  --header 'Authorization: Bearer <token>'

{
  "logs": [
    {
      "seq": "<string>",
      "timestamp": "2023-11-07T05:31:56Z",
      "created_at": "2023-11-07T05:31:56Z",
      "org_id": "<string>",
      "event_type": "<string>",
      "action": "<string>",
      "actor": {
        "uid": "<string>",
        "email": "<string>",
        "ip": "<string>",
        "user_agent": "<string>"
      },
      "target": {
        "type": "<string>",
        "id": "<string>",
        "name": "<string>"
      },
      "changes": [
        {
          "field": "<string>",
          "old": "<unknown>",
          "new": "<unknown>"
        }
      ],
      "source": "<string>",
      "metadata": {}
    }
  ],
  "next_cursor": "<string>"
}

Audit

List audit logs

Retrieve your organisation’s audit log events as a paginated, cursor-based stream. This endpoint is intended for SIEM ingestion, such as a Splunk REST or modular input. Poll with since=<next_cursor> from the previous response to fetch only new events.

Audit logging must be enabled for your organisation. If audit logging is not enabled, the endpoint returns 403. The organisation is derived from the API key which can be created in your organisations account.

Set the Accept header to application/x-ndjson to receive newline-delimited JSON instead of a single JSON object. In this mode, the next cursor is returned in the X-Next-Cursor response header rather than in a response field.

GET

audit

logs

List audit logs

curl --request GET \
  --url https://api.mobileboost.io/audit/logs \
  --header 'Authorization: Bearer <token>'

{
  "logs": [
    {
      "seq": "<string>",
      "timestamp": "2023-11-07T05:31:56Z",
      "created_at": "2023-11-07T05:31:56Z",
      "org_id": "<string>",
      "event_type": "<string>",
      "action": "<string>",
      "actor": {
        "uid": "<string>",
        "email": "<string>",
        "ip": "<string>",
        "user_agent": "<string>"
      },
      "target": {
        "type": "<string>",
        "id": "<string>",
        "name": "<string>"
      },
      "changes": [
        {
          "field": "<string>",
          "old": "<unknown>",
          "new": "<unknown>"
        }
      ],
      "source": "<string>",
      "metadata": {}
    }
  ],
  "next_cursor": "<string>"
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

since

string

Cursor: the next_cursor value from the previous response. Omit to start from the beginning of the retained log.

limit

integer

default:100

Maximum number of events to return (1-1000).

Required range: 1 <= x <= 1000

event_type

string

Exact match on event_type (e.g. test.updated, login.succeeded).

from

string<date-time>

ISO-8601 lower bound (inclusive) on created_at.

Example:

"2026-06-01T00:00:00Z"

string<date-time>

ISO-8601 upper bound (inclusive) on created_at.

actor

string

Substring match against the acting user's uid or email.

Response

Successful response

logs

object[]

Audit events, ordered oldest to newest.

Show child attributes

next_cursor

string | null

Pass as since to fetch the next page. null when the current page wasn't full (no more events yet).

Upload build