Read the tenant's audit trail (audit.view)

GET 
/api/audit-logs

The tenant's append-only audit trail, newest first — who did what, including the two powers over customer-authored content: a deleted message (message.deleted, which carries the destroyed body because the row itself is gone) and a hidden or unhidden public comment (social_comment.hidden / social_comment.unhidden).

Read-only: the table is append-only and has no write or delete verb, so this grants sight of the record and no ability to shape it. Requires audit.view — held by admins, grantable per member, and deliberately NOT an agent or supervisor default, because part of what the trail records is an agent's own destructive actions.

Tenant isolation is enforced by the database (RLS), not by a query clause here.

Request

Responses

200

A page of audit rows.

401

Not authenticated. code: account_disabled means the member's seat was deactivated in this workspace: the session is over even though the token was not revoked (clients sign out and clean up).

403

Authenticated but not allowed.