# API: Audit log

| Method | Path | What it does | Scope |
|---|---|---|---|
| GET | `/v1/audit-logs` | Every query and action in the organization, newest first (owner) | `audit:read` |
| GET | `/v1/audit-logs/export` | The audit log for a period (at most a year), 10,000 entries a page (pass next_cursor for the next), each entry with its place in the hash chain and whether it checks out (owner; JSONL or CSV) | `audit:read` |
| GET | `/v1/compliance/reports/:kind` | A report for auditors over a period: access changes, administrative changes, agent actions or data exports, with totals by action and actor (owner; JSON, JSONL or CSV) | `audit:read` |
| GET | `/v1/credential-uses` | Each use of a connected account's stored credentials: which connection, for which request or job, by which person, key, app or agent, newest first (owner) | `audit:read` |

## Examples

### GET /v1/audit-logs

Every query and action in the organization, newest first (owner)

```bash
curl -s "https://api.closefinch.com/v1/audit-logs" \
  -H "Authorization: Bearer $RA_API_KEY"
```

```js
const res = await fetch(`https://api.closefinch.com/v1/audit-logs`, {
  method: "GET",
  headers: { authorization: `Bearer ${process.env.RA_API_KEY}` },
});
const data = await res.json();
```

### GET /v1/audit-logs/export

The audit log for a period (at most a year), 10,000 entries a page (pass next_cursor for the next), each entry with its place in the hash chain and whether it checks out (owner; JSONL or CSV)

```bash
curl -s "https://api.closefinch.com/v1/audit-logs/export" \
  -H "Authorization: Bearer $RA_API_KEY"
```

```js
const res = await fetch(`https://api.closefinch.com/v1/audit-logs/export`, {
  method: "GET",
  headers: { authorization: `Bearer ${process.env.RA_API_KEY}` },
});
const data = await res.json();
```

### GET /v1/compliance/reports/$KIND

A report for auditors over a period: access changes, administrative changes, agent actions or data exports, with totals by action and actor (owner; JSON, JSONL or CSV)

```bash
curl -s "https://api.closefinch.com/v1/compliance/reports/$KIND" \
  -H "Authorization: Bearer $RA_API_KEY"
```

```js
const res = await fetch(`https://api.closefinch.com/v1/compliance/reports/${kind}`, {
  method: "GET",
  headers: { authorization: `Bearer ${process.env.RA_API_KEY}` },
});
const data = await res.json();
```

### GET /v1/credential-uses

Each use of a connected account's stored credentials: which connection, for which request or job, by which person, key, app or agent, newest first (owner)

```bash
curl -s "https://api.closefinch.com/v1/credential-uses" \
  -H "Authorization: Bearer $RA_API_KEY"
```

```js
const res = await fetch(`https://api.closefinch.com/v1/credential-uses`, {
  method: "GET",
  headers: { authorization: `Bearer ${process.env.RA_API_KEY}` },
});
const data = await res.json();
```

Request and response schemas: [https://www.closefinch.com/openapi.json](https://www.closefinch.com/openapi.json). All resources: [API reference](https://www.closefinch.com/docs/api).