Audit log API

Lists the project's configuration changes, newest first: who changed what, when, from which surface, with the field-level before and after, kept 400 days on every plan.

Filter by actor (id), actor_kind, source, resource_type and resource_id, action (exact, or a prefix when it ends in *), field (a JSON Pointer prefix such as /label) and a since/until window; page with cursor. format csv, xlsx or pdf writes the filtered log through the report renderer as a file (one row per changed field, oldest first, the last 30 days unless since says otherwise, the chain head and retention floor in the file so it is an anchor for audit verify).

Secrets (tokens, keys, passwords, webhook and source credentials) are shown as (redacted); every other value is the stored value. Entries are written by the services in the transaction that makes the change; nothing writes, updates or deletes an entry.

Needs the project capability; a dashboard session reads it as the project owner, an organization admin or a staff member shadowing the project. Reading and exporting the log is the audit log, which the Enterprise plan includes; a project whose plan lacks it is refused with feature_not_in_plan (402). Every plan records its changes.

The project's audit chain head (the last chained entry's seq and hash), the retention floor the chain starts from, and how many entries are waiting to be chained. Keep a head as an anchor and pass it to GET /api/audit/verify later to prove no history before it was rewritten or removed.

Part of the audit log, which the Enterprise plan includes; a project whose plan lacks it is refused with feature_not_in_plan (402).

Recomputes the audit hash chain over a range and reports what is wrong, if anything.

Every chained entry's hash is recomputed from its stored content, each entry must link to the one before it, seq must be contiguous from the retention floor, and the last entry must be the chain head. anchor (SEQ:HASH from an earlier export or head) additionally proves the entry at that seq is unchanged and the chain was not truncated below it.

A call checks at most 5000 entries; continue from next_seq with from_seq. Part of the audit log, which the Enterprise plan includes; a project whose plan lacks it is refused with feature_not_in_plan (402).

One audit entry with its field-level changes. Part of the audit log, which the Enterprise plan includes; a project whose plan lacks it is refused with feature_not_in_plan (402).