---
title: List Audit Entries
protocol: rest
method: GET
endpoint: /v1/projects/{projectId}/audit-log
description: "Retrieve the audit trail of actions taken in a project"
---

# List Audit Entries

Returns a paginated, newest-first list of audit entries for a project. Every state-changing action taken through the dashboard or API — settings updates, API key lifecycle events, custom domain changes, manual build triggers, audience profile changes, and webhook endpoint changes — is recorded automatically.

<Endpoint method="GET" path="/v1/projects/{projectId}/audit-log" />

## Path Parameters

<ParamField path="projectId" type="string" required>
  The project to read audit entries for. The caller must be a member of the organization that owns the project.
</ParamField>

## Query Parameters

<ParamField query="page" type="integer" default="1">
  Page number for pagination.
</ParamField>

<ParamField query="limit" type="integer" default="50">
  Number of entries per page. Maximum: `100`.
</ParamField>

<ParamField query="actor" type="string">
  Filter by actor email (case-insensitive substring match), e.g. `jane@`.
</ParamField>

<ParamField query="resource" type="string">
  Filter by resource type. One of: `settings`, `build`, `domain`, `api_key`, `webhook`, `audience`.
</ParamField>

## Response

<ResponseField name="data" type="array">
  Array of audit entry objects.

  <Expandable title="Audit entry object">
    <ResponseField name="id" type="string">
      Unique audit entry identifier.
    </ResponseField>

    <ResponseField name="action" type="string">
      What happened, e.g. `settings.updated`, `api_key.created`, `domain.removed`, `build.triggered`.
    </ResponseField>

    <ResponseField name="actor" type="object">
      Who performed the action: `id`, `name`, and `email`. Fields are empty strings when the actor account was deleted.
    </ResponseField>

    <ResponseField name="resource" type="object">
      What was acted on: `type`, `id`, and an optional human-readable `name` (e.g. the domain or API key name).
    </ResponseField>

    <ResponseField name="metadata" type="object">
      Action-specific details, such as the fields changed in a settings update.
    </ResponseField>

    <ResponseField name="createdAt" type="string">
      ISO 8601 timestamp of when the action happened.
    </ResponseField>
  </Expandable>
</ResponseField>

<ResponseField name="hasMore" type="boolean">
  `true` when more pages are available.
</ResponseField>

## Example Request

```bash
curl "https://api.syntext.dev/v1/projects/prj_abc123/audit-log?resource=api_key&limit=25" \
  -H "Authorization: Bearer $SYNTEXT_TOKEN"
```

## Example Response

```json
{
  "data": [
    {
      "id": "log_9f2c1e",
      "action": "api_key.created",
      "actor": { "id": "usr_1", "name": "Jane Doe", "email": "jane@example.com" },
      "resource": { "type": "api_key", "id": "key_42", "name": "CI Key" },
      "metadata": { "name": "CI Key", "scope": "build" },
      "createdAt": "2026-07-12T09:30:00.000Z"
    }
  ],
  "hasMore": false
}
```

## Recorded Actions

| Action | Resource type | When |
|---|---|---|
| `settings.updated` | `settings` | Project settings changed |
| `project.deleted` | `settings` | Project deleted |
| `api_key.created` / `api_key.rotated` / `api_key.revoked` | `api_key` | API key lifecycle |
| `domain.added` / `domain.removed` | `domain` | Custom domain changes |
| `build.triggered` | `build` | Manual build trigger |
| `audience.created` / `audience.updated` / `audience.deleted` | `audience` | Audience profile changes |
| `webhook.created` / `webhook.deleted` | `webhook` | Webhook endpoint changes |