A valid request URL is required to generate request examples{
"events": [
{
"id": "…",
"sequence": 4821,
"type": "member.role_changed",
"actor": {
"kind": "user",
"user_id": "…",
"email": "ana@acme.dev",
"ip": "203.0.113.7",
"user_agent": "Mozilla/5.0 …"
},
"target": {
"type": "membership",
"id": "…"
},
"payload": {
"role_id": "…",
"changed_by": "…"
},
"occurred_at": "2026-07-29T14:02:11Z"
}
],
"has_more": false,
"window_days": 30
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Read the staff audit trail
Requires audit:read. What staff did inside this organization, newest first: who acted, what they did, which object they did it to, when, and from where.
Entries come from the platform’s internal event bus rather than from each endpoint writing its own, which has two consequences worth knowing. An action is recorded a moment after it succeeds, never during the request that performed it. And the trail is append-only: no endpoint edits or removes an entry, and neither does anything else.
Recording is never conditional on a plan, and neither is keeping: every organization’s trail is retained for the same period. What a plan changes is how far back this read looks, reported as window_days — so entries beyond it are hidden rather than deleted, and a plan that lengthens the window shows the history that was always there.
A valid request URL is required to generate request examples{
"events": [
{
"id": "…",
"sequence": 4821,
"type": "member.role_changed",
"actor": {
"kind": "user",
"user_id": "…",
"email": "ana@acme.dev",
"ip": "203.0.113.7",
"user_agent": "Mozilla/5.0 …"
},
"target": {
"type": "membership",
"id": "…"
},
"payload": {
"role_id": "…",
"changed_by": "…"
},
"occurred_at": "2026-07-29T14:02:11Z"
}
],
"has_more": false,
"window_days": 30
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}{
"error": {
"code": "forbidden",
"message": "your role does not allow this action"
}
}Authorizations
A staff session token, uk_st_…. Minted by sign-up, sign-in or the two-factor exchange. Only a 401 means it is spent; not_a_member (403) is about the organization named in X-Organization-Id and leaves the token good for the others.
Headers
The organization the caller is acting on — the org_… code that appears in the panel URL. It identifies; the membership JOIN is what authorizes, so a forged code reads nothing: the answer is not_a_member (403), which does not mean the session is over. Absent, the session's default organization answers, or — if that membership was revoked while the session was open — any other one the caller still holds.
Query Parameters
The sequence of the oldest entry you already hold. Paging by sequence keeps a page stable while new actions land above it.
Response
One page of the trail, newest first.
Show child attributes
Show child attributes
Whether older entries exist below this page.
How far back this read looked, in days, as the plan allows. null means it looked through everything the trail still holds. Entries older than the window are retained and unreadable, never removed — the trail is kept for the same period on every plan.