Audit Logs API

The Audit Logs API returns the same activity as Audit logs in your workspace settings: who did what, and when, across apps, databases, workflows, agents and integrations. Use it to send the activity to a security tool (SIEM), keep your own archive, or get alerted when something changes, such as an app being published.

Base URL

https://studio-api.softr.io/v1/api

The Audit Logs API has its own base URL. It is not the Database API’s tables-api.softr.io.

Authentication

Pass a Personal Access Token in the Softr-Api-Key header, as with the Database API:

curl -X POST 'https://studio-api.softr.io/v1/api/workspaces/{workspaceId}/audit-logs/search' \
  -H 'Softr-Api-Key: <your-token>' \
  -H 'Content-Type: application/json' \
  -d '{}'

To create a token, open your Softr Dashboard, click your workspace name in the top-left corner, and go to API tokens. See API Setup and Endpoints for the steps.

The audit log covers the whole workspace, so the token needs read access to every product on the whole workspace:

• Choose Everything, or the workspace itself, not individual apps, databases or workflows.
• Set Applications & Forms and Workflows to at least Read only, and Databases to at least View only.

In scope terms, the token needs applications:read, databases.records:read and workflows:read on the whole workspace.

A token limited to individual resources is refused, because it would show only part of the activity. Legacy API keys are refused too.

The token acts as the user who created it. That user must be an owner or admin of the workspace.

Read the activity

Search Audit Logs returns the activity newest first, one page at a time. Every filter is optional:

curl -X POST 'https://studio-api.softr.io/v1/api/workspaces/{workspaceId}/audit-logs/search' \
  -H 'Softr-Api-Key: <your-token>' \
  -H 'Content-Type: application/json' \
  -d '{
    "entityTypes": ["APP"],
    "startDate": "2026-11-01T00:00:00Z",
    "size": 50
  }'

To find your workspace ID, call Get Databases. Each database in the response has a workspaceId.

Page through the results

Each response has entries, a cursor and hasMore:

1. Send your first request without a cursor.
2. While hasMore is true, send the same request again with the cursor from the last response.
3. When hasMore is false, you have read everything that matches. The cursor is then null.

Keep the filters the same while you page. A page holds at most 50 entries.

Poll for new activity

To collect new activity on a schedule, remember the createdAt of the newest entry you have stored. On the next run, send it as startDate and page until hasMore is false. startDate is inclusive, so skip the entries you already have by their id.

Entity types and actions

Each entry has an entityType and an action. The action names what happened. Some typical values:

Softr adds actions as products change. Do not fail on an action or entityType you do not know: store it, or skip it.

details holds extra information about the activity, such as what changed. Its shape depends on the action.

Errors

An error response has a code and a message that says what went wrong:

{
  "code": "Forbidden",
  "message": "Only workspace owners and admins can read the audit log."
}