--- title: "Audit Logs API" description: "Read the activity of your workspace from your own tools, for compliance reviews, security monitoring or alerts." canonical: "https://docs.softr.io/softr-api/audit-logs-api" updated: "2026-11-06" --- # Audit Logs API The Audit Logs API returns the same activity as **Audit logs** in your workspace settings: who did what, and when, across apps, databases, workflows, agents and integrations. Use it to send the activity to a security tool (SIEM), keep your own archive, or get alerted when something changes, such as an app being published. > **Info** > > The Audit Logs API is available on the Enterprise plan. Only workspace owners and admins can use it. ## Base URL ``` https://studio-api.softr.io/v1/api ``` The Audit Logs API has its own base URL. It is not the Database API's `tables-api.softr.io`. ## Authentication Pass a **Personal Access Token** in the `Softr-Api-Key` header, as with the Database API: ```bash curl -X POST 'https://studio-api.softr.io/v1/api/workspaces/{workspaceId}/audit-logs/search' \ -H 'Softr-Api-Key: ' \ -H 'Content-Type: application/json' \ -d '{}' ``` To create a token, open your Softr [Dashboard](https://studio.softr.io/dashboard), click your workspace name in the top-left corner, and go to **API tokens**. See [API Setup and Endpoints](/softr-api/api-setup-and-endpoints) for the steps. The audit log covers the whole workspace, so the token needs read access to every product on the whole workspace: - Choose **Everything**, or the workspace itself, not individual apps, databases or workflows. - Set **Applications & Forms** and **Workflows** to at least **Read only**, and **Databases** to at least **View only**. In scope terms, the token needs `applications:read`, `databases.records:read` and `workflows:read` on the whole workspace. A token limited to individual resources is refused, because it would show only part of the activity. Legacy API keys are refused too. The token acts as the user who created it. That user must be an owner or admin of the workspace. ## Read the activity [Search Audit Logs](/softr-api/audit-logs-api/search-audit-logs) returns the activity newest first, one page at a time. Every filter is optional: ```bash curl -X POST 'https://studio-api.softr.io/v1/api/workspaces/{workspaceId}/audit-logs/search' \ -H 'Softr-Api-Key: ' \ -H 'Content-Type: application/json' \ -d '{ "entityTypes": ["APP"], "startDate": "2026-11-01T00:00:00Z", "size": 50 }' ``` To find your workspace ID, call [Get Databases](/softr-api/softr-database-api/databases/get-databases). Each database in the response has a `workspaceId`. ### Page through the results Each response has `entries`, a `cursor` and `hasMore`: 1. Send your first request without a `cursor`. 2. While `hasMore` is `true`, send the same request again with the `cursor` from the last response. 3. When `hasMore` is `false`, you have read everything that matches. The `cursor` is then `null`. Keep the filters the same while you page. A page holds at most 50 entries. ### Poll for new activity To collect new activity on a schedule, remember the `createdAt` of the newest entry you have stored. On the next run, send it as `startDate` and page until `hasMore` is `false`. `startDate` is inclusive, so skip the entries you already have by their `id`. ## Entity types and actions Each entry has an `entityType` and an `action`. The `action` names what happened. Some typical values: | `entityType` | What it covers | Example actions | | ------------- | ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------- | | `APP` | Apps, their pages, blocks, settings, users and collaborators | `CREATE_APP`, `APP_PUBLISHED`, `PAGE_ADDED`, `BLOCK_UPDATED`, `COLLABORATOR_ADDED`, `APPLICATION_USER_REMOVED` | | `DATABASE` | Softr Databases, their tables, views and fields | `TABLESPACE_CREATED`, `TABLE_DELETED`, `FIELD_UPDATED`, `RECORD_DELETED` | | `WORKFLOW` | Workflows, their triggers and actions | `WORKFLOW_CREATED`, `WORKFLOW_ENABLED`, `WORKFLOW_AUTO_DISABLED`, `ACTION_UPDATED` | | `AGENT` | Agents, their knowledge sources, actions and triggers | `AGENT_CREATED`, `AGENT_DISABLED`, `KNOWLEDGE_SOURCE_ADDED` | | `INTEGRATION` | Data source connections of the workspace | `INTEGRATION_CREATED`, `INTEGRATION_UPDATED`, `INTEGRATION_DELETED` | | `WORKSPACE` | The workspace itself | `WORKSPACE_OWNER_ADDED`, `WORKSPACE_OWNER_REMOVED` | Softr adds actions as products change. Do not fail on an `action` or `entityType` you do not know: store it, or skip it. `details` holds extra information about the activity, such as what changed. Its shape depends on the action. ## Errors An error response has a `code` and a `message` that says what went wrong: ```json { "code": "Forbidden", "message": "Only workspace owners and admins can read the audit log." } ``` | Status | Meaning | What to do | | ------ | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | `400` | The request body is invalid, for example an unknown entity type | Fix the request | | `401` | The `Softr-Api-Key` header is missing, or the token is unknown, revoked or expired | Check the token | | `403` | The token or its user cannot read this audit log. The message says why | Use a token with the access above, created by an owner or admin, on an Enterprise workspace | | `429` | Too many requests | Wait a moment, then retry | | `503` | Part of the activity is temporarily unavailable | Retry the same request with the same `cursor` |