The audit log records every change to the organization, whoever made it and through whichever interface. Entries are listed newest first.
| Operation | Endpoint |
|---|---|
| List audit log | GET /v1/orgs/{org}/audit |
List audit log
GET /v1/orgs/{org}/auditLists the audit log of the organization, newest first. Page with before set to the id of the last entry received.
Required role: admin or higher. Organization-wide. A tech member or token limited to a client reads the entries of its client's zones.
Parameters
| Name | In | Type | Required | Description |
|---|---|---|---|---|
org | path | string (uuid) | Yes | Organization id. Every route checks that it is the token's organization (otherwise 404). |
limit | query | integer | No | Maximum number of items. Default 100. From 1 to 500. |
before | query | integer | No | Pagination: id of the last entry seen. |
Response
200: Returnsitems, an array of AuditEntry.
| Field | Type | Description |
|---|---|---|
items[].id | integer | Id. |
items[].org_id | string (uuid) | Organization id. |
items[].actor | string | Who made the change: a token, a user or OpenWAF. |
items[].action | string | |
items[].target | string | Target of the action. |
items[].data | object | Details of the change. |
items[].at | string (date-time) | Time of the entry. |
Example
curl "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/audit?limit=50" \
-H "Authorization: Bearer $OPENWAF_TOKEN"import { OpenWAF } from "./openwaf";
const owf = new OpenWAF({ baseUrl: "https://dash.openwaf.dev" }); // token from OPENWAF_TOKEN
const result = await owf.listAudit({
limit: 50
});from openwaf import OpenWAF
owf = OpenWAF(base_url="https://dash.openwaf.dev") # token from OPENWAF_TOKEN
result = owf.list_audit(limit=50)200
{
"items": [
{
"id": 48213,
"org_id": "1e7c9a3b-5d2f-4b8a-9c6e-0f2a4b6c8d1e",
"actor": "token:11111111-2222-4333-8444-555555555555",
"action": "record.update",
"target": "0c9a7e4d-2b1f-4e6a-8d3c-5f7b9a1c3e5d",
"data": {
"zone": "example.com",
"name": "www.example.com",
"reason": "Point www at the new origin"
},
"at": "2026-10-27T09:30:00Z"
}
]
}