# Audit log

> Read the audit log of your organization, every change made through the API, the dashboard, the CLI or MCP.

The audit log records every change to the organization, whoever made it and through whichever interface. Entries are listed newest first.

| Operation | Endpoint |
|---|---|
| [List audit log](https://developers.openwaf.dev/api/audit/#list-audit) | `GET /v1/orgs/{org}/audit` |

## List audit log

```http
GET /v1/orgs/{org}/audit
```

Lists the audit log of the organization, newest first. Page with `before` set to the `id` of the last entry received.

**Required role:** `admin` or higher. Organization-wide. A `tech` member or token limited to a client reads the entries of its client's zones.

#### Parameters

| Name | In | Type | Required | Description |
|---|---|---|---|---|
| `org` | path | string (uuid) | Yes | Organization id. Every route checks that it is the token's organization (otherwise `404`). |
| `limit` | query | integer | No | Maximum number of items. Default `100`. From 1 to 500. |
| `before` | query | integer | No | Pagination: id of the last entry seen. |

#### Response

- `200`: Returns `items`, an array of [AuditEntry](https://developers.openwaf.dev/api/schemas/#audit-entry).

| Field | Type | Description |
|---|---|---|
| `items[].id` | integer | Id. |
| `items[].org_id` | string (uuid) | Organization id. |
| `items[].actor` | string | Who made the change: a token, a user or OpenWAF. |
| `items[].action` | string |  |
| `items[].target` | string | Target of the action. |
| `items[].data` | object | Details of the change. |
| `items[].at` | string (date-time) | Time of the entry. |

#### Example

**curl**


```sh
curl "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/audit?limit=50" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"
```

**TypeScript**


```ts
import { OpenWAF } from "./openwaf";

const owf = new OpenWAF({ baseUrl: "https://dash.openwaf.dev" }); // token from OPENWAF_TOKEN
const result = await owf.listAudit({
  limit: 50
});
```

**Python**


```py
from openwaf import OpenWAF

owf = OpenWAF(base_url="https://dash.openwaf.dev")  # token from OPENWAF_TOKEN
result = owf.list_audit(limit=50)
```



```json
{
  "items": [
    {
      "id": 48213,
      "org_id": "1e7c9a3b-5d2f-4b8a-9c6e-0f2a4b6c8d1e",
      "actor": "token:11111111-2222-4333-8444-555555555555",
      "action": "record.update",
      "target": "0c9a7e4d-2b1f-4e6a-8d3c-5f7b9a1c3e5d",
      "data": {
        "zone": "example.com",
        "name": "www.example.com",
        "reason": "Point www at the new origin"
      },
      "at": "2026-10-27T09:30:00Z"
    }
  ]
}
```