# GET /v1/audit-log

> Every key use, settings change and approval answer, newest first.

In [Account API](https://vestra.ai/developers/reference/api/account.md): Your company's account: who is calling, its keys, its caps, what it spent and the models it may use.

Send `Authorization: Bearer vk_test_...` on every call.

Every key use, settings change and approval answer, newest first.

Your API key, scope `admin` or `all`. On the card: [`keys`](https://vestra.ai/developers/keys.md). Over HTTP it is made from the contract: fill in every value.

## Request

Query:

- `limit` (`integer`): How many items per page, 1 to 100. Default 20.
- `cursor` (`string`): Where to go on from: the `next_cursor` of the page before, unchanged. Absent: the first page.

## Answers 200

- `data` (`object[]`): The items on this page.
  - `id` (`string`): The entry's id.
  - `object` (`"audit_event"`): Always `audit_event`.
  - `mode` (`"live" | "test" | null`): The mode it happened in; null for a Vestra staff action on the company account.
  - `action` (`string`): What was done, such as `task.deleted` or `notebook.created`. Example: `task.deleted`.
  - `actor` (`object`): Who did it.
    - `kind` (`string`): Who did it: `key` (an API key), `console` (a person signed in), `client` (a session token) or `staff` (Vestra).
    - `id` (`string | null`): The key's id, the signed-in person's, or the session's; null when there is none to show.
  - `target` (`object`): What it was done to.
    - `type` (`string`): What kind of thing it was done to, such as `task`, `notebook` or `interaction`.
    - `id` (`string`): Its id.
  - `detail` (`map of any | null`): More about it, such as the fields that changed. It never holds a secret or a key; null when there is nothing more.
  - `created_at` (`string`): When it happened, as an ISO 8601 date and time in UTC.
- `next_cursor` (`string | null`): Send it as `cursor` for the next page; null on the last page.

## Code

**HTTP**

```bash
curl "$VESTRA_BASE_URL/v1/audit-log" \
  -H "Authorization: Bearer $VESTRA_API_KEY"
```

**TypeScript, Python, CLI, MCP**: No sample in your language for this route, so here it is over HTTP.