v1auth context
Audit
GET /v1/auth/audit-logs — what has happened on this account.
The audit log answers "what has happened on my own account": password changes, credential changes, sessions signed out, authorizations revoked, and the outcome and origin of each attempt.
Request
GET /v1/auth/audit-logs, session token, audience auth.
| Query | Type | Required | Notes |
|---|---|---|---|
limit | number | Optional | Default 20, max 100 |
cursor | string | Optional | next_cursor from the previous page |
Response
{
"success": true,
"entries": [
{
"id": "aud_...",
"action": "password.change",
"title": "Password changed",
"outcome": "success",
"ip": "203.0.113.7",
"country": "JP",
"user_agent": "Mozilla/5.0 ...",
"created_at": "2026-11-14T08:40:00.000Z"
}
],
"next_cursor": null
}| Field | Notes |
|---|---|
action | Machine-readable action identifier |
title / description | Display text derived from action |
outcome | Only success or failure |
ip / country / user_agent | Origin of this operation |
Failure reasons are not exposed
The server reports only success or failure, never the specific reason: that is an attack-surface map, of no help to the owner and of considerable help to an attacker.
Rules
| Rule | Notes |
|---|---|
| Session tokens only | An OAuth client has no business reading where and when the user changed a password elsewhere |
| Read-only, no step-up | Reading your own log destroys nothing; adding max_age would turn "I just got a suspicious sign-in alert, let me check" into "first re-authenticate" |
| Newest first | Paginate with cursor |
Related
- Which operations are recorded: Credential management, Sessions
- What the audit UI means: Account and security