Audit log

List audit log entries

GET /api/v1/audit-log

Owner and admin keys only. Newest first. This is the same data as Settings → Audit log; see Audit log for what's recorded.

actorstringquery

A user ID, or system for changes no person made (scheduled jobs and incoming webhooks).

typestringquery

Record type: ApiKey, Authenticator, Client, ClientBillingCycle, ClientDocument, Contact, Expense, ExternalProjectLink, Invite, Invoice, LinearConnection, Link, Membership, MercuryConnection, Milestone, Organization, PaymentMethod, Project, ProjectMember, QuickBooksConnection, RecurringInvoiceSchedule, SsoConnection, Task, TaskComment, TimeEntry, Timesheet, or User. Any other value is ignored.

actionstringquery

create, update, delete, sign_in, view, download, or export. Any other value is ignored.

fromstringquery

YYYY-MM-DD, inclusive (UTC).

tostringquery

YYYY-MM-DD, inclusive (UTC).

limitnumberquerydefault: 50

1 to 200.

pagenumberquerydefault: 0

Zero-based page number.

curl "https://<your-instance>/api/v1/audit-log?type=PaymentMethod&from=2026-10-01" \
  -H "Authorization: Bearer ch_live_..."

{
  "entries": [
    {
      "id": "cm9...",
      "at": "2026-10-02T15:04:11.000Z",
      "actor": { "id": "cm9...", "name": "Dana Ruiz", "email": "dana@example.com" },
      "via": "web",
      "action": "update",
      "summary": "updated payment method",
      "entityType": "PaymentMethod",
      "entityId": "cm9...",
      "entityLabel": "Operating account",
      "count": null,
      "changes": { "label": { "from": "Operating", "to": "Operating account" } },
      "ipAddress": "203.0.113.7",
      "userAgent": "Mozilla/5.0 ..."
    }
  ],
  "nextPage": 1
}

Field	Description
`at`	When it happened (ISO, UTC).
`actor`	`{ id, name, email }`, or `null` for system changes.
`via`	`web` (the app), `api` (an API key, through the REST API or MCP), or `system`.
`action`	One of the `action` values above.
`summary`	A readable description, e.g. `deleted 3 time entries`.
`entityType`, `entityId`, `entityLabel`	The record and its name or title at the time. `entityId` and `entityLabel` are `null` for bulk changes.
`count`	How many records a bulk change touched; otherwise `null`.
`changes`	On create, `{ field: value }`. On update, `{ field: { from, to } }`. `null` for deletes, sign-ins and views. Passwords, tokens and other secrets show as `[redacted]`, and so do payment-method `details` and `paymentInstructions`.
`ipAddress`, `userAgent`	Where the request came from, when known.

To read every page, request page=0, then keep requesting nextPage until it's null.

Errors: 403 "Only owners and admins can read the audit log.".