> ## Documentation Index
> Fetch the complete documentation index at: https://docs.korve.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# List

> List the organization's audit log entries, newest first. Write operations are recorded with the actor, the HTTP status they answered (failed attempts included), and small request context; reads are not recorded. Entries are retained for 90 days.



## OpenAPI

````yaml /openapi.json get /v1/orgs/{orgId}/audit
openapi: 3.1.0
info:
  title: Korve API
  version: 0.1.0
  description: >-
    Typed control plane for deploying applications and explicitly provisioning
    their managed infrastructure.
servers:
  - url: https://api.korve.dev
security: []
paths:
  /v1/orgs/{orgId}/audit:
    get:
      tags:
        - audit
      summary: List
      description: >-
        List the organization's audit log entries, newest first. Write
        operations are recorded with the actor, the HTTP status they answered
        (failed attempts included), and small request context; reads are not
        recorded. Entries are retained for 90 days.
      operationId: audit.list
      parameters:
        - name: orgId
          in: path
          required: true
          schema:
            type: string
          description: The organization's id (UUID) or slug — either form is accepted.
        - name: since
          in: query
          required: false
          schema:
            type: string
            format: date-time
          description: Only entries that occurred at or after this time (RFC 3339).
        - name: until
          in: query
          required: false
          schema:
            type: string
            format: date-time
          description: Only entries that occurred strictly before this time (RFC 3339).
        - name: limit
          in: query
          required: false
          schema:
            type: integer
          description: Maximum entries returned (1-200). Defaults to 50.
      responses:
        '200':
          description: Audit entries, newest first.
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    occurredAt:
                      type: string
                      format: date-time
                    operation:
                      type: string
                      description: The operation performed, e.g. "deploys.create".
                    actor:
                      type: object
                      description: Who performed the operation.
                      properties:
                        kind:
                          type: string
                          enum:
                            - user
                            - api_key
                            - agent_grant
                            - app_service
                        label:
                          type:
                            - string
                            - 'null'
                          description: >-
                            The user's email or the API key's name, captured
                            when the entry was written — entries outlive removed
                            members and revoked keys. Null for agent grants and
                            deployed app-service capabilities.
                      required:
                        - kind
                        - label
                    project:
                      type:
                        - string
                        - 'null'
                      description: >-
                        Slug of the project the operation addressed, resolved
                        when listing; null when no project was addressed or the
                        project no longer exists.
                    status:
                      type: integer
                      description: >-
                        HTTP status the operation answered — failed writes are
                        recorded too.
                    detail:
                      type:
                        - string
                        - 'null'
                      description: >-
                        Request context such as a hostname, slug, or key name.
                        Never contains secrets or environment-variable values.
                  required:
                    - occurredAt
                    - operation
                    - actor
                    - project
                    - status
                    - detail
        '422':
          description: Invalid since/until timestamp, empty window, or invalid limit.
      security:
        - apiKey: []
        - session: []
components:
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: korve_api_key
    session:
      type: apiKey
      in: cookie
      name: korve.session_token

````