curl --request GET \
--url https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"items": [
{
"id": "<string>",
"organizationId": "<string>",
"action": "<string>",
"actorUserId": "<string>",
"actorEmail": "<string>",
"targetType": "<string>",
"targetId": "<string>",
"targetLabel": "<string>",
"metadata": {},
"createdAt": "2023-11-07T05:31:56Z"
}
],
"has_next_page": true,
"end_cursor": "<string>",
"entries": [
{
"id": "<string>",
"organizationId": "<string>",
"action": "<string>",
"actorUserId": "<string>",
"actorEmail": "<string>",
"targetType": "<string>",
"targetId": "<string>",
"targetLabel": "<string>",
"metadata": {},
"createdAt": "2023-11-07T05:31:56Z"
}
],
"next_before": "<string>"
}{
"error": "missing_bearer",
"message": "Authorization required"
}{
"error": "missing_scope",
"required_scope": "sessions:read"
}{
"error": {
"type": "rate_limited",
"message": "This API key exceeded its request-rate limit"
}
}List audit log entries
Returns audit log entries newest first. Entry fields are camelCase (actorUserId, targetId, createdAt). Owners and admins read every entry in full. For other members, entries about another member’s personal secrets keep their action, actor and time but withhold the secret names (targetId and targetLabel are null, metadata.secret_names omits them, and metadata.names_withheld is true).
analytics:readcurl --request GET \
--url https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.reasonmachines.com/v3/organizations/{orgId}/audit-logs")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"items": [
{
"id": "<string>",
"organizationId": "<string>",
"action": "<string>",
"actorUserId": "<string>",
"actorEmail": "<string>",
"targetType": "<string>",
"targetId": "<string>",
"targetLabel": "<string>",
"metadata": {},
"createdAt": "2023-11-07T05:31:56Z"
}
],
"has_next_page": true,
"end_cursor": "<string>",
"entries": [
{
"id": "<string>",
"organizationId": "<string>",
"action": "<string>",
"actorUserId": "<string>",
"actorEmail": "<string>",
"targetType": "<string>",
"targetId": "<string>",
"targetLabel": "<string>",
"metadata": {},
"createdAt": "2023-11-07T05:31:56Z"
}
],
"next_before": "<string>"
}{
"error": "missing_bearer",
"message": "Authorization required"
}{
"error": "missing_scope",
"required_scope": "sessions:read"
}{
"error": {
"type": "rate_limited",
"message": "This API key exceeded its request-rate limit"
}
}Authorizations
Your Reason API key from Settings › API keys. New keys use reason_; legacy ara_ keys remain accepted. Keys are capability-scoped: run, mcp:read, mcp:write, secrets:read, secrets:write, sessions:read, sessions:debug, knowledge:read, memory:read, memory:write, skills:read, skills:write, repos:read, repos:write, reviews:read, reviews:write, deployment:read, analytics:read, org:read, org:write, attachments:read, attachments:write, guardrails:read, guardrails:write, network:read, network:write, automations:read, automations:write, agent_auth:read. network:read and network:write are opt-in, excluded from default keys. network:read reads the saved workspace network policy; network:write replaces custom allowed hosts and requires a current organization owner/admin. Legacy project PATCH requests containing network_allowed_hosts also require network:write plus their existing run scope and project management permission; saved project hosts do not affect current session egress. Only owners/admins can mint or manage keys with network:write; keys cannot grant themselves more authority. See /docs/network-policies for replacement semantics and runtime applicability. mcp:write manages MCP server configuration only; it does not authorize remote MCP-tool execution. sessions:read reads sessions, including the assistant, reasoning and tool activity in their events. sessions:debug is privileged: only for organization owners/admins, it expands session events to the full diagnostic projection (diagnostic event kinds, status text and raw event metadata).
Path Parameters
Organization id or slug. Resolve it with GET /v3/self.
Query Parameters
How many audit entries to return in this page; a larger value is capped at 200.
Exclusive upper time bound: only entries recorded before it are returned. Pass the previous page's end_cursor to read the next, older page; omit it to start from the newest entry.
Filter by an action recorded in an entry, such as secret.set.
Filter by a member user ID returned by listMembers or an audit entry's actor user ID.
Return only entries recorded at or after this moment, to read recent activity; omit it to reach back to the oldest entry.
Response
Audit log entries.
Audit entries on this page, newest first.
Show child attributes
Show child attributes
Whether older entries may follow this page.
Creation time of the oldest entry on this page; pass it as before for the next page. Null on the last page.
Deprecated: use items (same value).
Show child attributes
Show child attributes
Deprecated: use end_cursor (same value).

