latestOpenAPI 3.0.32026-08-1011013.1 KB

3076153cf1b7

Activities

Query activities

Query activity logs with filtering, pagination, sorting, and free-text search.

Free-Text Search

The search parameter performs a multi-field search across:

actor.email - Email address of the actor
action - Action performed
target.type - Type of target resource
target.id - ID of target resource
scope - Scope/domain of the activity

Search uses n-gram tokenization (3-4 characters) for partial matching.

Facets

The response includes faceted aggregations for:

actor_emails - Top 100 actor emails with counts
scopes - Top 100 scopes with counts
statuses - Status values with counts

post/audit-log/activities

Request body

searchstring

Free-text search query. Searches across actor.email, action, target.type, target.id, and scope fields using n-gram matching.

actor_typesstring[]

Filter by actor type

actor_idsstring[]

Filter by actor IDs

actor_emailsstring[]

Filter by actor email addresses

actionsstring[]

Filter by action names

target_typesstring[]

Filter by target types

target_idsstring[]

Filter by target IDs

scopesstring[]

Filter by scope/domain

methodsstring[]

Filter by HTTP method

statusesstring[]

Filter by status (outcome of the action)

start_timestring date-time

Filter activities after this time (inclusive, RFC3339 format)

end_timestring date-time

Filter activities before this time (inclusive, RFC3339 format)

limitinteger

Maximum number of activities to return

offsetinteger

Number of activities to skip for pagination

sort_bystring

Field to sort results by

sort_order'asc' | 'desc'

Sort order

Example request

{
  "search": "inventory",
  "actor_types": [
    "user"
  ],
  "actor_ids": [
    "user-123",
    "user-456"
  ],
  "actor_emails": [
    "user@example.com"
  ],
  "actions": [
    "inventory:sync",
    "inventory:masterTypeAgg"
  ],
  "target_types": [
    "workflow",
    "resource"
  ],
  "target_ids": [
    "wf-123"
  ],
  "scopes": [
    "inventory",
    "workflows"
  ],
  "methods": [
    "GET",
    "POST"
  ],
  "statuses": [
    "success"
  ],
  "start_time": "2025-12-01T00:00:00Z",
  "end_time": "2025-12-31T23:59:59Z",
  "limit": 50,
  "sort_by": "event_time",
  "sort_order": "desc"
}

Response

Successful query

totalinteger required

Total number of activities matching the query

has_moreboolean required

Indicates if there are more results beyond the current page

Example response

{
  "activities": [
    {
      "id": "66169d5af4992fc0bab04510-0-0-1234567890",
      "event_time": "2025-12-10T14:07:57.388Z",
      "source": "api-gateway",
      "account_id": "66169d5af4992fc0bab04510",
      "actor": {
        "type": "user",
        "id": "user-123",
        "email": "user@example.com"
      },
      "action": "inventory:sync",
      "target": {
        "type": "workflow",
        "id": "wf-123"
      },
      "scope": "inventory",
      "method": "GET",
      "status": "success",
      "request": {
        "body": "{\"key\": \"value\"}",
        "source_ip": "192.168.1.1",
        "user_agent": "Mozilla/5.0"
      },
      "response": {
        "status_code": 200,
        "body": "{\"result\": \"success\"}"
      }
    }
  ],
  "total": 150,
  "has_more": true,
  "facets": {
    "actor_emails": [
      {
        "key": "inventory",
        "count": 100
      }
    ],
    "scopes": [
      {
        "key": "inventory",
        "count": 100
      }
    ],
    "statuses": [
      {
        "key": "inventory",
        "count": 100
      }
    ]
  }
}