Skip to content
GitmoapAPIBeta
Organizeaudit
GET/repositories/{repo_id}/audit-log

List the audit records targeting a repository

list_repo_audit_log
  • audit:read
    A token needs the audit:read scope: Read the audit log (org owners / platform admins)Granted by read_api, write_api.Every operation this scope unlocks
  • Single-resource

    x-gitmoap-isolation: {"kind":"single_or_self_scoped"}

  • Paginated
    Pass the cursor a page returns to get the next one.

The records whose target is the repository itself, newest first; only the repository's owners may read them. Narrow them by actor, category and a time window. Filters apply to each page, so a page can hold fewer than limit records while more remain: keep reading while a cursor is returned.

Parameters

Path
  • repo_idRepositoryId (string · uuid)Repository id
Query
  • actorstringoptionalFilter to one actor id
  • categorystringoptionalFilter to one category
  • fromstringoptionalLower time bound (RFC-3339, inclusive)
  • tostringoptionalUpper time bound (RFC-3339, exclusive)
  • limitinteger · int32optionalPage size (1-100, default 20)
  • cursorstringoptionalOpaque pagination cursor
  • resourcestringoptionalFilter to one target resource id
  • scopestringoptionalIgnored here: this listing always reads the records targeting the repository

Responses

200A page of audit recordsapplication/json
  • recordsarray of AuditRecord
    • The AuditRecord schema
    • actorAuditActor
      • The AuditActor schema
      • actor_typestringWhat kind of caller acted: user, service_account, pipeline_run, anonymous, or scim — an organization's identity provider calling with its SCIM token.
      • auth_methodAuthMethodjwtaccess_tokenanonymousHow the caller authenticated.
      • idstringThe id of the user, service account or pipeline run that acted, or anonymous.
      • avatar_urlstring or nulloptional
      • emailstringoptional
      • token_idstring or nulloptional
      • usernamestringoptional
    • audit_idAuditId (string · uuid)
    • categoryAuditCategorymutationauth_eventsensitive_readWhat kind of operation the record captures.
    • hashstringSHA256(canonical_json(record without hash) ‖ prev_hash), hex.
    • http_methodstring
    • monthstringThe month the record belongs to, YYYY-MM. Each month's records form one segment of the chain.
    • occurred_atstring
    • operation_idstring
    • outcomeAuditOutcomesuccessdeniedfailureThe result of the audited operation.
    • prev_hashstringHash of the previous record in the chain (genesis = 64 zeros; first of a month links to the prior month's tip).
    • recorded_atstringWhen the record was written to the log, RFC 3339 with microseconds.
    • request_idstring
    • routestring
    • scopestringWhich audit chain the record belongs to — an organisation, a user, or the platform.
    • seqinteger · int640–∞Monotonic position within (scope, month).
    • status_codeinteger · int320–∞
    • accessAccessAuditDetail or nulloptionalFor an operation that changed who can do what: each grant it made, changed or revoked, with the role before and after. Absent everywhere else — and absent fields do not enter the hash, so every record written before this field existed verifies unchanged.
    • mcpMcpAuditDetail or nulloptionalFor a request an AI agent made through the MCP server: the tool and the client. Absent everywhere else, and so outside the hash of every record that does not carry it.
      • The McpAuditDetail schema
      • toolstringThe tool whose execution made the request.
      • clientstring or nulloptionalThe client application the tool call came from, as that application named itself.
      • oauth_client_idstring or nulloptionalThe app the access token was issued to, when an app connected through sign-in — its own registered identifier, which, unlike the self-reported client name, the person consented to.
    • resource_bindingstring or nulloptional
    • source_ipstring or nulloptional
    • target_idstring or nulloptional
    • target_typestring or nulloptional
    • user_agentstring or nulloptional
  • next_cursorstring or nulloptional
200 exampleSynthesized example
{
"records": [
{
"actor": {
"actor_type": "actor-type-1793",
"auth_method": "jwt",
"id": "id-6688"
},
"audit_id": "954235b4-f4d8-4bbd-ad54-6054d2ce20df",
"category": "mutation",
"hash": "hash-a192",
"http_method": "http-method-ae36",
"month": "month-588a",
"occurred_at": "2026-10-16T11:19:30Z",
"operation_id": "f9855ac9-af20-4fff-893f-2066f12d41fc",
"outcome": "success",
"prev_hash": "prev-hash-ae52",
"recorded_at": "2026-10-11T19:03:31Z",
"request_id": "cbd38b34-a1f1-464a-a902-c0dfd07d9da4",
"route": "route-79e0",
"scope": "scope-adf0",
"seq": 52,
"status_code": 38
},
{
"actor": {
"actor_type": "actor-type-1bc0",
"auth_method": "jwt",
"id": "id-5680"
},
"audit_id": "24e89960-dbcb-4320-bb41-ce7dc85924bf",
"category": "mutation",
"hash": "hash-e526",
"http_method": "http-method-842d",
"month": "month-da9d",
"occurred_at": "2026-10-13T05:47:59Z",
"operation_id": "167b1844-e9e6-4ef5-9840-e5163aea539a",
"outcome": "success",
"prev_hash": "prev-hash-3203",
"recorded_at": "2026-10-14T09:39:14Z",
"request_id": "30dd985b-e5d0-4239-acfd-b0d00b5c1acb",
"route": "route-0ffb",
"scope": "scope-e423",
"seq": 4,
"status_code": 83
}
],
"next_cursor": "next-cursor-88be"
}
400Bad request — a path parameter is not a well-formed value of its typeapplication/json
Error codes
  • BAD_REQUESTThe request is malformed: a parameter or a body field is not a well-formed value of its type
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
400 exampleSynthesized example
{
"error": {
"code": "code-4865",
"message": "Draw the region map from operation density"
}
}
401Unauthenticated — no credential, or an invalid oneapplication/json
Error codes
  • UNAUTHORIZEDNo credential was sent, or the one sent is invalid, expired or revoked
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
401 exampleSynthesized example
{
"error": {
"code": "code-14df",
"message": "Draw the region map from operation density"
}
}
403Not an Owner of the repositoryapplication/json
Error codes
  • FORBIDDENYou are signed in but may not do this here; reason names the permission or the rule that refused it
  • INSUFFICIENT_SCOPEThe access token lacks the scope this operation needs; required_scope names it
  • PERMISSION_REQUIREDYou need a permission you do not hold here; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
403 exampleSynthesized example
{
"error": {
"code": "code-5a9a",
"message": "Draw the region map from operation density"
}
}
404Repository not foundapplication/json
Error codes
  • NOT_FOUNDThe resource does not exist — or exists and you cannot see it: a private resource you have no access to answers exactly as an absent one does
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
404 exampleSynthesized example
{
"error": {
"code": "code-5c6f",
"message": "Draw the region map from operation density"
}
}
501The audit log is not configured on this deploymentapplication/json
Error codes
  • NOT_IMPLEMENTEDThis deployment has not configured the feature the operation needs; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
501 exampleSynthesized example
{
"error": {
"code": "code-bb74",
"message": "Draw the region map from operation density"
}
}

CLI

gitmoap audit list-repo-audit-log

  • --repo-ididRepository id (id or owner/repo path)
  • --actorstringoptionalFilter to one actor id
  • --categorystringoptionalFilter to one category
  • --cursorstringoptionalOpaque pagination cursor
  • --fromstringoptionalLower time bound (RFC-3339, inclusive)
  • --limitnumberoptionalPage size (1-100, default 20)
  • --resourcestringoptionalFilter to one target resource id
  • --scopestringoptionalIgnored here: this listing always reads the records targeting the repository
  • --tostringoptionalUpper time bound (RFC-3339, exclusive)

Used in these guides