Skip to main content
An administrative audit trail should answer who acted, what changed, which workspace and resource were affected, and whether the action succeeded. That requires collected events with a defined coverage and retention policy.
Get workspace audit logs currently returns entries=[], has_more=false, and next_cursor=null. It does not query a collected audit trail. An empty response cannot establish that no administrative actions occurred.

​
Prepare an audit review

Work with the workspace administrator and the person responsible for access reviews or incident response.
1

Define required events

List membership changes, group changes, resource grants, credential operations, configuration publication, and billing actions your review must cover. Identify the responsible system for each event.
2

Define investigation fields

Record the actor, workspace, resource, timestamp, action, outcome, and request identifier you need. Keep credentials and unnecessary transcript content out of review notes.
3

Track missing evidence

Use current member lists, resource metadata, and version reads to inspect present state. Label them as snapshots; they cannot reconstruct an unrecorded history of changes.
The public contract includes actor_uid, class_name, activity_name, and millisecond time-window filters. Those fields describe a future query shape; the current handler ignores them. A released audit workflow needs verified event collection, access controls, pagination, retention, and export behavior before use as an accountability record.
No. That report also returns placeholder rows, and request logs would not automatically establish full administrative event coverage.
No. A current grant shows present state, not a complete historical record of its creation or changes.