> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threetone.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit logs

> Prepare an administrative event-review policy and understand the current placeholder audit-log API.

An administrative audit trail should answer who acted, what changed, which workspace and resource were affected, and whether the action succeeded. That requires collected events with a defined coverage and retention policy.

<Warning>
  [Get workspace audit logs](/api-reference/workspace/get-workspace-audit-logs) currently returns `entries=[]`, `has_more=false`, and `next_cursor=null`. It does not query a collected audit trail. An empty response cannot establish that no administrative actions occurred.
</Warning>

## Prepare an audit review

Work with the workspace administrator and the person responsible for access reviews or incident response.

<Steps>
  <Step title="Define required events" id="audit-required-events">
    List membership changes, group changes, resource grants, credential operations, configuration publication, and billing actions your review must cover. Identify the responsible system for each event.
  </Step>

  <Step title="Define investigation fields" id="audit-investigation-fields">
    Record the actor, workspace, resource, timestamp, action, outcome, and request identifier you need. Keep credentials and unnecessary transcript content out of review notes.
  </Step>

  <Step title="Track missing evidence" id="audit-missing-evidence">
    Use current member lists, resource metadata, and version reads to inspect present state. Label them as snapshots; they cannot reconstruct an unrecorded history of changes.
  </Step>
</Steps>

The public contract includes `actor_uid`, `class_name`, `activity_name`, and millisecond time-window filters. Those fields describe a future query shape; the current handler ignores them. A released audit workflow needs verified event collection, access controls, pagination, retention, and export behavior before use as an accountability record.

<AccordionGroup>
  <Accordion title="Does the API request report provide the missing audit trail?" id="audit-faq-requests">No. That report also returns placeholder rows, and request logs would not automatically establish full administrative event coverage.</Accordion>
  <Accordion title="Can current access metadata prove who granted access?" id="audit-faq-history">No. A current grant shows present state, not a complete historical record of its creation or changes.</Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.