> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oneshotagent.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log

> Read and export your organization's events.

## Read

Admins open **Settings** → **Audit log**, or find **Audit log** in the command palette. Each event shows time, actor, action and target. Filter by UTC date range and by group: members, tokens, policies, exports or billing. Members see an admins-only message.

`GET /v1/org/audit-log`, admin, returns your organization's events oldest first by `(timestamp, id)`.

| Parameter | Meaning |
| - | - |
| `since`, `until` | Inclusive UTC ISO timestamps, up to six fractional digits; a date alone means midnight UTC |
| `action` | Literal prefix |
| `actor` | Exact match |
| `group` | One of the console groups above |
| `limit` | 1 to 500, default 100 |
| `cursor` | The previous page's `next_cursor` |
| `format` | `json` (default) or `csv` |

JSON: `{ success, data: { entries, count, has_more, next_cursor } }`. Each entry has `id`, `timestamp`, `actor`, `action`, `resource`, `resource_id`, `agent_id` and `details`; secrets in `details` are masked. Page until `has_more` is false, with the same filters on every page.

## Export

**Download CSV** fetches every matching page. CSV has the entry fields as columns, in that order, with compact JSON `details` and RFC 4180 quoting. Special characters are quoted, and cells starting with `=`, `+`, `-` or `@` get an apostrophe. [Receipt exports](https://docs.oneshotagent.com/sdk/organizations.md#credits-and-spending) follow the same cell rules. Paging headers are `X-Next-Cursor` and `X-Has-More`.

A download holds the events that existed when its first page was read, even without `until`, so its own export events are left out. Earlier export events stay in. Each CSV page records one `org.audit_log_exported` event with the filters and count only.

Reads share the receipt export rate limit. On `429`, wait for `Retry-After` and retry the same page; the console does this for you.

## Data retention

Admins set **Settings → Data retention** to **Keep everything** (the default) or 30 to 3650 days, with a preview before saving. Old tool inputs and results, messages, transcripts, goal outputs and artifacts are deleted daily. Receipts, credits, financial audit records, signed evidence and unfinished work stay.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.