curl --request GET \
--url https://app.hookie.ai/admin/api/audit \
--cookie hookie_session=const options = {method: 'GET', headers: {cookie: 'hookie_session='}};
fetch('https://app.hookie.ai/admin/api/audit', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://app.hookie.ai/admin/api/audit"
headers = {"cookie": "hookie_session="}
response = requests.get(url, headers=headers)
print(response.text){
"audit": [
{
"id": "<string>",
"at": "2023-11-07T05:31:56Z",
"actor_sub": "<string>",
"actor_email": "<string>",
"actor_agent": "<string>",
"action": "<string>",
"target": "<string>",
"details": "<string>"
}
],
"total": 123,
"limit": 123,
"offset": 123
}{
"error": "<string>",
"retry_after": 123,
"upgrade_url": "<string>"
}{
"error": "<string>",
"retry_after": 123,
"upgrade_url": "<string>"
}{
"error": "<string>",
"retry_after": 123,
"upgrade_url": "<string>"
}Read the workspace audit log
Workspace-level (tenant-wide), NOT project-scoped - there is no /projects//audit form. JSON reads are open to any role; the CSV export is owner/admin.
curl --request GET \
--url https://app.hookie.ai/admin/api/audit \
--cookie hookie_session=const options = {method: 'GET', headers: {cookie: 'hookie_session='}};
fetch('https://app.hookie.ai/admin/api/audit', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://app.hookie.ai/admin/api/audit"
headers = {"cookie": "hookie_session="}
response = requests.get(url, headers=headers)
print(response.text){
"audit": [
{
"id": "<string>",
"at": "2023-11-07T05:31:56Z",
"actor_sub": "<string>",
"actor_email": "<string>",
"actor_agent": "<string>",
"action": "<string>",
"target": "<string>",
"details": "<string>"
}
],
"total": 123,
"limit": 123,
"offset": 123
}{
"error": "<string>",
"retry_after": 123,
"upgrade_url": "<string>"
}{
"error": "<string>",
"retry_after": 123,
"upgrade_url": "<string>"
}{
"error": "<string>",
"retry_after": 123,
"upgrade_url": "<string>"
}Authorizations
The console's sealed session cookie, set by WorkOS AuthKit. Mutating requests also require the X-Requested-With CSRF header.
Query Parameters
Substring matched against actor_email OR actor_sub.
Exact action name, e.g. create_webhook or reveal_destination_secret.
Exact target id.
ISO timestamp; matches at >= since.
ISO timestamp; matches at <= until.
Page size; non-numeric or non-positive falls back to 25, values above 100 are clamped. Ignored when format=csv (that path takes a single 5000-row page).
1 <= x <= 100Row offset; forced to 0 when format=csv.
x >= 0Set to csv for a CSV attachment instead of JSON. Requires the manage capability (owner/admin) and is itself audited as export_audit.
csv Response
Newest first. JSON by default; with format=csv the body is a text/csv attachment (hookie-audit.csv) with the header at,actor_email,actor_sub,actor_agent,action,target,details.