Control plane API

Activity

The control plane's append-only audit trail of administrative changes: who did what, when, and from where.

`GET /activity`

Parameters: limit (default 50, clamped to 200), offset (default 0). Plain offset paging with no total: a page shorter than limit is the end.

{
  "events": [
    {
      "actor": "you@company.com",
      "action": "api_key.created",
      "target": "sk_i2_XXXXXXXX",
      "timestamp": "2026-08-04T10:39:00.271143+00:00",
      "source_ip": "203.0.113.99"
    }
  ],
  "limit": 50,
  "offset": 0
}

Newest first, the caller's organisation only. This is a different system from Analytics: it records administrative change in the control plane, not request traffic.

Actions

`action`	Written when	`target`
`user.login`	An account signs in
`user.logout`	An account signs out
`api_key.created`	A key is minted	The key's prefix, never the secret
`api_key.revoked`	A key is revoked	The key's prefix
`api_key.updated`	A key's rate limit, credit limit or expiry is changed	The key's prefix
`vault_key.set`	A BYOK provider key is stored or rotated	The provider name, never the key
`vault_key.revoked`	A BYOK provider key is removed	The provider name
`org.renamed`	The organisation is renamed	The new name
`member.joined`	An account joins the organisation	The email
`budget.deposited`	Credit is added to the organisation

member.removed and member.role_changed exist in the schema for endpoints that do not exist yet; they will not appear in a response today.

Fields

actor is the acting account's email, or null if that account was later hard-deleted (rare; deletion is soft everywhere else).
source_ip is resolved from the load balancer's X-Forwarded-For and is best-effort for display; do not build access decisions on it.
Entries are append-only. They cannot be edited or deleted by any member, and are kept for your organisation's retention period.

Something unclear or wrong on this page? Tell us. Machine-readable copies: llms.txt.