Audit log Live

The workspace audit log is the permanent record of administrative actions: agent invitations, role changes, department CRUD, conversation force-transfers, workspace settings updates, suppression edits, and subscription changes. Admin-only.

List audit entries

Cursor-paginated, newest first. Filters: action prefix (e.g., agent.), actorAgentId, subjectId, from, to.

Code samples

curl 'https://app.message.com/api/v1/workspace/audit-log?limit=100' \
  -H 'Authorization: Bearer YOUR_WORKSPACE_JWT'

const res = await fetch('https://app.message.com/api/v1/workspace/audit-log?limit=100', {
  headers: { Authorization: 'Bearer ' + token }
});
const { auditLog } = await res.json();

import requests
r = requests.get(
    "https://app.message.com/api/v1/workspace/audit-log",
    headers={"Authorization": f"Bearer {token}"},
    params={"limit": 100},
)
audit = r.json()["auditLog"]

require "net/http"
require "json"
uri = URI("https://app.message.com/api/v1/workspace/audit-log?limit=100")
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
  req = Net::HTTP::Get.new(uri)
  req["Authorization"] = "Bearer #{token}"
  http.request(req)
end
audit = JSON.parse(res.body)["auditLog"]

<?php
$ctx = stream_context_create([
  "http" => ["method" => "GET", "header" => "Authorization: Bearer $token"]
]);
$audit = json_decode(file_get_contents("https://app.message.com/api/v1/workspace/audit-log?limit=100", false, $ctx), true)["auditLog"];

{
  "auditLog": [
    {
      "id": "uuid",
      "actorAgentId": "uuid",
      "actorEmail": "[email protected]",
      "action": "agent.role_changed",
      "subjectType": "agent",
      "subjectId": "uuid",
      "before": { "role": "agent" },
      "after": { "role": "supervisor" },
      "ipAddress": "203.0.113.42",
      "userAgent": "Mozilla/5.0...",
      "createdAt": "2026-05-13T15:30:00Z"
    }
  ],
  "nextCursor": "2026-05-13T15:25:00Z|uuid"
}

Tracked actions

Retention

• Default: 365 days of audit entries.
• Enterprise plans: unlimited retention, with export to your own SIEM.
• Soft-delete: deleted records are tombstoned for 30 days before garbage collection.

Export

Generates a CSV or JSON snapshot of the audit log within a date range. Returns a signed URL valid for 15 minutes. Used for SOC 2 / ISO 27001 audits.

Errors

Common pitfalls

• Treating audit as analytics. Use Reports for volume / performance. Audit is for compliance and security review.
• Filtering by action exact match. Action is a dotted hierarchy. Filter by prefix (agent.) to catch everything related to agents.
• Forgetting the actor. System-triggered events (auto-suspension, webhook-driven changes) carry actorAgentId: null and actorEmail: "system".