Every mutation through the dashboard or the API writes an audit row: the actor, the action as resource.verb, the target, and any extra detail under meta. Actions taken with an API key record the key rather than a person.
List audit entries
GET
/user/audit_logsNewest first.
Needs the audit.read permission, or an API key with the matching scope.
Query parameters
workspace_idintegerrequired- The workspace to read from.
actionstring- Exact action, for example
incidents.create. date_fromstring- ISO 8601 lower bound.
date_tostring- ISO 8601 upper bound.
limitintegerdefault 20- Rows per page, up to 100.
offsetintegerdefault 0- Rows to skip.
Common actions
| Resource | Verbs |
|---|---|
pages | create, update, publish, delete |
components, component_groups | create, update, set_status, delete |
incidents | create, update, resolve, publish, update_meta, delete_draft |
maintenances | create, update, start, complete, cancel |
monitors | create, update, pause, resume, delete, update_rules |
subscribers | import, delete |
webhooks, api_keys, message_templates, domains | create, update, delete (keys: revoke; domains: verify) |
members | invite, resend_invite, update_role, remove, accept_invite |
billing | checkout, change_plan, cancel, resume, portal_session, sync |
Request
curl "https://api.statusbee.co/user/audit_logs?workspace_id=5&action=incidents.create" \
-H "Authorization: Bearer sb_live_…"Response
{
"statusCode": 200,
"error": false,
"message": null,
"data": {
"rows": [
{
"id": 5021,
"org_id": 5,
"workspace_id": 5,
"actor_user_id": 12,
"actor_api_key_id": null,
"action": "incidents.create",
"target_type": "incident",
"target_id": 91,
"meta": {
"title": "Checkout errors"
},
"ip": "203.0.113.10",
"created_at": "2026-09-14T09:02:11.000Z"
}
],
"count": 1,
"limit": 20,
"offset": 0
}
}