Docs
Audit log

List the audit log

GEThttps://api.norreach.app/v1/audit-log

The workspace's audit log, newest first: what happened, who did it, and — for anything done through the API — which key (or connected app), from REST or MCP, with the request id. Each entry names the ids it is about; its raw details are never served. Filter by action (exact, or a prefix like contact.*), actor (part of the name, e.g. an email or "via API key"), since / until. Owners and admins.

audit:readRole must allow: audit.viewOperation id: list_audit_log
GET/audit-log
curl -X GET "https://api.norreach.app/v1/audit-log" \
  -H "Authorization: Bearer $NORREACH_API_KEY"
List the audit log
{
  "object": "list",
  "data": [
    {
      "id": "48211",
      "object": "audit_entry",
      "action": "api.approve_approval",
      "actor": "anna@example.com via API key CRM sync (nr_live_8fK2pQ1x)",
      "via": {
        "kind": "api_key",
        "surface": "rest",
        "key_id": "0f1e2d3c-4b5a-4968-8776-655443322110",
        "key_prefix": "nr_live_8fK2pQ1x",
        "client_name": null,
        "request_id": "6f0c2a1e-9b8d-4c7e-a6f5-4e3d2c1b0a99"
      },
      "targets": {
        "contact_id": "7d1c3b2a-5e4f-4a1b-9c8d-0e1f2a3b4c5d"
      },
      "created_at": "2026-11-05T09:12:33.120Z"
    }
  ],
  "has_more": false,
  "next_cursor": null
}

Authorizations

Authorizationstringheaderrequired

Bearer authentication: send Authorization: Bearer <key>, with an API key or an OAuth access token. The key needs the scope audit:read. API keys and scopes

Query parameters

limitintegerquery

Page size (1–200, default 50).

cursorstringquery

The next_cursor of the previous page.

actionstringquery

Only this action, or every action under a prefix (contact.*).

actorstringquery

Only entries whose actor contains this.

sincestring (date-time)query

Only entries at or after this time (RFC 3339).

untilstring (date-time)query

Only entries before this time (RFC 3339).

Response

200application/json— List the audit log

object"list"required
dataobject[]required
Show child attributes
data[].idstringrequired

The entry's id.

data[].object"audit_entry"required
data[].actionstringrequired

What happened (contact.erased, api.publish_page, Approved …).

data[].actorstring | nullrequired

Who did it: a person's email, "<email> via API key <label> (<prefix>)", or "nora".

data[].viaobject | nullrequired

Set when it was done through the API: which key, from where.

data[].targetsobjectrequired

The ids it is about (contact_id, campaign_id …).

data[].created_atstringrequired

RFC 3339 UTC timestamp with milliseconds.

has_morebooleanrequired
next_cursorstring | nullrequired

Errors

Errors are application/problem+json with a stable code.

StatusCodeMeaning
400bad_requestThe request couldn't be read.
400unknown_fieldThe request has a field this operation doesn't know.
400invalid_cursorThat cursor doesn't belong to this list.
401unauthorizedA valid API key is required.
403insufficient_scopeThis API key doesn't have the scope this operation needs.
403feature_not_enabledThe API isn't switched on for this workspace.
403role_forbiddenThe key's creator's role can't do this.
422validation_failedThe request has invalid fields.
429rate_limitedToo many requests. Slow down and try again.
500server_errorSomething went wrong on our side.
503unavailableThe API isn't available right now. Try again shortly.