Audit Logs for AI Agent Platforms

TL;DR: Arcade.dev captures every administrative action across the runtime automatically — who did it, how, what changed, and when. There’s nothing to enable. Audit logs are on by default, with a filterable dashboard and a REST API for pulling data into your own systems.

If you want audit events outside the dashboard, there’s a REST API. You can pull logs programmatically to feed into your existing SIEM, compliance tooling, or internal reporting.

Example

Fetch the 10 most recent audit logs for your organization, filtered to creation events:

curl -s "https://cloud.arcade.dev/api/v1/orgs/{org_id}/audit_logs?action=AUDIT_ACTION_CREATED&limit=10" \
  -H "Authorization: Bearer $ARCADE_API_KEY"

{
  "code": 200,
  "msg": "Request successful",
  "data": {
    "items": [
      {
        "id": "d290f1ee-6c54-4b01-90e6-d701748f0851",
        "event_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "timestamp": "2026-02-24T12:34:56.789Z",
        "action": "AUDIT_ACTION_CREATED",
        "source": "AUDIT_SOURCE_API",
        "display_name": "jane@example.com",
        "organization_id": "550e8400-e29b-41d4-a716-446655440000",
        "principal_type": "ACCOUNT",
        "resource_type": "RESOURCE_TYPE_API_KEY",
        "resource_display": "prod-key-1"
      }
    ],
    "next_cursor": "MjAyNi0wMi0yNFQxMjo...",
    "has_more": true
  }
}

To fetch the next page, pass the cursor:

curl -s "https://cloud.arcade.dev/api/v1/orgs/{org_id}/audit_logs?action=AUDIT_ACTION_CREATED&limit=10&cursor=MjAyNi0wMi0yNFQxMjo..." \
  -H "Authorization: Bearer $ARCADE_API_KEY"

Endpoints overview

List Organization Audit Logs

GET /api/v1/orgs/{org_id}/audit_logs

Returns a paginated, cursor-based list of audit log entries scoped to an organization. Results are ordered newest-first.

Authentication

Requires a valid user identity (API key or bearer token). The authenticated principal must be a member of the organization.

Rate limit

100 requests per 60 seconds (per IP).

Path parameters

Query parameters

Response

Status: 200 OK

{
  "code": 200,
  "msg": "Request successful",
  "data": {
    "items": [
      {
        "id": "d290f1ee-6c54-4b01-90e6-d701748f0851",
        "event_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "timestamp": "2026-02-24T12:34:56.789Z",
        "client_ip": "203.0.113.42",
        "action": "AUDIT_ACTION_CREATED",
        "source": "AUDIT_SOURCE_DASHBOARD",
        "display_name": "jane@example.com",
        "customer_id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
        "organization_id": "550e8400-e29b-41d4-a716-446655440000",
        "project_id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
        "principal_id": "usr_abc123",
        "user_id": "user-456",
        "principal_type": "ACCOUNT",
        "resource_type": "RESOURCE_TYPE_PROJECT",
        "resource_id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
        "resource_display": "My Project",
        "data": { "key": "value" },
        "created_time": "2026-02-24T12:34:57.000Z"
      }
    ],
    "next_cursor": "MjAyNi0wMi0yNFQxMjo...",
    "has_more": true
  }
}

Pagination

Pagination is cursor-based. When has_more is true, pass the next_cursor value as the cursor query parameter in the next request. The cursor is an opaque base64-encoded string; do not construct or modify it.

List Project Audit Logs

GET /api/v1/orgs/{org_id}/projects/{project_id}/audit_logs

Identical to the organization endpoint, but additionally scoped to a single project. The authenticated principal must have access to both the organization and the project.

Authentication

Requires a valid user identity (API key or bearer token). The principal must be a member of both the organization and the project.

Rate limit

100 requests per 60 seconds (per IP).

Path parameters

Query parameters

Same as List Organization Audit Logs.

Response

Same schema as List Organization Audit Logs. The project_id filter is applied automatically from the path.

Enums

AuditAction

AuditSource

ResourceType

Response item schema

Each item in the items array of a list response has the following shape:

Failure handling

• Standard error envelope with code and msg fields. Common failures are 401 (unauthenticated), 403 (not a member of the org/project), and 429 (rate limited).