Audit log API export

Why you need it

The same AuditLogs table the /Admin dashboard reads internally, exposed as JSON with bearer- token auth. Cursor pagination over a stable (CreatedAtUtc DESC, Id DESC) order; callers walk it to the end then incremental-poll with since=.

• Filters that match real audit questions. since / until (ISO datetime), actor (email contains), entity_type (exact), action (Create / Update / Delete / SoftDelete / Restore).
• Before / after JSON diffs. Each row carries the full row state pre- and post-write (sensitive properties redacted to "***" — encrypted blobs, password hashes, OAuth tokens never land in the audit table).
• Cursor pagination. Opaque base64-encoded (ticks, guid) tuple; up to 200 rows per page; next_cursor in the response keeps streaming.
• Token-required. No anonymous access — the audit log is sensitive even when each individual action is. Tenant scope follows the token's owner.

Where it pays off

Compliance reviews are the primary driver:

• SOC 2 Type II evidence. Auditor pulls a sample window; you give them a token + the API URL.
• Customer security reviews. Enterprise buyer's security team wants "show us your audit trail" — programmatic answer beats a screenshot.
• SIEM forwarding. Pipe StatusPulse writes into Splunk / Datadog Security / Sumo Logic so the trail joins the rest of your security observability.

Related

• Public read API
• SSO domain lock
• Incident CSV export