{"openapi":"3.1.0","info":{"title":"Base44 Audit Logs API","description":"\nWorkspace-scoped audit logs API for security monitoring and SIEM integrations.\n\nReturns sanitized audit events across all apps in a workspace with filtering, sorting, and cursor-based pagination. Security scan events can link to a sanitized, ownership-scoped findings response.\n\n**Authentication:** Pass a workspace API key with the `audit_logs:read` scope in the `api_key` header.\n\n**Endpoints:**\n- `POST /{workspace_id}/list`\n- `GET /{workspace_id}/security-scan-runs/{run_id}`\n\n---\n\n### Filtering & Sorting (first request)\n\nOn the **first** request (no cursor), you may include any combination of:\n\n| Parameter | Type | Description |\n|-----------|------|-------------|\n| `app_id` | string | Narrow results to a single app |\n| `event_types` | list[string] | Filter by one or more event types |\n| `user_email` | string | Filter by user email |\n| `status` | string | Filter by status (`success` / `failure`) |\n| `start_date` | datetime | Include events from this date (inclusive) |\n| `end_date` | datetime | Include events until this date (exclusive) |\n| `order` | `ASC` or `DESC` | Sort by timestamp (default: `DESC`) |\n| `limit` | integer (1–1000) | Events per page (default: `50`) |\n\n---\n\n### Cursor Pagination\n\nThis API uses **opaque cursor-based pagination**. The cursor encodes the original query (filters, sort, and limit) so the server can resume exactly where it left off.\n\n**How to paginate:**\n\n1. **First page:** send your filters, sort, and limit — no `cursor`.\n2. **Check the response:** `pagination.next_cursor` contains the cursor for the next page. When it is `null`, there are no more pages.\n3. **Next pages:** send **only** `{\"cursor\": \"<value>\"}`. **Do not** include `app_id`, `event_types`, `user_email`, `status`, `start_date`, `end_date`, `order`, or `limit` — these are already encoded in the cursor. The server returns HTTP 400 if any filter, sort, or limit parameter is provided alongside a cursor.\n\n**Cursor expiry:** cursors are valid for **24 hours** from creation. An expired cursor returns HTTP 400.\n\n---\n\n### Response Shape\n\n```json\n{\n  \"events\": [ { \"timestamp\", \"user_email\", \"workspace_id\", \"app_id\", \"ip\", \"user_agent\", \"event_type\", \"status\", \"error_code\", \"metadata\" } ],\n  \"pagination\": { \"total\": 1234, \"next_cursor\": \"...\" }\n}\n```\n\n---\n\n### Rate Limits\n- 100 requests per minute per API key (enterprise workspaces get 2×)\n","version":"1.0.0"},"paths":{"/{workspace_id}/security-scan-runs/{run_id}":{"get":{"tags":["audit-logs"],"summary":"Get security scan findings","description":"Returns the sanitized findings and section coverage for one security scan referenced by an `app.security.check_run` audit event. See [Security scan findings](/developers/references/audit-logs-api/get-started/security-scan-findings) for the retrieval flow and how to interpret coverage.","operationId":"get_security_scan_run_public__workspace_id__security_scan_runs__run_id__get","parameters":[{"name":"workspace_id","in":"path","required":true,"schema":{"type":"string","title":"Workspace Id"}},{"name":"run_id","in":"path","required":true,"schema":{"type":"string","description":"Security scan run ID from the `run_id` field of an `app.security.check_run` audit event.","title":"Run Id"},"description":"Security scan run ID from the `run_id` field of an `app.security.check_run` audit event."}],"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SecurityScanRunResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}},"/{workspace_id}/list":{"post":{"tags":["audit-logs"],"summary":"List audit logs","description":"Returns paginated audit log events for a workspace.\n\nYou can filter by:\n- [Event type](/developers/references/audit-logs-api/get-started/event-types)\n- App\n- User email\n- Status\n- Date range\n\nResults use cursor-based pagination.","operationId":"list_audit_logs_public__workspace_id__list_post","parameters":[{"name":"workspace_id","in":"path","required":true,"schema":{"type":"string","title":"Workspace Id"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicListAuditLogsRequest"}}}},"responses":{"200":{"description":"Successful Response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/PublicAuditLogsListResponse"}}}},"422":{"description":"Validation Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/HTTPValidationError"}}}}}}}},"components":{"schemas":{"BackendFunctionFindingResponse":{"properties":{"file_path":{"type":"string","title":"File Path","description":"Path of the backend function file.","example":"functions/exportInvoices.ts"},"issue_description":{"type":"string","title":"Issue Description","description":"Authorization issue found in the function.","example":"The function does not verify an authenticated app member before exporting data."}},"additionalProperties":false,"type":"object","required":["file_path","issue_description"],"title":"BackendFunctionFindingResponse"},"DependencyFindingResponse":{"properties":{"package_name":{"type":"string","title":"Package Name","description":"Name of the vulnerable dependency.","example":"example-parser"},"current_version":{"type":"string","title":"Current Version","description":"Version currently in use.","example":"2.4.0"},"fixed_version":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Fixed Version","description":"First version that resolves the vulnerability, or `null` if none is available.","example":"2.4.3"},"vulnerability_id":{"type":"string","title":"Vulnerability Id","description":"Public advisory identifier.","example":"CVE-2026-12345"},"severity":{"anyOf":[{"type":"string","enum":["critical","high","medium","low"]},{"type":"null"}],"title":"Severity","description":"Scanner-provided severity, or `null` when unscored.","example":"high"},"summary":{"type":"string","title":"Summary","description":"Short description of the vulnerability.","example":"Malformed input can cause excessive resource consumption."}},"additionalProperties":false,"type":"object","required":["package_name","current_version","fixed_version","vulnerability_id","severity","summary"],"title":"DependencyFindingResponse"},"HTTPValidationError":{"properties":{"detail":{"items":{"$ref":"#/components/schemas/ValidationError"},"type":"array","title":"Detail"}},"type":"object","title":"HTTPValidationError"},"HardcodedSecretFindingResponse":{"properties":{"file_path":{"type":"string","title":"File Path","description":"Path of the file containing the potential secret.","example":"src/lib/payments.ts"},"description":{"type":"string","title":"Description","description":"Fixed message; secret values and matching text are never returned.","example":"Potential hardcoded secret detected."}},"additionalProperties":false,"type":"object","required":["file_path","description"],"title":"HardcodedSecretFindingResponse"},"PublicAuditLogResponse":{"properties":{"timestamp":{"type":"string","format":"date-time","title":"Timestamp","description":"When the event occurred in `YYYY-MM-DDTHH:MM:SSZ` format (UTC).","example":"2026-01-15T09:23:41Z"},"user_email":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"User Email","description":"Email of the human user who performed the action, when applicable.","example":"jane@acme.com"},"actor_type":{"type":"string","title":"Actor Type","description":"Type of actor that performed the action.","default":"user","example":"workspace_api_key"},"actor_id":{"type":"string","title":"Actor Id","description":"Stable identifier of the actor.","default":"","example":"key-id-1"},"actor_display_name":{"type":"string","title":"Actor Display Name","description":"Actor display name captured at event time.","default":"","example":"Production deploy key"},"workspace_id":{"type":"string","title":"Workspace Id","description":"Workspace the event belongs to.","example":"67f2c8e01a3b5d004e92d7a1"},"app_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"App Id","description":"App ID, if the event is scoped to a specific app. Omitted for workspace-level events.","example":"6820f3a4e7b91d003c45a1f2"},"ip":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Ip","description":"IP address of the user who performed the action. Omitted when not available.","example":"203.0.113.42"},"user_agent":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"User Agent","description":"User-agent string of the user who performed the action. Omitted when not available.","example":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)"},"event_type":{"type":"string","title":"Event Type","description":"Event type identifier. See [Event Types](/developers/references/audit-logs-api/get-started/event-types) for possible values.","example":"auth.login"},"status":{"type":"string","title":"Status","description":"Whether the action succeeded or failed. Either `\"success\"` or `\"failure\"`.","example":"success"},"error_code":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Error Code","description":"Error code when status is `\"failure\"`. Omitted on success.","example":"rate_limited"},"metadata":{"additionalProperties":{"type":"string"},"type":"object","title":"Metadata","description":"Additional key-value context for the event. Keys vary by event type. See [Event Types](/developers/references/audit-logs-api/get-started/event-types) for details.","example":{"auth_method":"email_password"}}},"type":"object","required":["timestamp","workspace_id","event_type","status","metadata"],"title":"PublicAuditLogResponse","description":"A single audit log event."},"PublicAuditLogsListResponse":{"properties":{"events":{"items":{"$ref":"#/components/schemas/PublicAuditLogResponse"},"type":"array","title":"Events","description":"List of audit log events."},"pagination":{"$ref":"#/components/schemas/PublicPaginationInfo","description":"Pagination metadata."}},"type":"object","required":["events","pagination"],"title":"PublicAuditLogsListResponse","description":"Response containing a page of audit log events."},"PublicListAuditLogsRequest":{"properties":{"event_types":{"anyOf":[{"items":{"type":"string"},"type":"array"},{"type":"null"}],"title":"Event Types","description":"Filter by one or more [event types](/developers/references/audit-logs-api/get-started/event-types).","example":["auth.login","app.entity.created"]},"user_email":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"User Email","description":"Filter by user email.","example":"jane@acme.com"},"status":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Status","description":"Filter by status. Either `\"success\"` or `\"failure\"`.","example":"success"},"start_date":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"Start Date","description":"Filter events from this date (inclusive) in `YYYY-MM-DDTHH:MM:SSZ` format.","example":"2026-01-01T00:00:00Z"},"end_date":{"anyOf":[{"type":"string","format":"date-time"},{"type":"null"}],"title":"End Date","description":"Filter events until this date (exclusive) in `YYYY-MM-DDTHH:MM:SSZ` format.","example":"2026-02-01T00:00:00Z"},"app_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"App Id","description":"App ID to narrow results to a specific app.","example":"6820f3a4e7b91d003c45a1f2"},"limit":{"type":"integer","maximum":1000.0,"minimum":1.0,"title":"Limit","description":"Number of events per page.","default":50,"example":100},"cursor":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Cursor","description":"Pagination cursor from a previous response.","example":"gAAAAABn7vJ..."},"order":{"type":"string","enum":["ASC","DESC"],"title":"Order","description":"Sort order by timestamp.","default":"DESC","example":"DESC"}},"type":"object","title":"PublicListAuditLogsRequest","description":"Request body for listing audit log events."},"PublicPaginationInfo":{"properties":{"total":{"type":"integer","title":"Total","description":"Total number of matching events.","example":347},"next_cursor":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Next Cursor","description":"Cursor for fetching the next page. The value is `null` if there are no more pages.","example":"gAAAAABn7vJ..."}},"type":"object","required":["total"],"title":"PublicPaginationInfo","description":"Pagination metadata for paginated responses."},"RLSFindingResponse":{"properties":{"entity_name":{"type":"string","title":"Entity Name","description":"Entity the recommendation applies to.","example":"Invoices"},"description":{"type":"string","title":"Description","description":"Recommended row-level security change.","example":"Restrict reads to records owned by the authenticated app member."}},"additionalProperties":false,"type":"object","required":["entity_name","description"],"title":"RLSFindingResponse"},"SecurityScanCoverageResponse":{"properties":{"rls":{"type":"string","enum":["completed","failed","not_run","unknown"],"title":"Rls","description":"Outcome of the RLS section. Only `completed` means an empty findings array is a clean result.","example":"completed"},"hardcoded_secrets":{"type":"string","enum":["completed","failed","not_run","unknown"],"title":"Hardcoded Secrets","description":"Outcome of the hardcoded-secrets section.","example":"completed"},"backend_functions":{"type":"string","enum":["completed","failed","not_run","unknown"],"title":"Backend Functions","description":"Outcome of the backend-functions section.","example":"completed"},"dependency_vulnerabilities":{"type":"string","enum":["completed","failed","not_run","unknown"],"title":"Dependency Vulnerabilities","description":"Outcome of the dependency-vulnerabilities section.","example":"completed"},"static_code":{"type":"string","enum":["completed","failed","not_run","unknown"],"title":"Static Code","description":"Outcome of the static-code section.","example":"completed"}},"additionalProperties":false,"type":"object","required":["rls","hardcoded_secrets","backend_functions","dependency_vulnerabilities","static_code"],"title":"SecurityScanCoverageResponse"},"SecurityScanRunResponse":{"properties":{"run_id":{"type":"string","title":"Run Id","description":"Identifier of the security scan run.","example":"6886b8d390dc7e2f4a2c91b3"},"app_id":{"type":"string","title":"App Id","description":"App the scan ran against.","example":"6820f3a4e7b91d003c45a1f2"},"workspace_id":{"type":"string","title":"Workspace Id","description":"Workspace that owns the run.","example":"67f2c8e01a3b5d004e92d7a1"},"created_date":{"type":"string","format":"date-time","title":"Created Date","description":"When the scan ran, in `YYYY-MM-DDTHH:MM:SSZ` format (UTC).","example":"2026-07-26T14:32:17Z"},"coverage":{"$ref":"#/components/schemas/SecurityScanCoverageResponse","description":"Per-section outcome. A section's empty findings array is a clean result only when its coverage is `completed`."},"rls_recommendations":{"items":{"$ref":"#/components/schemas/RLSFindingResponse"},"type":"array","title":"Rls Recommendations","description":"Row-level security recommendations. Unscored."},"hardcoded_secrets":{"items":{"$ref":"#/components/schemas/HardcodedSecretFindingResponse"},"type":"array","title":"Hardcoded Secrets","description":"Hardcoded-secret findings. Unscored; secret values are never returned."},"backend_functions":{"items":{"$ref":"#/components/schemas/BackendFunctionFindingResponse"},"type":"array","title":"Backend Functions","description":"Backend-function authorization issues. Unscored."},"dependency_vulnerabilities":{"items":{"$ref":"#/components/schemas/DependencyFindingResponse"},"type":"array","title":"Dependency Vulnerabilities","description":"Dependency vulnerabilities. May carry a scanner-provided severity."},"static_code_findings":{"items":{"$ref":"#/components/schemas/StaticCodeFindingResponse"},"type":"array","title":"Static Code Findings","description":"Static code analysis findings. May carry a scanner-provided severity."}},"additionalProperties":false,"type":"object","required":["run_id","app_id","workspace_id","created_date","coverage"],"title":"SecurityScanRunResponse"},"StaticCodeFindingResponse":{"properties":{"title":{"type":"string","title":"Title","description":"Short title of the finding.","example":"Unvalidated redirect target"},"severity":{"anyOf":[{"type":"string","enum":["critical","high","medium","low"]},{"type":"null"}],"title":"Severity","description":"Scanner-provided severity, or `null` when unscored.","example":"medium"},"confidence":{"anyOf":[{"type":"string","enum":["high","medium","low"]},{"type":"null"}],"title":"Confidence","description":"Scanner confidence in the finding, or `null` when unavailable.","example":"high"},"category":{"type":"string","title":"Category","description":"Finding category.","example":"open_redirect"},"file_path":{"type":"string","title":"File Path","description":"Path of the file the finding is in.","example":"src/pages/Login.tsx"},"line":{"anyOf":[{"type":"integer"},{"type":"null"}],"title":"Line","description":"1-based line number, or `null` when not applicable.","example":48},"impact":{"type":"string","title":"Impact","description":"Potential impact of the finding.","example":"An attacker could redirect a person to an untrusted site."},"recommendation":{"type":"string","title":"Recommendation","description":"Recommended remediation.","example":"Allow only application-owned redirect destinations."},"standards":{"items":{"$ref":"#/components/schemas/StaticCodeStandardResponse"},"type":"array","title":"Standards","description":"Related security standards, when available."}},"additionalProperties":false,"type":"object","required":["title","severity","confidence","category","file_path","line","impact","recommendation"],"title":"StaticCodeFindingResponse"},"StaticCodeStandardResponse":{"properties":{"framework":{"type":"string","title":"Framework","description":"Standards framework.","example":"CWE"},"id":{"type":"string","title":"Id","description":"Identifier within the framework.","example":"601"},"name":{"type":"string","title":"Name","description":"Human-readable name of the standard.","example":"URL Redirection to Untrusted Site"}},"additionalProperties":false,"type":"object","required":["framework","id","name"],"title":"StaticCodeStandardResponse"},"ValidationError":{"properties":{"loc":{"items":{"anyOf":[{"type":"string"},{"type":"integer"}]},"type":"array","title":"Location"},"msg":{"type":"string","title":"Message"},"type":{"type":"string","title":"Error Type"}},"type":"object","required":["loc","msg","type"],"title":"ValidationError"}},"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"api_key","description":"API key for authentication. See the Authentication page for your API for details on how to get your key."}}},"tags":[{"name":"audit-logs","description":"Query audit events and retrieve sanitized findings for a referenced security scan run."}],"servers":[{"url":"https://app.base44.com/api/v1/audit-logs","description":"Audit Logs API"}],"security":[{"ApiKeyAuth":[]}]}