List the audit log
Changes to credentials (who: user:<email>, key:<id> or support), and each use once per session, command, agent run, step session, script, task run, type action session or boxline-otp session (by what). Newest first. Never values.
GET
/v1/credentials/auditRequest
| Method and path | GET/v1/credentials/audit |
|---|---|
| Base URL | https://api.boxline.dev |
| Authentication | Your API key in the x-api-key header (or Authorization: Bearer). The examples read it from BOXLINE_API_KEY. |
Query parameters
| Name | Type | Default | Allowed values | Description |
|---|---|---|---|---|
name | string | – | – | One credential. |
limit | integer | 50 | – | From 1 to 200. |
after | string | – | – | The next value of the previous page (same filters and sort). Opaque; do not build it yourself. |
curl "https://api.boxline.dev/v1/credentials/audit?name=SHOP" \ -H "x-api-key: $BOXLINE_API_KEY"import { Boxline } from "@boxline/sdk";const bx = new Boxline(); // reads BOXLINE_API_KEY and BOXLINE_API_URLfor await (const e of bx.credentials.audit({ name: "SHOP" })) { console.log(e.at, e.action, e.type, e.actor ?? "", e.usedBy?.type ?? "");}from boxline import Boxlinebx = Boxline() # reads BOXLINE_API_KEY and BOXLINE_API_URLfor e in bx.credentials.audit(name="SHOP"): print(e["at"], e["action"], e["type"], e["actor"] or "", (e["usedBy"] or {}).get("type", ""))Responses
200 OK
A page of entries.
Fields
| Name | Type | Default | Allowed values | Description |
|---|---|---|---|---|
data | object[] | – | – | |
data[].at | string | – | – | Format: date-time. |
data[].action | string | – | create, update, delete, use, code | code: a pushed 2FA code or sign-in link (details.kind), never its value. |
data[].type | string | – | password, secret | |
data[].name | string | – | – | |
data[].actor | string | null | – | – | Who changed it: user:<email>, key:<api key id>, or support (Boxline support acting as a user). |
data[].usedBy | null | object | – | – | What used it (once per session, command's session, agent run, step session, script, task run, type-action session or boxline-otp session): session (exported into a new session's shell), exec (one command's credentials), agent_run (an agent run; id = the run), task_run (a task's run; id = the task run), step (plain-English steps on the actions API), script (browser/script and its step()), action (the type action), otp (boxline-otp codes); id is the session for session, exec, step, script, action and otp. Null for changes. |
data[].usedBy.type | string | – | session, exec, agent_run, step, script, task_run, action, otp | |
data[].usedBy.id | string | – | – | |
data[].details | object | – | – | Never values. Create: {scope, shell, origins (how many), totp (passwords)}; update: {changed} (the fields sent), plus previousOrigins when the sites changed; a profile link: {changed: ["profiles"], profile, linked}. |
next | string | null | – | – | Pass it back as after for the next page; null on the last page. |
{ "data": [ { "at": "2026-09-29T10:00:00.000Z", "action": "create", "type": "password", "name": "Work account", "actor": "…", "usedBy": { "type": "session", "id": "…" }, "details": {} } ], "next": "eyJvIjoiY3JlYXRlZF9kZXNjIiwidCI6IjIwMjYtMDktMjlUMTA6MDA6MDAuMTIzNDU2WiIsImkiOiI2YzFmIn0"}Errors
Errors have a matching HTTP status and the same body. code is stable, so check it in your code; message is for people. See Errors and request ids.
| Status | Codes | When |
|---|---|---|
| 400 Bad Request | invalid_request, invalid_json, invalid_cursor, invalid_idempotency_key, invalid_extension, variables_with_extensions, terms_not_accepted, invalid_reset_token, invalid_confirmation_code, wrong_password, no_password, invalid_next, invalid_oauth_token | The request is not valid. |
| 401 Unauthorized | unauthorized | Missing or invalid API key. |
{ "error": { "code": "not_found", "message": "session not found", "requestId": "req_4fJx0aQm2Lk9Pz7N" }}Learn more
These docs describe a beta API. Endpoints, fields and SDK methods may change before general availability; breaking changes will be listed in the changelog.