> ## Documentation Index
> Fetch the complete documentation index at: https://docs.atako.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List the company audit journal

> Company-admin only. Cursor-paginated, most recent first by default.



## OpenAPI

````yaml /api-reference/openapi.json get /company/audit-log
openapi: 3.1.0
info:
  title: Atako API
  version: 0.1.0
  description: >-
    The Atako customer API — manage AI agents, their files, integrations,
    billing, and your company/team, programmatically.


    ## Authentication


    Every non-public endpoint takes a Bearer token that is either:

    - a **programmatic API key** (`aik_…`) — create one at
    [app.atako.ai](https://app.atako.ai) → Settings → API keys (company-admin
    only), or

    - a **Supabase session JWT** — what the web app itself sends; not practical
    to obtain outside a browser session.


    ```bash

    curl https://api.atako.ai/agents -H "Authorization: Bearer aik_..."

    ```


    An API key acts as its owning user, with all of that user's permissions —
    there is no separate key scope in this release.


    ## Other Atako HTTP surfaces (not covered by this spec)


    - **Atako MCP server** — `POST /mcp` (auth: same Bearer token as above)
    exposes a read-only Model Context Protocol tool catalogue for AI clients
    (Claude Code, Claude Desktop, Cursor, ChatGPT). See
    [docs.atako.ai/developers/mcp/overview](https://docs.atako.ai/developers/mcp/overview).

    - **Content API** (`cak_…` key, `/content/*`) — a separate, more restricted
    key type for headless CMS-style access to blog/news/use-case content. Not
    documented here.


    ## Errors


    Errors use a JSON envelope: `{ "error": string, "code"?: string }`. `error`
    is either a short human-readable message or a SCREAMING_SNAKE_CASE code,
    depending on the route — treat it as an opaque string to match against, not
    a stable enum across the whole API.


    ## Rate limits


    Authenticated routes: 6000 requests/min per user (`authRateLimit`). Public
    GET routes: 60/min per IP. A handful of sensitive public POST routes
    (newsletter signup, email-exists, invitation preview) are limited to 10
    requests / 15 min per IP.


    ## Pagination


    List endpoints use either simple `limit`/`offset` query params (marketing
    content — a plain JSON array response, capped at the documented max) or
    `page`/`limit` (credit transactions). Neither returns a total count today;
    fetch until a page comes back shorter than `limit`.
servers:
  - url: https://api.atako.ai
    description: Production
security: []
tags:
  - name: Agents
  - name: Messages
  - name: Activity
  - name: Agent Options
  - name: API Keys
  - name: Files
  - name: Cron Jobs
  - name: Sub-Agents
  - name: Interagent Messages
  - name: Integrations
  - name: Subscriptions
  - name: Users
  - name: Company
  - name: Teams
  - name: Floor
  - name: Projects
  - name: Public
  - name: Marketing Content
paths:
  /company/audit-log:
    get:
      tags:
        - Company
      summary: List the company audit journal
      description: Company-admin only. Cursor-paginated, most recent first by default.
      operationId: listCompanyAuditLog
      parameters:
        - name: cursor
          in: query
          required: false
          description: >-
            Opaque pagination cursor from a previous page's `nextCursor`
            (ignored by /export).
          schema:
            type: string
        - name: limit
          in: query
          required: false
          description: Page size, default 50, capped at 100 (ignored by /export).
          schema:
            type: integer
            minimum: 1
            maximum: 100
        - name: sort
          in: query
          required: false
          description: Sort by createdAt, default desc.
          schema:
            type: string
            enum:
              - asc
              - desc
        - name: actorId
          in: query
          required: false
          description: Filter to a single human actor.
          schema:
            type: string
            format: uuid
        - name: actorAgentId
          in: query
          required: false
          description: Filter to a single agent actor.
          schema:
            type: string
            format: uuid
        - name: action
          in: query
          required: false
          description: Comma-separated list of exact action strings.
          schema:
            type: string
        - name: status
          in: query
          required: false
          description: Filter by outcome.
          schema:
            type: string
            enum:
              - ok
              - denied
              - error
        - name: entityType
          in: query
          required: false
          description: Filter by the affected entity type.
          schema:
            type: string
        - name: from
          in: query
          required: false
          description: Only entries at or after this instant.
          schema:
            type: string
            format: date-time
        - name: to
          in: query
          required: false
          description: Only entries at or before this instant.
          schema:
            type: string
            format: date-time
        - name: q
          in: query
          required: false
          description: >-
            Free-text search over action, actor name/email, agent name and
            entity type.
          schema:
            type: string
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogPage'
        '400':
          description: Validation error, or an invalid cursor.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '401':
          description: Missing, malformed, or invalid bearer token / API key.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '403':
          description: The caller does not have the required role/permission.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
        '404':
          description: No company found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
      security:
        - bearerAuth: []
components:
  schemas:
    AuditLogPage:
      type: object
      properties:
        logs:
          type: array
          items:
            $ref: '#/components/schemas/AuditLogEntry'
        nextCursor:
          type: string
          nullable: true
          description: >-
            Opaque cursor — pass back as `?cursor=` to fetch the next page, null
            once exhausted.
      required:
        - logs
        - nextCursor
    Error:
      type: object
      description: >-
        Atako's standard error envelope. `error` is either a short
        human-readable message or a SCREAMING_SNAKE_CASE code (routes are
        inconsistent about which — treat it as an opaque string and match on it
        exactly if you need to branch on error type). Some routes add extra
        fields alongside `error` (see the operation's own error responses).
      properties:
        error:
          type: string
        code:
          type: string
          description: >-
            Present on some routes; a stable machine-readable code duplicating
            or refining `error`.
      required:
        - error
      additionalProperties: true
    AuditLogEntry:
      type: object
      properties:
        id:
          type: string
          format: uuid
        createdAt:
          type: string
          format: date-time
        action:
          type: string
        status:
          type: string
          enum:
            - ok
            - denied
            - error
        entityType:
          type: string
          nullable: true
        entityId:
          type: string
          nullable: true
        ip:
          type: string
          nullable: true
        meta:
          type: object
          nullable: true
          additionalProperties: true
        actor:
          $ref: '#/components/schemas/AuditLogActor'
        target:
          type: object
          nullable: true
          description: >-
            Who/what the action was about, when that differs from the actor
            (e.g. a member removed by an admin).
          properties:
            userId:
              type: string
              format: uuid
            userName:
              type: string
              nullable: true
            userEmail:
              type: string
              nullable: true
          required:
            - userId
      required:
        - id
        - createdAt
        - action
        - status
        - actor
    AuditLogActor:
      description: >-
        Who performed the action — a member, an agent acting on the company's
        behalf, or the system itself.
      oneOf:
        - type: object
          properties:
            kind:
              type: string
              enum:
                - user
            id:
              type: string
              format: uuid
            name:
              type: string
              nullable: true
            email:
              type: string
              nullable: true
          required:
            - kind
            - id
        - type: object
          properties:
            kind:
              type: string
              enum:
                - agent
            id:
              type: string
              format: uuid
            name:
              type: string
              nullable: true
          required:
            - kind
            - id
        - type: object
          properties:
            kind:
              type: string
              enum:
                - system
            id:
              type: 'null'
            name:
              type: 'null'
          required:
            - kind
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: >-
        An `aik_…` programmatic API key (app.atako.ai → Settings → API keys) or
        a Supabase session JWT.

````