Export the audit log

The audit log records what happened in an organisation and who did it. The portal's audit log page shows the latest 100 events. The API pages through the whole history, so you can keep a copy or feed it to another system.

You need to be an owner or admin of the organisation.

The examples use the variables set in Make your first calls: BASE, BREQWATR_API_KEY and ORG_ID.

1. Read a page

curl -s -G "$BASE/orgs/$ORG_ID/audit_events" \
  -H "Authorization: Bearer $BREQWATR_API_KEY" \
  --data-urlencode "limit=100" | jq

{
  "data": [
    {
      "id": "c41e8b07-2fd6-49a3-b1e8-5d06a7c3f912",
      "action": "project.created",
      "description": "Created project web",
      "actor": "Sam Lee",
      "project_id": "a9d27e10-64b3-4f18-8c05-71e3f6ab20d9",
      "created_at": "2026-09-14T15:04:05Z"
    }
  ],
  "next_cursor": "MjAyNi0wOS0xNFQxNTowNDowNS4wMDBaLGM0MWU4YjA3"
}

Events come newest first. action is a stable code, so match on it. description is a sentence in your language and may change.

2. Read every page into a file

Pass each page's next_cursor back as cursor until it's null, as Pagination explains. This writes one event per line, as JSON Lines:

cursor=""
: > audit.jsonl
while :; do
  page=$(curl -s -G "$BASE/orgs/$ORG_ID/audit_events" \
    -H "Authorization: Bearer $BREQWATR_API_KEY" \
    --data-urlencode "limit=100" \
    ${cursor:+--data-urlencode "cursor=$cursor"})
  echo "$page" | jq -c '.data[]' >> audit.jsonl
  cursor=$(echo "$page" | jq -r '.next_cursor // empty')
  [ -z "$cursor" ] && break
done
wc -l audit.jsonl

A large history can take many requests. Each key may make 600 requests a minute; if you go over, the API answers 429 rate_limited with Retry-After, as Rate limits explains.

3. Export one kind of event

Pass action_type to keep only one action:

curl -s -G "$BASE/orgs/$ORG_ID/audit_events" \
  -H "Authorization: Bearer $BREQWATR_API_KEY" \
  --data-urlencode "action_type=membership.removed" | jq

Add the same parameter to the loop in step 2 to export every event of that kind. Some actions to start with:

Action	Recorded when
project.created	A project is created
project.deleted	A project is deleted
membership.role_changed	A member's role changes
membership.removed	Someone is removed from the organisation
invitation.created	Someone is invited

4. Pick up where you left off

Because events come newest first, a later export starts with whatever happened since the last one. To add only new events to a copy you already have, stop reading once you reach an event whose id is already in your file.