Audit log API

Read your team's audit log over the API. The audit log is a chronological record of significant actions in your team — who did what, and when — which makes it the backbone of any compliance export, security review or SIEM integration you want to build on top of Servor.

This endpoint requires the audit:read scope.

curl https://api.servor.app/v1/audit \
  -H "Authorization: Bearer sv_live_..."

[
  {
    "id": "uuid",
    "actionType": "incident.created",
    "resourceType": "incident",
    "resourceId": "uuid",
    "ipAddress": "203.0.113.10",
    "createdAt": "2026-08-20T10:00:00.000Z"
  }
]

What you get back

GET /v1/audit returns audit entries for your team, most recent first. Each entry captures an action and the actor who performed it, so you can answer "who changed this, and when?" long after the fact.

curl https://api.servor.app/v1/audit \
  -H "Authorization: Bearer sv_live_..."

Audit log vs. command history

Both are records of activity, but they answer different questions:

Use the audit log for team and account activity; use command history for the exact commands executed on a given server.

Notes

• The audit log never contains secrets, passphrases or encrypted payloads — only the fact that an action happened and who performed it.
• The same log is browsable in the dashboard — open the audit log in Servor.
• A 403 means your token is missing the audit:read scope. See errors for the full list of status codes.

See also