Audit Log API
Align records an append-only audit trail of mutations and access-control denials. Organization admins can retrieve it through a filterable API - a named SOC 2 monitoring control.
Endpoint
GET /admin/audit-logs
- Auth: authenticated request (session cookie or
Authorization: Bearer <token>), org_admin role required (403 otherwise). - Scope: results are restricted to the caller's tenant.
Query parameters
| Parameter | Type | Description |
|---|---|---|
action | string | Filter by action (e.g. decision.updated, access.denied). |
actor | string | Filter by the actor (user) who performed the action. |
resourceType | string | Filter by resource type. |
resourceId | uuid | Filter by a specific resource. |
from | ISO 8601 | Start of the time range. |
to | ISO 8601 | End of the time range. |
limit | int (1-1000) | Page size (default 100). |
offset | int | Pagination offset. |
Example
curl -s "$ALIGN_API/admin/audit-logs?action=decision.updated&from=2026-06-01T00:00:00Z&limit=50" \
-H "Authorization: Bearer $ADMIN_TOKEN"
Each entry includes the actor, action, resource, a details object, and a timestamp. Records under an active legal hold are preserved regardless of retention purges.