Audit Logs | ZopDev Developer Docs

Audit logs record every change made inside an org through the ZopNight UI or the public API, and every MCP tool call an AI assistant makes on your behalf. Each entry is an HTTP-level record: who made the request, the method and path, the request and response bodies, the status code and, for failures, an error message. Logs can be filtered, paged, and exported.

Filtering by Product Area

Entries are not tagged with a product area. To narrow the list to one area, filter on the request path with the resource parameter (a path substring), for example resource=schedules or resource=deployments. The audit view in the app uses the same path-based filtering.

List Audit Logs

GET /audit-logs

List audit log entries with filtering and pagination.

Query Parameters

Parameter	Description
`method`	Filter by HTTP method (`POST`, `PUT`, `PATCH`, `DELETE`)
`resource`	Filter by a substring of the request path (e.g. `schedules`)
`status`	Filter by response status code
`user`	Filter by the acting user’s email
`search`	Free-text search
`source`	Origin of the request, comma-separated: `ui`, `api`, `mcp`, `internal`, `unknown`. An unknown value returns `400`
`startDate`	Start of the time range, `YYYY-MM-DD`
`endDate`	End of the time range, `YYYY-MM-DD`
`sort_order`	`asc` or `desc`
`page`	Page number (default: 1)
`size`	Items per page (default: 20, max: 100). `limit` is accepted as an alias

curl "https://api.zop.dev/audit-logs?resource=schedules&method=DELETE&startDate=2026-04-01&endDate=2026-04-30&page=1&size=50" \
  -H "Authorization: Bearer <token>"

{
  "data": {
    "items": [
      {
        "id": "9a7c3e1f-4b2d-4f6a-8e5c-1d3b2a4c6e8f",
        "orgId": "3f6c2a9e-8b1d-4c7e-9f2a-1d5e6b7c8a90",
        "userEmail": "user@company.com",
        "method": "DELETE",
        "path": "/schedules/7c1e4b2a-5d3f-4a6b-9c8d-2e1f0a3b4c5d",
        "statusCode": 200,
        "source": "ui",
        "createdAt": "2026-04-29T11:30:00Z"
      },
      {
        "id": "2e4d6f8a-1c3b-4a5d-9e7f-6b8a0c2d4e6f",
        "orgId": "3f6c2a9e-8b1d-4c7e-9f2a-1d5e6b7c8a90",
        "userEmail": "user@company.com",
        "method": "POST",
        "path": "/overrides",
        "statusCode": 400,
        "errorMessage": "resource_uid is required",
        "source": "mcp",
        "tool": "create_override",
        "sessionId": "...",
        "createdAt": "2026-04-29T11:25:00Z"
      }
    ],
    "total": 8421,
    "page": 1,
    "limit": 50
  }
}

Audit Log Object

Field	Description
`id`, `orgId`	Entry and organization IDs
`userEmail`	Who made the request
`method`, `path`	The HTTP request
`body`, `responseBody`	Request and response bodies, when captured. Bodies on secret-carrying paths (cloud accounts, connect, integrations, AI keys, app secrets, basic auth, notification channels) are not captured at all; MCP tool calls redact their declared secret arguments. Large bodies are truncated
`statusCode`	Response status
`errorMessage`	For failed requests, the error message taken from the response
`source`	`ui`, `api`, `mcp`, `internal` or `unknown`
`tool`, `sessionId`, `resourceUid`	MCP calls only: the tool, the MCP session and the target resource
`client`, `patId`	Reserved for the MCP client name and the token used. Not populated yet: always empty
`createdAt`	When the request was made

Export

POST /audit-logs/export

Export audit logs matching a filter as CSV. The export runs in the background and a download link is emailed to you.

The body takes the same filters as the list endpoint. The request returns immediately; when the CSV is ready you receive an email with a signed download link.

curl -X POST https://api.zop.dev/audit-logs/export \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{
    "resource": "deployments",
    "startDate": "2026-04-01",
    "endDate": "2026-04-30"
  }'

{
  "data": {
    "message": "Export in progress. You'll receive an email shortly."
  }
}

See Roles & Permissions for who can read and export audit logs.