Lists audit rows in order: who did what, to what, with which result, and the hashes that chain the rows. Page with –after (the last sequence you saw). A team-wide agent token or a person who manages members can do this.
Usage
overlane audit list [--after SEQUENCE] [--limit N] [--category CATEGORY] [--result RESULT] [--action ACTION] [--service URL] [--team TENANT_ID]Flags
| Flag | Type | Required | Default | Description |
|---|---|---|---|---|
--after |
string | no | Only rows after this sequence number (default 0) | |
--limit |
string | no | Rows per page, 1 to 200 (default 50) | |
--category |
one of admin, policy, token |
no | Only rows of this category | |
--result |
one of success, denied, failure |
no | Only success, denied or failure | |
--action |
string | no | Only this action, for example member.removed | |
--service |
string | no | The service address (default: OVERLANE_SERVICE_URL, then the project’s binding, then the hosted service) | |
--team |
string | no | The team (tenant) to act on (default: the one your token belongs to) |
Examples
overlane audit list
overlane audit list --result denied --limit 20
overlane audit list --after 120 --jsonBehavior
- Effect:
read(changes nothing). - Needs credentials: yes. Uses the network: yes.
- Supports
--dry-run: no. Accepts--force: no. - Machine-readable description:
overlane schema audit list.
Result
With --json (the default when stdout is not a terminal) the command prints this JSON Schema’s shape on stdout.
{
"type": "object",
"properties": {
"tenantId": {
"type": "string",
"minLength": 1,
"maxLength": 128,
"pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
"description": "tenant identifier"
},
"events": {
"type": "array",
"items": {
"type": "object",
"properties": {
"tenantId": {
"type": "string",
"minLength": 1,
"maxLength": 128,
"pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
"description": "tenant identifier"
},
"seq": {
"type": "integer",
"exclusiveMinimum": 0,
"maximum": 9007199254740991
},
"eventId": {
"type": "string",
"minLength": 1,
"maxLength": 64
},
"at": {
"type": "string",
"format": "date-time",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
},
"actor": {
"type": "string",
"minLength": 1,
"maxLength": 200
},
"principalType": {
"type": "string",
"enum": [
"user",
"agent",
"system"
]
},
"role": {
"anyOf": [
{
"type": "string",
"minLength": 1,
"maxLength": 40
},
{
"type": "null"
}
]
},
"action": {
"type": "string",
"enum": [
"member.removed",
"member.role_changed",
"invitation.created",
"invitation.revoked",
"run_policy.updated",
"usage_policy.updated",
"usage_policy.user_updated",
"usage_events.deleted",
"project.updated",
"project.archived",
"project.restored",
"project.deleted",
"project.purged",
"project.merged",
"task.updated",
"task.cancelled",
"task.archived",
"task.restored",
"task.deleted",
"task.purged",
"work_record.updated",
"work_record.archived",
"work_record.restored",
"work_record.deleted",
"work_record.purged",
"loop.archived",
"loop.restored",
"release.published",
"release.promoted",
"release.withdrawn",
"release.pinned",
"release.rolled_back",
"memory_settings.updated",
"issue_sync.updated",
"autonomy.changed",
"task_policy.updated",
"task_creation.updated",
"loop.created",
"loop.updated",
"loop.deleted",
"bot.registered",
"bot.revoked",
"bot.key_rotated",
"token.created",
"token.revoked",
"sso.portal_link_issued",
"directory.synced",
"group_mapping.updated",
"audit.exported",
"siem_target.created",
"siem_target.deleted",
"residency.pinned",
"residency.migration_requested",
"byok.key_added",
"byok.key_tested",
"byok.key_rotated",
"byok.key_revoked",
"model_executor.added",
"model_executor.removed",
"model.called",
"retention.updated",
"retention.purged",
"data.exported",
"data.deleted",
"restore.drill_run",
"mcp_allowlist.updated",
"repo.mirror_set",
"repo.deleted",
"branch_protection.updated",
"ci_settings.updated",
"ci_secret.set",
"ci_secret.deleted",
"check_definition.registered",
"deploy_target.created",
"deploy_target.updated",
"deploy_target.deleted",
"deploy_environment.created",
"deploy_secret.set",
"deploy_secret.deleted",
"release.started",
"channel_schedule.updated",
"channel_preset.updated",
"channel.promoted",
"channel.held",
"channel.hold_released",
"channel.rolled_back",
"decision_settings.updated",
"claim_policy.updated",
"budget.set",
"budget.removed",
"pr_routing_policy.updated",
"release_promotion.updated",
"egress_policy.updated",
"agent_readonly.changed",
"connector.connected",
"connector.revoked",
"mcp_server.added",
"mcp_server.removed",
"chat_user.mapped",
"chat_user.linked",
"connector.oauth_started",
"bot_user.mapped",
"skill.approved",
"skill.rejected",
"api_key.created",
"api_key.revoked",
"api_key.rotated",
"webhook.created",
"webhook.deleted",
"webhook.rotated",
"alert_rule.updated",
"alert_rule.deleted",
"observe_retention.purged",
"observe_settings.updated",
"feature_override.set",
"feature_override.cleared",
"operator.read",
"billing_discount.granted",
"billing_discount.revoked",
"sign_in_invitation.added",
"sign_in_invitation.removed",
"workspace_channel.updated",
"code_links.updated",
"repo_access.set",
"repo_access.cleared",
"viewer_channel.updated"
]
},
"category": {
"type": "string",
"enum": [
"admin",
"policy",
"token"
]
},
"target": {
"type": "object",
"properties": {
"type": {
"type": "string",
"minLength": 1,
"maxLength": 40
},
"id": {
"type": "string",
"maxLength": 200
}
},
"required": [
"type",
"id"
],
"additionalProperties": false
},
"result": {
"type": "string",
"enum": [
"success",
"denied",
"failure"
]
},
"prevHash": {
"type": "string",
"pattern": "^[0-9a-f]{64}$"
},
"hash": {
"type": "string",
"pattern": "^[0-9a-f]{64}$"
}
},
"required": [
"tenantId",
"seq",
"eventId",
"at",
"actor",
"principalType",
"role",
"action",
"category",
"target",
"result",
"prevHash",
"hash"
],
"additionalProperties": false
}
},
"nextAfter": {
"anyOf": [
{
"type": "integer",
"minimum": 0,
"maximum": 9007199254740991
},
{
"type": "null"
}
]
},
"head": {
"anyOf": [
{
"type": "string",
"pattern": "^[0-9a-f]{64}$"
},
{
"type": "null"
}
]
}
},
"required": [
"tenantId",
"events",
"nextAfter",
"head"
],
"additionalProperties": false
}See exit codes for the status the process returns.