---
title: "overlane audit list"
description: "Read the tamper-evident audit log, a page at a time"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.overlane.app/llms.txt
> Use this file to discover all available pages before exploring further.

# overlane audit list

{/* Generated by apps/docs/scripts/generate.mjs (CLI pages from the command registry in packages/cli). Do not edit; run `pnpm --filter @overlane/docs gen`. */}

Lists audit rows in order: who did what, to what, with which result, and the hashes that chain the rows. Page with --after (the last sequence you saw). A team-wide agent token or a person who manages members can do this.

## Usage

```sh
overlane audit list [--after SEQUENCE] [--limit N] [--category CATEGORY] [--result RESULT] [--action ACTION] [--service URL] [--team TENANT_ID]
```

## Flags

| Flag | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| `--after` | string | no |  | Only rows after this sequence number (default 0) |
| `--limit` | string | no |  | Rows per page, 1 to 200 (default 50) |
| `--category` | one of `admin`, `policy`, `token` | no |  | Only rows of this category |
| `--result` | one of `success`, `denied`, `failure` | no |  | Only success, denied or failure |
| `--action` | string | no |  | Only this action, for example member.removed |
| `--service` | string | no |  | The service address (default: OVERLANE_SERVICE_URL, then the project's binding, then the hosted service) |
| `--team` | string | no |  | The team (tenant) to act on (default: the one your token belongs to) |

## Examples

```sh
overlane audit list
overlane audit list --result denied --limit 20
overlane audit list --after 120 --json
```

## Behavior

- Effect: `read` (changes nothing).
- Needs credentials: yes. Uses the network: yes.
- Supports `--dry-run`: no. Accepts `--force`: no.
- Machine-readable description: `overlane schema audit list`.

## Result

With `--json` (the default when stdout is not a terminal) the command prints this JSON Schema's shape on stdout.

```json
{
  "type": "object",
  "properties": {
    "tenantId": {
      "type": "string",
      "minLength": 1,
      "maxLength": 128,
      "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
      "description": "tenant identifier"
    },
    "events": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "tenantId": {
            "type": "string",
            "minLength": 1,
            "maxLength": 128,
            "pattern": "^[A-Za-z0-9][A-Za-z0-9_.:-]*$",
            "description": "tenant identifier"
          },
          "seq": {
            "type": "integer",
            "exclusiveMinimum": 0,
            "maximum": 9007199254740991
          },
          "eventId": {
            "type": "string",
            "minLength": 1,
            "maxLength": 64
          },
          "at": {
            "type": "string",
            "format": "date-time",
            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d:[0-5]\\d(?:\\.\\d+)?(?:Z|([+-](?:[01]\\d|2[0-3]):[0-5]\\d)))$"
          },
          "actor": {
            "type": "string",
            "minLength": 1,
            "maxLength": 200
          },
          "principalType": {
            "type": "string",
            "enum": [
              "user",
              "agent",
              "system"
            ]
          },
          "role": {
            "anyOf": [
              {
                "type": "string",
                "minLength": 1,
                "maxLength": 40
              },
              {
                "type": "null"
              }
            ]
          },
          "action": {
            "type": "string",
            "enum": [
              "member.removed",
              "member.role_changed",
              "invitation.created",
              "invitation.revoked",
              "run_policy.updated",
              "usage_policy.updated",
              "usage_policy.user_updated",
              "usage_events.deleted",
              "project.updated",
              "project.archived",
              "project.restored",
              "project.deleted",
              "project.purged",
              "project.merged",
              "task.updated",
              "task.cancelled",
              "task.archived",
              "task.restored",
              "task.deleted",
              "task.purged",
              "work_record.updated",
              "work_record.archived",
              "work_record.restored",
              "work_record.deleted",
              "work_record.purged",
              "loop.archived",
              "loop.restored",
              "release.published",
              "release.promoted",
              "release.withdrawn",
              "release.pinned",
              "release.rolled_back",
              "memory_settings.updated",
              "issue_sync.updated",
              "autonomy.changed",
              "task_policy.updated",
              "task_creation.updated",
              "loop.created",
              "loop.updated",
              "loop.deleted",
              "bot.registered",
              "bot.revoked",
              "bot.key_rotated",
              "token.created",
              "token.revoked",
              "sso.portal_link_issued",
              "directory.synced",
              "group_mapping.updated",
              "audit.exported",
              "siem_target.created",
              "siem_target.deleted",
              "residency.pinned",
              "residency.migration_requested",
              "byok.key_added",
              "byok.key_tested",
              "byok.key_rotated",
              "byok.key_revoked",
              "model_executor.added",
              "model_executor.removed",
              "model.called",
              "retention.updated",
              "retention.purged",
              "data.exported",
              "data.deleted",
              "restore.drill_run",
              "mcp_allowlist.updated",
              "repo.mirror_set",
              "repo.deleted",
              "branch_protection.updated",
              "ci_settings.updated",
              "ci_secret.set",
              "ci_secret.deleted",
              "check_definition.registered",
              "deploy_target.created",
              "deploy_target.updated",
              "deploy_target.deleted",
              "deploy_environment.created",
              "deploy_secret.set",
              "deploy_secret.deleted",
              "release.started",
              "channel_schedule.updated",
              "channel_preset.updated",
              "channel.promoted",
              "channel.held",
              "channel.hold_released",
              "channel.rolled_back",
              "decision_settings.updated",
              "claim_policy.updated",
              "budget.set",
              "budget.removed",
              "pr_routing_policy.updated",
              "release_promotion.updated",
              "egress_policy.updated",
              "agent_readonly.changed",
              "connector.connected",
              "connector.revoked",
              "mcp_server.added",
              "mcp_server.removed",
              "chat_user.mapped",
              "chat_user.linked",
              "connector.oauth_started",
              "bot_user.mapped",
              "skill.approved",
              "skill.rejected",
              "api_key.created",
              "api_key.revoked",
              "api_key.rotated",
              "webhook.created",
              "webhook.deleted",
              "webhook.rotated",
              "alert_rule.updated",
              "alert_rule.deleted",
              "observe_retention.purged",
              "observe_settings.updated",
              "feature_override.set",
              "feature_override.cleared",
              "operator.read",
              "billing_discount.granted",
              "billing_discount.revoked",
              "sign_in_invitation.added",
              "sign_in_invitation.removed",
              "workspace_channel.updated",
              "code_links.updated",
              "repo_access.set",
              "repo_access.cleared",
              "viewer_channel.updated"
            ]
          },
          "category": {
            "type": "string",
            "enum": [
              "admin",
              "policy",
              "token"
            ]
          },
          "target": {
            "type": "object",
            "properties": {
              "type": {
                "type": "string",
                "minLength": 1,
                "maxLength": 40
              },
              "id": {
                "type": "string",
                "maxLength": 200
              }
            },
            "required": [
              "type",
              "id"
            ],
            "additionalProperties": false
          },
          "result": {
            "type": "string",
            "enum": [
              "success",
              "denied",
              "failure"
            ]
          },
          "prevHash": {
            "type": "string",
            "pattern": "^[0-9a-f]{64}$"
          },
          "hash": {
            "type": "string",
            "pattern": "^[0-9a-f]{64}$"
          }
        },
        "required": [
          "tenantId",
          "seq",
          "eventId",
          "at",
          "actor",
          "principalType",
          "role",
          "action",
          "category",
          "target",
          "result",
          "prevHash",
          "hash"
        ],
        "additionalProperties": false
      }
    },
    "nextAfter": {
      "anyOf": [
        {
          "type": "integer",
          "minimum": 0,
          "maximum": 9007199254740991
        },
        {
          "type": "null"
        }
      ]
    },
    "head": {
      "anyOf": [
        {
          "type": "string",
          "pattern": "^[0-9a-f]{64}$"
        },
        {
          "type": "null"
        }
      ]
    }
  },
  "required": [
    "tenantId",
    "events",
    "nextAfter",
    "head"
  ],
  "additionalProperties": false
}
```

See [exit codes](/cli/#exit-codes) for the status the process returns.

Source: https://docs.overlane.app/cli/audit-list/index.mdx