Tenants can read their own audit log

August 5, 2026

Audit rows were being written across the platform and there was no endpoint that returned them. The organization.audit.read permission was declared and passed to nothing.

There is now a keyset-paginated read with filters for action, actor, target and time range, plus a facet listing the actions actually present so a filter cannot be a typo that silently returns nothing.