Audit rows were being written across the platform and there was no endpoint that returned them. The organization.audit.read permission was declared and passed to nothing.
There is now a keyset-paginated read with filters for action, actor, target and time range, plus a facet listing the actions actually present so a filter cannot be a typo that silently returns nothing.