GET /v1/audit-log

Returns the partner-visible audit trail for the calling org: one row per material action (API request, auth event, mutation, kill-switch flip). The schema is designed to feed your own compliance review or SIEM without a support ticket — Layers itself does not publish a SOC 2 attestation today; see Certifications.

Rows are newest-first. Cursor-paginated using a keyset on (occurredAt DESC, eventId ASC) so deep iteration stays fast regardless of offset. Default limit 50, max 200. The cursor is opaque base64-url; treat it as a black box and pass it back unmodified on the next call.

Example

# Every auth failure in the last hour
curl "https://api.layers.com/v1/audit-log?eventType=auth.key_rejected&since=$(date -u -v-1H +%Y-%m-%dT%H:%M:%SZ)&limit=100" \
  -H "X-Api-Key: $LAYERS_API_KEY"

{
  "items": [
    {
      "eventId": "7c2f1a3e-0b4c-4a11-9f7e-33c0a2c1bd55",
      "eventType": "api.request",
      "occurredAt": "2026-04-20T18:14:02.187Z",
      "requestId": "req_01HXA1NHKJZXPV8R7Q6WSM5BCD",
      "organizationId": "2481fa5c-a404-44ed-a561-565392499abc",
      "projectId": "254a4ce1-f4ca-42b1-9e36-17ca45ef3d39",
      "apiKeyId": "c2037bb9-354d-4662-96b7-97a28ad6b6e1",
      "actor": "partner_api",
      "data": {
        "path": "/api/partner/v1/projects/254a4ce1.../content",
        "method": "POST",
        "status": 202,
        "latency_ms": 1907,
        "endpoint_class": "long-running"
      },
      "piiRedacted": true,
      "schemaVersion": 1
    }
  ],
  "nextCursor": "eyJvY2N1cnJlZEF0IjoiMjAyNi0wNC0yMFQxODoxNDowMi4xODdaIiwiZXZlbnRJZCI6IjdjMmYxYTNlLTBiNGMtNGExMS05ZjdlLTMzYzBhMmMxYmQ1NSJ9"
}

Use cases

• Compliance review — pull a time-bounded CSV via cursor iteration for your own audit-evidence needs.
• Leaked-key forensics — filter on apiKeyId to get every call the key made before you revoked it.
• Incident response — since=<30min ago>&eventType=auth.kill_switch_tripped shows exactly what fired when.
• Partner-side dashboards — mirror Layers' audit trail into your own SIEM without a support ticket.

Retention

Layers' retention commitment for partner-visible audit events:

For longer-than-2-year retention needs (for example, 7-year retention under your own compliance program): stream events to your own SIEM in real time. The api.request event carries every field needed to reconstruct a request (requestId, apiKeyId, path, method, status, latency_ms, endpoint_class, occurredAt). Layers does not today offer 7-year retention on our side; partners treating this endpoint as their system-of-record should mirror events to a pipeline under their own control.

Longer Layers-side retention (up to 2 years hot, 7 years cold) is available on the Enterprise tier under contract. Contact legal@layers.com.

Errors

See also

• Errors — canonical event-type catalog
• Security & compliance