Audit log

Every file action writes one row in the audit log. The log is append-only — rows are never updated or deleted, even when the file itself is removed.

Object shape

{
  "id": "01HW…",
  "object": "audit_log_entry",
  "file": "01HW…",
  "actor": "user_01HW…",
  "action": "download",
  "metadata": { "attachment": true, "via": "api" },
  "ip_address": null,
  "user_agent": null,
  "created_at": "2026-05-24T12:00:00.000Z"
}

Possible action values:

• upload
• download
• rename
• move
• delete
• share (reserved for future use)

file is null when the file has been deleted — the row survives, but the file-pointer is dropped.

Endpoints

GET /v1/audit_log                  ?file=:id (filter by file)

Cursor-paginated. See Pagination.

Use cases

• Compliance. "Show me everyone who downloaded the contracts folder last month."
• Incident response. "Was anything accessed after this credential leak?"
• Internal billing. Knowing which integrations are downloading the most data.

→ Quickstarts