# Audit Log

> MCP tools for the Audit Log module. See the [Audit Log module docs](/docs/modules/audit-log) for permissions and data model.

# Audit Log

MCP tools for the Audit Log module. See the [Audit Log module docs](/docs/modules/audit-log) for permissions and data model.

### `list-audit-entries`

List audit entries

#### Arguments

| Argument | Type | Required | Description |
| -------- | ---- | -------- | ----------- |
| `project_id` | `string` | no | Project ID (scopes results; required if not using project key auth for a specific project) |
| `action` | `string` | no | Exact permission-action string, e.g. `secrets:DeleteSecret` |
| `principal_id` | `string` | no | Public id of the principal (`user_…` or `key_…`) |
| `resource_public_id` | `string` | no | Exact target resource public id, e.g. `sec_…` |
| `resource_srn` | `string` | no | SRN prefix match, e.g. `srn:{project}:secret:`. The log is append-only, so a stored SRN is never rewritten; the filter matches it as stored. |
| `from` | `string` | no | Only entries created at or after this timestamp (ISO 8601) |
| `to` | `string` | no | Only entries created at or before this timestamp (ISO 8601) |
| `limit` | `number` | no | Number of results per page (1–200, default 25) |
| `offset` | `number` | no | Number of results to skip |

### `get-audit-entry`

Get an audit entry

#### Arguments

| Argument | Type | Required | Description |
| -------- | ---- | -------- | ----------- |
| `entry_id` | `string` | yes | Audit entry ID |