Skip to main content
GET
List API requests
Returns the log of API requests made with your organization’s API keys, newest first. Use it to find out what a failing request looked like, which key sent it, and why it was rejected.
This endpoint takes no organizationId in the URL. Authenticate with either an API key (the organization resolves automatically from the key) or a Supabase Bearer session (send the X-Organization-Id: <org-id> header — the user must be an owner or admin of that organization).

What is recorded

  • Requests authenticated with an API key (X-API-Key: sk_... or Authorization: Bearer sk_...).
  • Rejected requests whose key really exists, with authFailure set to the reason: inactive (revoked key), expired, ip_not_allowed or missing_scope.
  • 429 rate-limited requests made with a known key.

What is not recorded

  • Requests made from the dashboard (session).
  • Requests with an unknown key.
  • Request bodies and the bodies of successful responses.
  • OPTIONS, health and docs routes.
Records are kept for 30 days.

Authentication

Accepts either:
  • An API key (X-API-Key: sk_...) with the read:request-logs scope — the organization is resolved from the key itself.
  • A Supabase Bearer session (Authorization: Bearer <token>) with the X-Organization-Id: <org-id> header — the authenticated user must be an owner or admin of that organization. A member gets 403 Forbidden.

Query Parameters

Pagination

The response includes nextCursor. Send it as cursor to get the next page. When nextCursor is null there are no more results.

Example Request

With a session, pass the organization as the second argument:

Example Response

apiKey is null when the key was deleted after the request was made.

Common Errors

400 Bad Request

Invalid from/to range (or more than 30 days), invalid cursor, or a filter with an unsupported value. Also returned when X-Organization-Id is missing on a session-authenticated request.

401 Unauthorized

Missing or invalid Bearer token / API key.

403 Forbidden

The authenticated user is not an owner or admin of the organization, or the API key does not have the read:request-logs scope.

Authorizations

X-API-Key
string
header
required

API Key for authentication (format: sk_...)

Headers

X-Organization-Id
string

Required for Supabase session auth (owner or admin). Ignored with an API key.

Query Parameters

from
string

Inicio (ISO 8601). Default: to - 24 h

to
string

Fin (ISO 8601). Default: ahora

status
string

Lista separada por comas de clases (2xx, 4xx, 5xx) y códigos exactos. Hasta 20.

Example:

"4xx,500"

method
string

Lista separada por comas de GET, POST, PUT, PATCH, DELETE.

Example:

"GET,POST"

q
string

Busca en el path real (contiene, sin distinguir mayúsculas).

Example:

"/invoices"

route
string
Example:

"/invoices/:uuid"

apiKeyId
string
environment
enum<string>
Available options:
sandbox,
production
channel
enum<string>
Available options:
web,
api,
sdk,
cli,
mcp
authFailure
enum<string>
Available options:
any,
inactive,
expired,
ip_not_allowed,
missing_scope
minDurationMs
number
Required range: 0 <= x <= 600000
maxDurationMs
number
Required range: 0 <= x <= 600000
cursor
string

nextCursor de la página anterior

limit
number
default:50
Required range: 1 <= x <= 100

Response

200 - application/json
data
object[]
required
nextCursor
object | null