Workspace activity history

GET

/workspaces/{id}/activity

const url = 'https://your-org.evershell.ai/v1/workspaces/example/activity?order=asc&limit=100';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://your-org.evershell.ai/v1/workspaces/example/activity?order=asc&limit=100' \
  --header 'Authorization: Bearer <token>'

Permissions: workspace:read or workspace:read:own (creator-match on :own).

Returns category=activity audit events scoped to this workspace — task lifecycle, agent events, workspace state changes. For pure audit (proxy decisions, config changes), use /workspaces/{id}/audit.

Response shape mirrors /audit: {events, cursor?}. Cursor is present when the page filled the requested limit; pass it back as ?cursor=... for the next page (mutually exclusive with after).

Two paging modes coexist:

cursor — precise composite keyset paging, same encoding as /audit (opaque; don’t construct or parse).
after — loose timestamp-only “events since this point”, used by SSE replay flows where the consumer dedups by event id.

Pass one or the other, not both.

Authorizations

bearerAuth

Parameters

Path Parameters

required

string

Query Parameters

task_id

string

Filter to events for one task.

event_type

string

Filter to a single event type (closed-enum).

after

string format: date-time

Loose “events strictly after this timestamp” — useful for SSE replay where exact resume isn’t needed. Mutually exclusive with cursor.

cursor

string

Opaque resume pointer returned by a previous page’s cursor field. Don’t construct or parse — pass it back verbatim. A malformed cursor returns 400 invalid_cursor.

order

string

default: asc

Allowed values: asc desc

limit

integer

default: 100 <= 10000

Responses

200

One page of activity events.

application/json

object

events

required

Array<object>

object

required

string

org_id

required

string

user_id

required

Real WorkOS user id for session-authenticated requests and proxy-emitted events; "system" for API-key-authenticated and WorkOS-webhook-driven events.

string

timestamp

required

string format: date-time

event_type

required

Closed-enum — see Audit events for the catalog

string

category

required

string

Allowed values: audit activity

actor

required

string

Allowed values: control-plane policy-engine agent

workspace_id

string

task_id

string

agent_role

Role name; populated only on workspace-scoped events.

string

agent_provider

Provider name; populated only on workspace-scoped events.

string

destination

string

method

string

path

string

decision

string

Allowed values: allow deny

reason

string

latency_ms

integer

transforms_applied

integer

validations_applied

integer

capability_name

string

phase

string

Allowed values: request_headers request_body response_headers response_body dns

policy_type

string

Allowed values: http dns

detail

object

key

additional properties

any

debits

object

key

additional properties

integer

budget_state

Per-counter snapshot at commit point (proxy allows).

object

key

additional properties

any

floored

Per-counter “ceiling applied” reasons (proxy allows).

object

key

additional properties

string

transforms_failed

Per-transform failure reasons.

object

key

additional properties

string

auth_used

Credential names whose mint succeeded on the request.

Array<string>

auth_failures

Per-credential mint failure reasons.

object

key

additional properties

string

cursor

Opaque resume pointer for the next page. Present only when the page filled the requested limit.

string

Example

{
  "events": [
    {
      "category": "audit",
      "actor": "control-plane",
      "decision": "allow",
      "phase": "request_headers",
      "policy_type": "http"
    }
  ]
}

400

Malformed cursor, or after and cursor both supplied.

application/json

object

error

required

object

code

required

Closed-enum slug (e.g. permission_denied, validation_error, workspace_not_found)

string

message

required

Human-readable summary

string

request_id

required

Server-generated request id for correlating logs

string

details

Optional structured context. Validation errors land at details.fields as a per-field map.

object

key

additional properties

any

Example

{
  "error": {
    "code": "permission_denied",
    "message": "caller lacks required scope",
    "request_id": "7f3a9c2e"
  }
}

404

Resource not found in the caller’s org

application/json

object

error

required

object

code

required

Closed-enum slug (e.g. permission_denied, validation_error, workspace_not_found)

string

message

required

Human-readable summary

string

request_id

required

Server-generated request id for correlating logs

string

details

Optional structured context. Validation errors land at details.fields as a per-field map.

object

key

additional properties

any

Example

{
  "error": {
    "code": "permission_denied",
    "message": "caller lacks required scope",
    "request_id": "7f3a9c2e"
  }
}