List activity for an end user.
curl --request GET \ --url https://auth.example.com/api/admin/users/example/activity-log \ --header 'Authorization: Bearer <token>'List audit activity for a single user using hot audit storage when configured. Retained whole-row archives are included in supported log queries. A bounded query that cannot read its required rows returns log_query_incomplete instead of partial statistics or an empty success.
Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ”Header Parameters
Section titled “Header Parameters ”Tenant selector for multi-tenant admin requests.
Query Parameters
Section titled “Query Parameters ”Responses
Section titled “ Responses ”User activity log response.
object
object
Unix timestamp in milliseconds.
object
Example
{ "data": [ { "id": "audit_123", "action": "auth.login", "details": { "result": "success", "client_id": "web-app", "session_id": "sess_123", "request_id": "req_123" }, "timestamp": 1770000000000, "ip_address": "203.0.113.10", "user_agent": "Mozilla/5.0" } ], "pagination": { "has_more": false }}Headers
Section titled “Headers ”Snapshot for the remote scheduled view; eventual when Pipeline visibility can lag ingestion; local_hot_only for local scheduled staging without a remote Catalog.
Tenant deliveries not yet confirmed visible. Omitted for self-service subjects. Zero does not guarantee immediate Pipeline visibility.
True only for a complete bounded snapshot query. Pipeline responses remain false; incomplete reads return 503.
Error response.
object
Example generated
{ "error": "example", "message": "example", "error_description": "example"}Error response.
object
Example generated
{ "error": "example", "message": "example", "error_description": "example"}The retained log query is incomplete. No partial entries or statistics are returned as a successful result. Narrow the period or retry.
object
Example
{ "error": "log_query_incomplete", "complete": false}