Activity Log

6 endpoints.

Delete selected activity entries

DELETEhttp://localhost:3000/api/activity

Bulk delete by ID. Session-only — an API token of either role is refused, so a token cannot erase its own audit trail.

Request body

application/json

Responses

200How many entries were removed.

null

Server

This endpoint accepts a browser session only — the cookie set when you log in to your own instance. API tokens are refused by the server, so there is no token field here and the command above carries no Authorization header.

SendCopy as cURL

Your own instance address. Requests go from this browser straight to it.

List activity entries

GEThttp://localhost:3000/api/activity

A page of activity entries, newest first, scoped to what the caller is allowed to see (see this file’s header).

Entries whose target is an archive are annotated with whether that archive still exists, so a client can render “deleted since” instead of a dead link.

How access changes the result

• Which entries you receive depends on who you are. A browser session sees every entry. An administrator token sees the entries it produced itself, plus every entry produced by a guest token. A guest token sees only the entries it produced itself. A token holder is therefore looking at a subset of the log, not at the log — an empty result does not mean nothing happened.

Query parameters

cursorstringoptional

Opaque pagination cursor from a previous response's next_cursor.

limitinteger · min: 1 · max: 200 · default: 50optional

Clamped to a small fixed range regardless of what is asked for — an unbounded limit would let one request force an arbitrarily large scan.

start_tsintegeroptional

Only entries at or after this epoch-second timestamp.

end_tsintegeroptional

Only entries at or before this epoch-second timestamp.

actorstringoptional

Comma-separated actor keys; multiple values are OR'd together.

action_typestringoptional

Comma-separated action types; multiple values are OR'd together.

outcomestringoptional

Comma-separated outcomes; multiple values are OR'd together.

Responses

200One page of entries.

{
  "entries": [
    {}
  ],
  "next_cursor": "",
  "total_estimate": 0
}

ServerAPI token

cursorquerylimitquerystart_tsqueryend_tsqueryactorqueryaction_typequeryoutcomequery

SendCopy as cURL

Your own instance address. Requests go from this browser straight to it.

Delete one activity entry

DELETEhttp://localhost:3000/api/activity/{id}

Deletes a single entry by ID. Session-only, for the same reason the bulk delete is.

Path parameters

idstringrequired

Responses

200Deleted.

{
  "error": "",
  "operation": "",
  "success": 0,
  "successMessage": ""
}

404No entry with that ID.

{
  "error": "",
  "operation": "",
  "success": 0,
  "successMessage": ""
}

Server

idpath

This endpoint accepts a browser session only — the cookie set when you log in to your own instance. API tokens are refused by the server, so there is no token field here and the command above carries no Authorization header.

SendCopy as cURL

Your own instance address. Requests go from this browser straight to it.

List activity filter facets

GEThttp://localhost:3000/api/activity/facets

The distinct action types and actors present in the log, each with a count — so a client can build a filter UI from what is actually there rather than from a hardcoded list.

Like the list endpoint, this is scoped to what the caller may see: an actor only appears if the caller could read that actor’s entries.

Responses

200The available facets.

{
  "action_types": [
    {}
  ],
  "actors": [
    {}
  ]
}

ServerAPI token

SendCopy as cURL

Your own instance address. Requests go from this browser straight to it.

Read the activity retention window

GEThttp://localhost:3000/api/activity/retention

How long activity entries are kept, in seconds.

Responses

200The current window.

{
  "retention_secs": 0
}

ServerAPI token

SendCopy as cURL

Your own instance address. Requests go from this browser straight to it.

Set the activity retention window

PUThttp://localhost:3000/api/activity/retention

Changes how long activity entries are kept. Session-only: a token must not be able to shorten how long its own trail survives.

Request body

application/json

Responses

200Stored.

{
  "error": "",
  "operation": "",
  "success": 0,
  "successMessage": ""
}

Server

This endpoint accepts a browser session only — the cookie set when you log in to your own instance. API tokens are refused by the server, so there is no token field here and the command above carries no Authorization header.

SendCopy as cURL

Your own instance address. Requests go from this browser straight to it.