How to read your Runtime audit log

On Runtime, the audit log comes with every account at no charge. Entries are kept for at least 400 days. Nobody can edit or delete an entry before then. Each entry records the action, its actor, the time, the client's IP address, the request ID, and whether the request came through the website, the API or MCP. This is the state as of 26 October 2026 (teams).

Read it in the browser

Sign in as an owner or admin, and open Audit log. Developers and billing members cannot see it.

Read it from a terminal

Terminalnpx withruntime audit                          # newest firstnpx withruntime audit --action key.            # only key eventsnpx withruntime audit --action member. --limit 100npx withruntime audit --before <next>          # the page after that

Or use curl:

Terminalcurl -sS -H "Authorization: Bearer ${RUNTIME_API_KEY}" \  "https://api.withruntime.com/v1/audit?action=secret.&limit=200"

Read it from code

Read every credit event, 200 entries per page:

TypeScriptimport { Runtime } from "withruntime";const runtime = new Runtime();let before: string | undefined;do {  const page = await runtime.audit.list({    action: "credit.",    limit: 200,    ...(before ? { before } : {}),  });  for (const event of page.events) console.log(event);  before = page.next ?? undefined;} while (before);

Pythonfrom withruntime import Runtimewith Runtime() as runtime:    before = None    while True:        page = runtime.audit.list(action="credit.", limit=200, before=before)        for event in page["events"]:            print(event)        before = page["next"]        if not before:            break

An agent reads the same log with the runtime_audit_list MCP tool. The tool takes the same filters.

Options

You can filter on these groups:

Who did it

The actor on an entry is a person, a key, your directory, or Runtime itself. Runtime is the actor for events such as a card payment settling. Each key acts as its own agent. When three CI jobs and a coding agent share an account, the log shows which key changed a network rule or revoked another key.

Questions it answers

• Who revoked the CI key? Filter key. and find the revocation.
• Who gave a contractor admin? Filter member. for the role change.
• Was a secret's value ever shown? Filter secret. for a reveal. The log records the event, not the value.
• Which address approved a new agent connection? Filter connection.. Each entry includes the client IP.
• What did our directory change overnight? Filter scim..
• Who paused that sandbox? Filter resource.paused. An idle pause names Runtime and shows that the sandbox was idle.

Mistakes and how Runtime handles them

• Looking for what a sandbox did on its own. Its pauses, wakes, restarts and stops are in the audit log under resource., with the actor who requested them. Its boots, failures and moves are in its own history. Use runtime events or the metrics and events API.
• Reading with a developer's key. Runtime returns 403 forbidden. The key must be made by an owner or admin.
• Reading with a key limited to selected actions. Also 403. Use a key with full access, or a read-only key. A read-only key is the safer choice for a dashboard or an export job.
• Expecting a {data, nextCursor} page. The audit log returns events and next. Pass next back as before.

A read-only key made by an admin is the right credential for sending the log to a SIEM on a schedule. It can read every entry and cannot change anything.

Related

• How to invite your team and how to set up single sign-on, whose changes all appear here
• Security for read-only keys
• HTTPS API reference

Facts on this page were checked on 26 October 2026.