How to read your Runtime audit log

Owners and admins open Audit log in the account, or call GET /v1/audit with a key an owner or admin made, filtered by action.

On Runtime the audit log comes with every account at no charge, and entries are kept for at least 400 days. Nobody can edit an entry or delete one before then. Each records the action, who did it, the time, the client's IP address, the request id and whether it came through the website, the API or MCP, as of 25 September 2026 (teams).

Read it in the browser

Sign in as an owner or admin and open Audit log. Developers and billing members do not see it.

Read it from a terminal

Terminalnpx withruntime audit                          # newest firstnpx withruntime audit --action key.            # only key eventsnpx withruntime audit --action member. --limit 100npx withruntime audit --before <next>          # the page after that

Or with curl:

Terminalcurl -sS -H "Authorization: Bearer ${RUNTIME_API_KEY}" \  "https://api.withruntime.com/v1/audit?action=secret.&limit=200"

Read it from code

Page back through every credit event, 200 at a time:

TypeScriptimport { Runtime } from "withruntime";const runtime = new Runtime();let before: string | undefined;do {  const page = await runtime.audit.list({    action: "credit.",    limit: 200,    ...(before ? { before } : {}),  });  for (const event of page.events) console.log(event);  before = page.next ?? undefined;} while (before);

Pythonfrom withruntime import Runtimewith Runtime() as runtime:    before = None    while True:        page = runtime.audit.list(action="credit.", limit=200, before=before)        for event in page["events"]:            print(event)        before = page["next"]        if not before:            break

An agent reads the same log with the runtime_audit_list MCP tool, which takes the same filters.

Options

The groups you can filter on:

Who did it

The actor on an entry is a person, a key, your directory, or Runtime itself for things like a card payment settling. Each key is its own agent, so when three CI jobs and a coding agent share an account, the log says which key changed a network rule or revoked another key.

Questions it answers

• Who revoked the CI key? Filter key. and look for the revocation.
• Who gave a contractor admin? Filter member. for the role change.
• Was a secret's value ever shown? Filter secret. for a reveal. The log records the event, never the value.
• Which address approved a new agent connection? Filter connection.; each entry carries the client IP.
• What did our directory change overnight? Filter scim..

Mistakes and how Runtime handles them

• Looking for sandbox starts and stops. They are not in the audit log. Each sandbox has its own history: use runtime events or the metrics and events API.
• Reading with a developer's key. Runtime answers 403 forbidden. The key must be made by an owner or admin.
• Reading with a key limited to selected actions. Also 403. Use a key with full access, or a read-only key, which is the safer choice for a dashboard or an export job.
• Expecting a {data, nextCursor} page. The audit log answers events and next; pass next back as before.

A read-only key made by an admin is the right credential for shipping the log to a SIEM on a schedule: it reads every entry and can change nothing.

Related

• How to invite your team and how to set up single sign-on, whose changes all land here
• Security for read-only keys
• HTTPS API reference

Facts on this page were checked on 25 September 2026.