Users & agents

Audit log

What happened in your project, and what your agents read: one event per call that ran, newest first.

"Who wrote this memory, and what did the agent know when it decided?" Filter by user_id to get the events attributed to one end user: writes, edits, fact writes, corrections and forgets, end-user erasures, reads of one memory, and every read made with that user_id, with the memories and facts it returned. A read made without a user_id and a batch import carry user_id null: find them by target_id or in read. A read lists ids. To know what a fact said at that moment, read it with as_of set to the time of the event.

The log records ids, counts and short labels, never the text of a memory, a fact or a query. Erasing an end user or an agent namespace therefore removes its content for good, and the log still shows that it happened. Forgetting a single memory is recorded as erase too, but keeps the memory and its facts as history. Events are kept for 400 days.

Authentication

HTTP header, required: Authorization: Bearer kor_live_.... The key needs the memories:read scope. Reading the log does not count against your query quota, and the read is not itself written to the log.

A key sees only the events of its own account and its own project. A key without a project sees the events that have no project.

Query parameters

Example request

curl "https://api.korely.ai/v1/audit?user_id=customer-4812&limit=50" \
  -H "Authorization: Bearer kor_live_..."

import requests

r = requests.get(
    "https://api.korely.ai/v1/audit",
    params={"user_id": "customer-4812", "limit": 50},
    headers={"Authorization": "Bearer kor_live_..."},
)
for e in r.json()["events"]:
    print(e["ts"], e["action"], e["target_id"], (e.get("read") or {}).get("facts"))

const r = await fetch(
  "https://api.korely.ai/v1/audit?user_id=customer-4812&limit=50",
  { headers: { Authorization: "Bearer kor_live_..." } },
);
const { events, total } = await r.json();

Response

200 OK. The events, newest first, and how many match. The order is ts descending, then the event's internal id descending, so two events in the same instant keep one order and paging with offset is stable: a page neither repeats nor skips an event that was already there.

{
  "events": [
    {
      "ts": "2026-10-02T09:14:31.218Z",
      "actor": "rest",
      "action": "read",
      "result": "ok",
      "user_id": "customer-4812",
      "target_id": null,
      "meta": {"endpoint": "context", "tokens": 412, "degraded": false, "memories_read": 3, "facts_read": 2},
      "ip": "203.0.113.9",
      "read": {"memories": ["mem_8f2c1a", "mem_41d0e7", "mem_c9a0b2"], "facts": ["fct_a1", "fct_b7"]}
    },
    {
      "ts": "2026-10-02T09:12:05.004Z",
      "actor": "rest",
      "action": "write",
      "result": "ok",
      "user_id": "customer-4812",
      "target_id": "mem_c9a0b2",
      "meta": {"endpoint": "memories:add", "facts": 0},
      "ip": "203.0.113.9",
      "read": null
    }
  ],
  "total": 2
}

Errors