GET /audit — retrieve the memory audit log

GET /audit returns a chronological log of every memory operation performed for a given user. Each entry records what action was taken, which app triggered it, which memory was affected, and a request_id you can use to correlate the entry with server-side logs.

Audit log availability depends on the provider. Check capabilities().features.supports_audit before calling this endpoint. Providers that do not support auditing will return an unsupported_capability error.

Query parameters

string

required

Return only audit entries for this user.

string

Filter entries to a specific application (e.g. cursor, chatgpt). Matches the app field from the memory’s source metadata.

string

ISO 8601 datetime. Return only entries at or after this timestamp.

integer

default:"100"

Maximum number of entries to return.

Response — 200 OK

AuditEntry[]

List of audit log entries, most recent first.

Show AuditEntry properties

string

ISO 8601 datetime when the operation occurred.

string

The application that triggered the operation, if known. null if not recorded.

string

The OMP verb that was executed. One of add, search, get, update, delete, list, or context.

string

The ID of the memory affected by the operation. null for operations that do not target a single memory (e.g. search, list).

string

The scope at the time of the operation, if applicable. null if not recorded.

string

Opaque identifier for the original request. Use this to correlate audit entries with server-side access logs.

Example

curl -s "http://localhost:8080/audit?user_id=u1&limit=3"

{
  "entries": [
    {
      "timestamp": "2026-04-27T12:05:00Z",
      "app": "cursor",
      "action": "search",
      "memory_id": null,
      "scope": "coding/preferences",
      "request_id": "req_search_001"
    },
    {
      "timestamp": "2026-04-27T11:42:00Z",
      "app": "cursor",
      "action": "add",
      "memory_id": "mem_abc123",
      "scope": "coding/preferences",
      "request_id": "req_add_001"
    },
    {
      "timestamp": "2026-04-27T11:10:00Z",
      "app": "chatgpt",
      "action": "get",
      "memory_id": "mem_def456",
      "scope": null,
      "request_id": "req_get_001"
    }
  ]
}

Filter by app

curl -s "http://localhost:8080/audit?user_id=u1&app=cursor&since=2026-04-27T00:00:00Z"

Use request_id to match an audit entry to the corresponding line in your server’s access log. This is the fastest way to debug unexpected reads or writes to a user’s memory.

Overview

Endpoints

GET /audit — retrieve the memory audit log

Query parameters

Response — 200 OK

Example

Filter by app

​Query parameters

​Response — 200 OK

​Example

​Filter by app

Query parameters

Response — 200 OK

Example

Filter by app