> ## Documentation Index
> Fetch the complete documentation index at: https://docs.openmem.blog/llms.txt
> Use this file to discover all available pages before exploring further.

# GET /audit — retrieve the memory audit log

> Query parameters, response schema, and examples for the OMP audit log endpoint, which records every memory operation by user and app.

`GET /audit` returns a chronological log of every memory operation performed for a given user. Each entry records what action was taken, which app triggered it, which memory was affected, and a `request_id` you can use to correlate the entry with server-side logs.

<Note>
  Audit log availability depends on the provider. Check `capabilities().features.supports_audit` before calling this endpoint. Providers that do not support auditing will return an `unsupported_capability` error.
</Note>

## Query parameters

<ParamField query="user_id" type="string" required>
  Return only audit entries for this user.
</ParamField>

<ParamField query="app" type="string">
  Filter entries to a specific application (e.g. `cursor`, `chatgpt`). Matches the `app` field from the memory's `source` metadata.
</ParamField>

<ParamField query="since" type="string">
  ISO 8601 datetime. Return only entries at or after this timestamp.
</ParamField>

<ParamField query="limit" type="integer" default="100">
  Maximum number of entries to return.
</ParamField>

## Response — 200 OK

<ResponseField name="entries" type="AuditEntry[]">
  List of audit log entries, most recent first.

  <Expandable title="AuditEntry properties">
    <ResponseField name="timestamp" type="string">
      ISO 8601 datetime when the operation occurred.
    </ResponseField>

    <ResponseField name="app" type="string">
      The application that triggered the operation, if known. `null` if not recorded.
    </ResponseField>

    <ResponseField name="action" type="string">
      The OMP verb that was executed. One of `add`, `search`, `get`, `update`, `delete`, `list`, or `context`.
    </ResponseField>

    <ResponseField name="memory_id" type="string">
      The ID of the memory affected by the operation. `null` for operations that do not target a single memory (e.g. `search`, `list`).
    </ResponseField>

    <ResponseField name="scope" type="string">
      The scope at the time of the operation, if applicable. `null` if not recorded.
    </ResponseField>

    <ResponseField name="request_id" type="string">
      Opaque identifier for the original request. Use this to correlate audit entries with server-side access logs.
    </ResponseField>
  </Expandable>
</ResponseField>

## Example

```bash theme={null}
curl -s "http://localhost:8080/audit?user_id=u1&limit=3"
```

```json theme={null}
{
  "entries": [
    {
      "timestamp": "2026-04-27T12:05:00Z",
      "app": "cursor",
      "action": "search",
      "memory_id": null,
      "scope": "coding/preferences",
      "request_id": "req_search_001"
    },
    {
      "timestamp": "2026-04-27T11:42:00Z",
      "app": "cursor",
      "action": "add",
      "memory_id": "mem_abc123",
      "scope": "coding/preferences",
      "request_id": "req_add_001"
    },
    {
      "timestamp": "2026-04-27T11:10:00Z",
      "app": "chatgpt",
      "action": "get",
      "memory_id": "mem_def456",
      "scope": null,
      "request_id": "req_get_001"
    }
  ]
}
```

### Filter by app

```bash theme={null}
curl -s "http://localhost:8080/audit?user_id=u1&app=cursor&since=2026-04-27T00:00:00Z"
```

<Tip>
  Use `request_id` to match an audit entry to the corresponding line in your server's access log. This is the fastest way to debug unexpected reads or writes to a user's memory.
</Tip>