> ## Documentation Index > Fetch the complete documentation index at: https://docs.abundly.ai/llms.txt > Use this file to discover all available pages before exploring further. # Read the user action log > Who changed which agent, team or workspace setting, and when, newest first — the same rows as Usage › User action log in the portal, private and deleted agents included. Instruction, prompt and credential values are never stored: they appear as `«redacted:…»` tokens, which show that a value changed but not what it is — read `/agents/:agentId/instruction-versions` for the instruction text. Changes by Abundly staff show the actor as "Abundly staff" with object snapshots stripped. Filter with `agentId`, `eventType` (comma-separated), `actorUserId`, `from` and `to`; paginate with `page` and `pageSize` (default 50, max 200). ## OpenAPI ````yaml /api-reference/workspace-api.json get /workspaceapi/action-log openapi: 3.1.0 info: title: Abundly Workspace API description: >- Workspace-level and per-agent data and administration. GET endpoints need a workspace API key (wk_) with the Workspace read API scope; POST endpoints need the Workspace write API scope. The write endpoints are batch operations mirroring the Workspace Manager capability: ids travel in the JSON body, each id gets its own result, and per-id failures still return HTTP 200. Private agents are listed by /workspaceapi/agents but return 403 on every per-agent GET, so enumerate from /workspaceapi/agents?includeOverview=true rather than iterating agent ids. Write endpoints can target private agents. version: 1.0.0 servers: - url: https://service.abundly.ai description: Shared platform - url: https://{tenant}.service.abundly.ai description: Dedicated deployment variables: tenant: default: your-tenant security: - workspaceApiKey: [] paths: /workspaceapi/action-log: get: summary: Read the user action log description: >- Who changed which agent, team or workspace setting, and when, newest first — the same rows as Usage › User action log in the portal, private and deleted agents included. Instruction, prompt and credential values are never stored: they appear as `«redacted:…»` tokens, which show that a value changed but not what it is — read `/agents/:agentId/instruction-versions` for the instruction text. Changes by Abundly staff show the actor as "Abundly staff" with object snapshots stripped. Filter with `agentId`, `eventType` (comma-separated), `actorUserId`, `from` and `to`; paginate with `page` and `pageSize` (default 50, max 200). operationId: action-log parameters: - name: agentId in: query required: false description: Only changes to this agent. schema: type: string - name: eventType in: query required: false description: >- Comma-separated event types, e.g. "agent.instructions_changed,agent.capabilities_changed". schema: type: string - name: actorUserId in: query required: false description: Only changes made by this user. schema: type: string - name: from in: query required: false description: ISO date — only changes at or after this time. schema: type: string - name: to in: query required: false description: ISO date — only changes at or before this time. schema: type: string - name: page in: query required: false description: Page number (default 1). schema: type: integer minimum: 1 - name: pageSize in: query required: false description: Page size (default 50, max 200). schema: type: integer minimum: 1 maximum: 200 responses: '200': description: Success. Empty result sets are also 200. content: application/json: schema: description: >- Newest first. The id → name maps resolve ids referenced inside `data`. type: object properties: rows: type: array items: type: object properties: id: type: string timestamp: description: ISO 8601 timestamp. type: string eventType: description: >- `.`, e.g. "agent.instructions_changed". type: string source: description: >- "portal_api", "workspace_api", "agent_tool", "scheduler", "migration" or "admin_api" (Abundly staff). type: string data: description: >- Event-specific detail. Instruction, prompt and credential values are stored as `«redacted:…»` tokens, so they show that a value changed but never what it is. type: object properties: changedFields: type: array items: type: string before: {} after: {} additionalProperties: {} agentId: type: string agentName: type: string targetType: description: '"agent", "team" or "workspace".' type: string targetId: type: string teamName: type: string actorUserId: description: Null for system changes and Abundly staff rows. anyOf: - type: string - type: 'null' actorUserName: type: string actorUserEmail: type: string actorAgentId: description: >- Set instead of the user fields when an agent made the change. type: string actorAgentName: type: string staffRedacted: description: >- An Abundly staff change: the actor reads "Abundly staff" and snapshots are summarised. type: boolean redactedSummary: anyOf: - type: string - type: 'null' redactedDetailLines: type: array items: type: string required: - id - timestamp - eventType - source - data - targetType - targetId - actorUserId additionalProperties: {} totalCount: description: Rows matching the filters, across all pages. type: number page: type: number pageSize: type: number agentNamesById: type: object propertyNames: type: string additionalProperties: type: string userNamesById: type: object propertyNames: type: string additionalProperties: type: string groupNamesById: type: object propertyNames: type: string additionalProperties: type: string required: - rows - totalCount - page - pageSize additionalProperties: false '400': $ref: '#/components/responses/Error' '401': $ref: '#/components/responses/Error' '403': $ref: '#/components/responses/Error' '404': $ref: '#/components/responses/Error' components: responses: Error: description: >- Error. Every failure on this API returns JSON with a single `error` field. content: application/json: schema: type: object properties: error: description: >- Human-readable message. Every error on this API uses this shape. type: string required: - error additionalProperties: false securitySchemes: workspaceApiKey: type: http scheme: bearer description: >- Workspace API key (wk_). GET endpoints require the Workspace read API scope, POST endpoints the Workspace write API scope. ````