Filter by resource type. Accepts a comma-separated set; members are trimmed and deduplicated, and member order affects neither the result nor the cursor.
--resource-id <value>
No
Filter by exact resource identifier.
--start-date <value>
No
Include audit entries created at or after this UTC ISO 8601 timestamp, such as 2026-08-06T00:00:00Z. Dates without a time, timestamps with an offset instead of Z, and year 0000 are rejected.
--end-date <value>
No
Include audit entries created at or before this UTC ISO 8601 timestamp, such as 2026-08-06T00:00:00Z. Dates without a time, timestamps with an offset instead of Z, and year 0000 are rejected.
--include-departed
No
Include actions by users who have left the organization.
--no-include-departed
No
Send --include-departed as false.
--limit <n>
No
Maximum items to return (0 for everything). Defaults to 100.
--cursor <value>
No
Continue from nextCursor returned by a previous result.
--organization <value>
No
Organization whose audit trail to read; defaults to the caller’s organization. A caller that belongs to no organization, or names one it does not belong to, is refused with 403.
--actor-email <value>
No
Filter by actor email address.
--all-workspaces
No
Do not filter to the configured workspace (OAuth login or personal API key required for account-wide access).
Organization whose audit trail to read; defaults to the caller’s organization. A caller that belongs to no organization, or names one it does not belong to, is refused with 403.
