---
title: WatchFor activity log API
description: GET /v1/activity — the organization's audit trail (who changed what, when) with free-text search, entity and time filters, and cursor pagination.
canonical: https://watchfor.io/docs/api/activity
---

# WatchFor activity log API

GET /v1/activity — the organization's audit trail (who changed what, when) with free-text search, entity and time filters, and cursor pagination.

| Method | Path | Scope | operationId |
| --- | --- | --- | --- |
| GET | `/v1/activity` | read | `listActivity` |

The same events as the dashboard's
[Activity Log](/docs/organization/activity-log): every create, update,
delete, pause, acknowledge and similar action on monitors, alert rules,
contacts, contact groups, maintenance windows, status pages,
notification channels, API keys, report schedules and incidents — whether
it came from the dashboard, an API key, an MCP tool or an A2A skill.
Read-only; events are written by the platform.

The activity event:

```json
{
  "id": "c1d2e3f4-…",
  "object": "activity_event",
  "entity_type": "monitor",
  "entity_id": "0b0f6a41-…",
  "entity_name": "Marketing site",
  "action": "monitor.updated",
  "changes": { "interval": { "before": 60, "after": 300 } },
  "actor": { "name": "API key: CI deploy", "email": null },
  "created_at": "2026-08-24T14:03:11.000Z"
}
```

| Field | Meaning |
| --- | --- |
| `entity_type` | `monitor`, `alert_rule`, `contact`, `contact_group`, `maintenance_window`, `status_page`, `notification_channel`, `api_key`, `report_schedule`, `incident`, … |
| `entity_id` | The entity's id (`null` for organization-level events) |
| `entity_name` | The entity's current display name; for entities that no longer exist, the name captured at create/delete time |
| `action` | `<entity>.<verb>`, e.g. `monitor.created`, `monitor.paused`, `monitor.reset`, `alert_rule.disabled`, `incident.acknowledged`, `incident.excluded_from_uptime`, `contact_group.deleted`, `member.invitation_revoked`, `api_key.renamed`. Bulk pause/resume/delete write one row **per monitor** (the batch size is in the row's metadata), not one summary row |
| `changes` | For updates, only the changed fields as `{ "field": { "before", "after" } }`; for creates/deletes a small snapshot (name, type, target, …); `null` for actions with no payload such as `incident.acknowledged` |
| `actor` | Who did it — a dashboard user (`name` + `email`), `API key: <name>` for keys, `Name (via OAuth)` for OAuth tokens; `null` for system events |

## List activity

`GET /v1/activity` — newest first, keyset cursor pagination (stable even
while new events arrive).

| Query | Meaning |
| --- | --- |
| `q` | Free-text search over the action, actor name/email **and** the JSON change details. Also matches by the *current* name of an entity, so searching "Marketing site" finds its update events even when the change itself did not mention the name |
| `entity_type` | One entity type, e.g. `monitor` |
| `entity_id` | One entity's full history |
| `since` / `until` | ISO 8601 bounds on `created_at` |
| `limit` | 1–100, default 50; anything else, or a `sort` parameter, returns `400` |
| `cursor` | The previous page's `next_cursor` |

```bash
curl "https://watchfor.io/api/v1/activity?entity_type=monitor&since=2026-08-24T00:00:00Z" \
  -H "Authorization: Bearer wf_live_YOUR_KEY"
```

```json
{
  "object": "list",
  "data": [ { "id": "c1d2e3f4-…", "object": "activity_event", "…": "…" } ],
  "has_more": true,
  "next_cursor": "YzFkMmUz…"
}
```

## Typical uses

- **Correlate an incident with a change** — list activity for the
  incident's monitor with `since` a little before `started_at`.
- **Change review** — `?q=alert_rule` or `?entity_type=alert_rule` to see
  who loosened a threshold.
- **Key hygiene** — `?entity_type=api_key` shows key creation and
  revocation; `?q=API key:` shows everything keys did.

Also available as the MCP tool `list_activity`.

---

Canonical page: https://watchfor.io/docs/api/activity · All docs: https://watchfor.io/docs · Site guide: https://watchfor.io/llms.txt