Audit Logs

Audit logs record security-relevant and administrative actions performed in your OneCal Team, such as sign-ins, membership changes, sync updates, and API key changes. On this page, we'll look at how to list audit log events and filter them programmatically.

Only API keys belonging to users with the OWNER, ADMIN, or BILLING_ONLY role can access audit logs. Audit events are only recorded for teams with at least two members.

The Audit Log Event model

Properties

Name
id
Type
string
Description
Unique identifier for the audit log event.
Name
createdAt
Type
timestamp
Description
Timestamp of when the action happened.
Name
category
Type
enum
Description
Category of the action. Possible values: SECURITY, SYNC_CONFIG, BOOKING_LINKS, BOOKING_PAGES, CALENDARS, ACCESS_CONTROL, BILLING, WORKFLOWS, API_KEYS, MCP.
Name
action
Type
string
Description
The action that was performed, for example LOG_IN, MEMBERSHIP_REMOVED, or SYNC_CONFIG_UPDATED. See Actions for the full list.
Name
details
Type
object | null
Description
Event-specific details. When present, details.subject describes the entity the action concerns, with a type, an optional id, and an optional human-readable label. The subject is a snapshot taken when the action happened, so it stays meaningful even if the entity is later renamed or deleted.
Name
actor
Type
object
Description
Who performed the action. actor.kind is one of: user (a team member, with id, name, and email), system (an automated action such as a webhook or background job), or deleted (a user who has since been deleted).
Some automated events are attributed to the team member they concern rather than to system, so you can find them by filtering on that member: CALENDAR_CONNECTION_EXPIRED is attributed to the owner of the calendar connection, and SYNC_CONFIG_FAILED and SYNC_CONFIG_REPAIRED to the owner of the sync. impersonatedBy is always null for these events.
Name
impersonatedBy
Type
object | null
Description
Set when the action was performed by an administrator impersonating the actor. When impersonatedBy.masked is false, the impersonator's name and email are included. When masked is true, the impersonator was a OneCal system administrator or is no longer a member of your team, and no identifying details are returned.

GET/v1/audit-logs

List all audit log events

This endpoint retrieves a paginated list of audit log events for your team, ordered from newest to oldest. All query parameters are optional and can be combined.

Optional query parameters

Name
page
Type
integer
Description
The page number to return. Defaults to 1.
Name
pageSize
Type
integer
Description
The number of events to return per page, between 1 and 100. Defaults to 100.
Name
category
Type
enum
Description
Only return events in this category. Possible values: SECURITY, SYNC_CONFIG, BOOKING_LINKS, BOOKING_PAGES, CALENDARS, ACCESS_CONTROL, BILLING, WORKFLOWS, API_KEYS, MCP.
Name
actorUserId
Type
string
Description
Only return events performed by this user. You can get user IDs from the memberships endpoint.
Name
dateFrom
Type
string
Description
Only return events that happened on or after this point in time. Accepts an ISO 8601 date (2026-10-01) or date-time with a timezone offset (2026-10-01T09:00:00Z). A date is interpreted as the start of that day in UTC.
Name
dateTo
Type
string
Description
Only return events that happened on or before this point in time. Accepts the same formats as dateFrom. A date includes the whole day, up to its end in UTC. Must not be earlier than dateFrom.

Request

GET

/v1/audit-logs

curl -G https://app.onecal.io/api/v1/audit-logs \
  -H "x-api-key: {apiKey}" \
  -d category=ACCESS_CONTROL \
  -d dateFrom=2026-10-01 \
  -d dateTo=2026-10-31 \
  -d pageSize=50 \
  -d page=1

Response

{
  "pageNumber": 1,
  "pageSize": 50,
  "total": 2,
  "data": [
    {
      "id": "cm9x2k1q40001l70846gq7a1b",
      "createdAt": "2026-10-14T09:12:44.512Z",
      "category": "ACCESS_CONTROL",
      "action": "MEMBERSHIP_REMOVED",
      "details": {
        "subject": {
          "type": "user",
          "id": "cm7f3cfb000000clbc8pk5qtr",
          "label": "Jane Smith"
        }
      },
      "actor": {
        "kind": "user",
        "id": "cm6a1b2c300000clb1x2y3z4w",
        "name": "John Doe",
        "email": "john@example.com"
      },
      "impersonatedBy": null
    },
    {
      "id": "cm9x2j8r20000l708ab12cd34",
      "createdAt": "2026-10-02T15:03:10.004Z",
      "category": "ACCESS_CONTROL",
      "action": "INVITATION_CREATED",
      "details": {
        "subject": {
          "type": "invite",
          "id": "cm9x2j8qz0000l708zz99yy88",
          "label": "jane@example.com"
        }
      },
      "actor": {
        "kind": "user",
        "id": "cm6a1b2c300000clb1x2y3z4w",
        "name": "John Doe",
        "email": "john@example.com"
      },
      "impersonatedBy": { "masked": true }
    }
  ]
}

Actions

The action of an event is one of the following values, grouped by category. New actions may be added over time, so your integration should handle unknown values gracefully.

Name
SECURITY
Description
LOG_IN, SSO_LOGIN, LOG_OUT, OAUTH_ACCOUNT_LINKED, OAUTH_ACCOUNT_UNLINKED, EMAIL_UPDATED, IMPERSONATION_STARTED, IMPERSONATION_ENDED, ADMIN_MANAGED_ACCOUNT_ENABLED, ADMIN_MANAGED_ACCOUNT_DISABLED, USER_IMPERSONATION_ENABLED, USER_IMPERSONATION_DISABLED
Name
SYNC_CONFIG
Description
SYNC_CONFIG_CREATED, SYNC_CONFIG_UPDATED, SYNC_CONFIG_DELETED, SYNC_CONFIG_RE_RAN, SYNC_CONFIG_PAUSED, SYNC_CONFIG_UNPAUSED, SYNC_CONFIG_FAILED, SYNC_CONFIG_REPAIRED
Name
BOOKING_LINKS
Description
BOOKING_LINK_CREATED, BOOKING_LINK_UPDATED, BOOKING_LINK_DELETED
Name
BOOKING_PAGES
Description
BOOKING_PAGE_CREATED, BOOKING_PAGE_UPDATED
Name
CALENDARS
Description
CALENDAR_CONNECTED, CALENDAR_DELETED, CALENDAR_DISCONNECTED, CALENDAR_CONNECTION_EXPIRED, CALENDAR_CONNECTION_RECONNECTED, CALENDAR_UPDATED, CALENDAR_EVENT_CREATED, CALENDAR_EVENT_UPDATED, CALENDAR_EVENT_DELETED, PUBLIC_CALENDAR_FEED_CREATED, PUBLIC_CALENDAR_FEED_UPDATED, PUBLIC_CALENDAR_FEED_DELETED
Name
ACCESS_CONTROL
Description
INVITATION_CREATED, INVITATION_ACCEPTED, INVITATION_DECLINED, INVITATION_REVOKED, MEMBERSHIP_CREATED, MEMBERSHIP_REMOVED, ROLE_UPDATED
Name
BILLING
Description
PLAN_UPDATED, SUBSCRIPTION_CHANGED, SEAT_ADDED, SEAT_REMOVED
Name
WORKFLOWS
Description
WORKFLOW_CREATED, WORKFLOW_UPDATED, WORKFLOW_DELETED
Name
API_KEYS
Description
API_KEY_CREATED, API_KEY_REVOKED
Name
MCP
Description
MCP_CLIENT_CREATED, MCP_CLIENT_DELETED, MCP_CLIENT_SECRET_CREATED, MCP_CLIENT_SECRET_REVOKED, MCP_REDIRECT_URI_CREATED, MCP_REDIRECT_URI_DELETED