Activity Log API

Base URL: https://govconnect.ke/v1

All endpoints require authentication via API Key or JWT cookie. API keys use the tfm_k_ prefix.

See the Activity log guide for concepts.

The activity log is an append-only feed of meaningful workspace actions (domain changes, sends, team and billing events, security events). It captures deletions and other non-creation events, not just a snapshot of what currently exists.

List activity log entries

GET /v1/audit-log

Returns a time-sorted feed of workspace activity for the authenticated user, newest first.

Query parameters:

curl "https://govconnect.ke/v1/audit-log?range=7d&category=Security" \
  -H "Authorization: Bearer tfm_k_YOUR_API_KEY"

Response:

{
  "items": [
    {
      "id": "act_abc123",
      "actor": "jane@yourdomain.com",
      "action": "api_key.created",
      "target_type": "API key",
      "target_name": "Production backend",
      "target_id": "8f1d2c3a-...",
      "category": "Security",
      "meta": {},
      "created_at": "2026-04-06T10:00:00Z"
    }
  ],
  "range": "7d",
  "total": 1
}

total is the count of entries within the selected range (and category, when given); it is not affected by limit.

The meta object

Every entry carries a meta object with structured context about the action. For most actions it is empty ({}).

Actions performed by an AI assistant or automation through the Model Context Protocol (MCP) are tagged in meta:

• meta.via is set to "mcp" for MCP-driven entries.
• meta.client identifies the MCP client that performed the action.

{
  "id": "act_def456",
  "actor": "jane@yourdomain.com",
  "action": "broadcast.sent",
  "target_type": "Broadcast",
  "target_name": "April newsletter",
  "target_id": "8f1d2c3a-...",
  "category": "Send",
  "meta": { "via": "mcp", "client": "Claude" },
  "created_at": "2026-04-06T11:00:00Z"
}

An entry without meta.via was performed directly through the dashboard or API.

Errors