Audit Trail: Read Your Organization's Activity Log

A tamper-evident audit trail of every action an agent took, provable to a compliance team or auditor after the fact — page through it with client.getActivityLog().

client.getActivityLog(opts?) returns one page of your organization’s agent-activity audit trail — every audited contract dispatch (actor, on-behalf-of, contract, function, outcome), reconstructed from the cluster’s append-only, tamper-evident ledger. This is what you point a compliance team or an auditor at to prove what an agent actually did, not just what it was supposed to do. The scope organization is resolved server-side from your session DID: there’s no scope parameter, and a page carries every member’s activity in that org, not just your own.

let cursor: number | undefined;
do {
  const page = await client.getActivityLog({
    limit: 200,
    ...(cursor !== undefined && { before_seq: cursor }),
  });
  render(page.entries);
  cursor = page.next_seq ?? undefined;
} while (cursor !== undefined);

Page until next_seq is null — never stop on a short or empty page. The node caps how much ledger a single call decrypts, so a page can come back shorter than limit (even empty) while the window still has rows and next_seq is still non-null. Only a null next_seq means the window is exhausted.

Rows come back newest first (descending seq_no). Each ActivityEntry:

Field	Type	Meaning
seq_no	number	Ledger index — the ordering key. Use this, not timestamp_ms, to sort: entries from different nodes can have skewed clocks.
hash	string	Hex SHA-256 of the stored entry — read-time tamper evidence.
timestamp_ms	number	Call time in Unix ms, stamped on the node that took the request (per-node wall clock, not cluster-assigned).
caller_type	"agent" | "human"	Decided server-side by an existence check on actor in the agent registry.
actor	string	DID that actually invoked the contract.
on_behalf_of	string	DID of the owner the caller acted for. Equals actor on a self / own-authority call — never null.
org	string	Organization the acting principal belongs to — identical on every row of a page.
contract	string	Contract that ran, e.g. tee:user/contracts.
function	string	Contract function invoked, e.g. user-upsert.
outcome	"success" | "denied" | "error"	Host-stamped result of the dispatch.
roles?	string[]	Role ids the acting authority carried at call time. Omitted when the authority carried no role. On a denied entry this is the caller’s claimed authority, not a validated one.

Params (GetActivityLogOptions), all optional — {} is a valid call: from_ms / to_ms bound the window (Unix ms, inclusive); before_seq is the paging cursor (the previous page’s next_seq); limit is clamped server-side to 1–1000 (default 200).

Like execute, this runs the session-payload encryption rather than plain HTTPS — entries carry principal DIDs, so getActivityLog() requires an authenticated session.

Not the same method as getAuditEvents(). getAuditEvents() returns your own audit trail (every actor, PII-bearing action/target/details included) — it’s the right call when you need your own history with detail. getActivityLog() returns your organization’s activity, metadata only (no call arguments or payloads), scoped to every member. Reach for getActivityLog() for an org-wide activity view; reach for getAuditEvents() for your own detailed trail.