> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nekt.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Token Access Logs

> Every request made with an API token or an MCP token, newest first.



## OpenAPI

````yaml GET /api/v1/token-access-logs/
openapi: 3.0.3
info:
  title: Nekt API
  version: v1
  description: Nekt API Documentation
  contact:
    email: support@nekt.ai
servers:
  - url: https://api.nekt.ai
security: []
paths:
  /api/v1/token-access-logs/:
    get:
      tags:
        - v1
      summary: List token access logs
      description: >-
        Every request made with an API token or an MCP token, newest first:
        which token, who owns it, what it did, which URL and which status.


        **Paginated by cursor.** There is no `count` — follow `next` instead.
        `page_size` accepts up to 200.


        **Without `created_at__gte` the list covers the last 30 days.** Ask for
        a wider range explicitly, up to the limit your plan keeps: 7 days on
        Starter, 30 on Growth, 90 on Custom. Nothing exists beyond 90 days —
        lines are deleted automatically.


        **To pull incrementally** (into a SIEM or a warehouse), pass the
        `created_at` of the newest line you already hold as `created_at__gt` and
        follow `next` to the end. The ordering breaks ties by id, so a sync that
        resumes this way neither loses nor repeats a line.


        This response never includes the request body — fetch a single log for
        that.


        Who sees what: Owners and Admins see the whole workspace; everyone else
        sees only the logs of the tokens they created. An API token or a
        full-access MCP token sees what its creator would see. Restricted MCP
        tokens cannot read this. On the Free plan the endpoint answers `403`.
      operationId: v1_token_access_logs_list
      parameters:
        - in: query
          name: action
          schema:
            type: array
            items:
              type: string
          description: Multiple values may be separated by commas.
          explode: false
          style: form
        - in: query
          name: created_at__gt
          schema:
            type: string
            format: date-time
        - in: query
          name: created_at__gte
          schema:
            type: string
            format: date-time
        - in: query
          name: created_at__lt
          schema:
            type: string
            format: date-time
        - in: query
          name: created_at__lte
          schema:
            type: string
            format: date-time
        - name: cursor
          required: false
          in: query
          description: The pagination cursor value.
          schema:
            type: string
        - name: page_size
          required: false
          in: query
          description: Number of results to return per page.
          schema:
            type: integer
        - in: query
          name: status_code
          schema:
            type: integer
        - in: query
          name: status_code__gte
          schema:
            type: integer
        - in: query
          name: status_code__lt
          schema:
            type: integer
        - in: query
          name: token_id
          schema:
            type: array
            items:
              type: string
          description: Multiple values may be separated by commas.
          explode: false
          style: form
        - in: query
          name: token_kind
          schema:
            type: array
            items:
              type: string
          description: Multiple values may be separated by commas.
          explode: false
          style: form
        - in: query
          name: token_owner_id
          schema:
            type: array
            items:
              type: string
          description: Multiple values may be separated by commas.
          explode: false
          style: form
        - in: query
          name: transport
          schema:
            type: array
            items:
              type: string
          description: Multiple values may be separated by commas.
          explode: false
          style: form
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedTokenAccessLogList'
          description: ''
      security:
        - ApiKeyAuth: []
components:
  schemas:
    PaginatedTokenAccessLogList:
      type: object
      required:
        - results
      properties:
        next:
          type: string
          nullable: true
          format: uri
          example: http://api.example.org/accounts/?cursor=cD00ODY%3D"
        previous:
          type: string
          nullable: true
          format: uri
          example: http://api.example.org/accounts/?cursor=cj0xJnA9NDg3
        results:
          type: array
          items:
            $ref: '#/components/schemas/TokenAccessLog'
    TokenAccessLog:
      type: object
      description: 'One access-log line: who called, what they reached, and how it answered.'
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
        created_at:
          type: string
          format: date-time
          readOnly: true
        token_kind:
          allOf:
            - $ref: '#/components/schemas/TokenKindEnum'
          readOnly: true
        token_id:
          type: string
          format: uuid
          readOnly: true
          nullable: true
          description: >-
            The APIToken's or the MCPToken's id — `token_kind` says which. Not a
            foreign key because it points at two different tables. Null when
            authentication failed, and there is no token to name.
        token_description:
          type: string
          readOnly: true
        token_owner:
          type: integer
          readOnly: true
          nullable: true
        token_owner_email:
          type: string
          readOnly: true
        action:
          type: string
          readOnly: true
          description: >-
            Client-facing action slug from the audit registry (`source.create`,
            `data.sql_query`, ...), derived from the resolved route — never from
            the raw URL. `unknown` is a valid value: a route nobody has mapped
            yet is still recorded.
        transport:
          allOf:
            - $ref: '#/components/schemas/TransportEnum'
          readOnly: true
        method:
          type: string
          readOnly: true
        path:
          type: string
          readOnly: true
        status_code:
          type: integer
          readOnly: true
          nullable: true
        response_content_length:
          type: integer
          readOnly: true
          nullable: true
          description: >-
            How much data left with this response — the size question an access
            audit exists to answer.
        duration_ms:
          type: integer
          readOnly: true
          nullable: true
        remote_address:
          type: string
          readOnly: true
        client_tool:
          type: string
          readOnly: true
          description: >-
            MCP tool name, when the caller declares one. Informational only — it
            comes from the client, so it authorises nothing.
      required:
        - action
        - client_tool
        - created_at
        - duration_ms
        - id
        - method
        - path
        - remote_address
        - response_content_length
        - status_code
        - token_description
        - token_id
        - token_kind
        - token_owner
        - token_owner_email
        - transport
    TokenKindEnum:
      enum:
        - api-token
        - mcp-token
      type: string
      description: |-
        * `api-token` - API token
        * `mcp-token` - MCP token
    TransportEnum:
      enum:
        - http
        - websocket
      type: string
      description: |-
        * `http` - HTTP
        * `websocket` - WebSocket
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      in: header
      name: x-api-key
      description: 'API Key authentication. Format: ''x-api-key: api_key'''

````