Account

Read the audit log

account_audit_log · Reads only · Markdown

The account's admin and security actions, newest first, with a check that none was changed or removed.

Free*

*Free up to 1,000,000 reads a month for the whole account, then $0.50 per 10,000 reads.

An example

Who made new keys or changed our limits this month? And show me nothing in the log was tampered with.

Your agent callsaccount_audit_logFree*

The example business is Hansen & Voss, a restaurant-equipment wholesaler in Hamburg with 60 staff. The reply is the one the tool really gives.

With these arguments
{
  "action": "key.",
  "since": "2026-10-01T00:00:00Z",
  "verify": true
}
What comes back
{
  "entries": [
    {
      "id": 4101,
      "at": "2026-10-14T08:00:00+00:00",
      "action": "key.created",
      "actor": "key 1 (Pip)",
      "target": "key 2 (Support bot)",
      "detail": {
        "scope": {
          "areas": [
            "helpdesk"
          ],
          "tools": null,
          "deny_tools": null,
          "read_only": false,
          "drafts_only": false,
          "expires_at": null,
          "networks": null,
          "team": "Support",
          "accountable": "Lena Brandt"
        },
        "daily_budget_usd": "$20.00"
      },
      "ip": "127.0.0.1"
    }
  ],
  "count": 1,
  "chain": {
    "intact": true,
    "entries": 1,
    "broken_at": null
  }
}

Use it when

Someone asks who changed a key, a limit or a credential, who signed in, or what was deleted and when; or an auditor wants proof the record is whole.

What it does

The account's admin and security actions, newest first: keys made and revoked, limits and auto-reload, the owner's sign-ins, connectors, exports, vault reads and writes, credentials set and everything deleted. Ordinary work is in the call log (account_list_calls). verify: true also checks the hash chain, which breaks where an entry was changed or removed.

What comes back

entries: each with its id, time, action (like key.created or tool.vault_get), actor, target, detail and IP; count; with verify, chain: whether it is intact, how many entries, and the first broken one. Every reply also carries cost_usd and balance_usd.

Inputs

NameTypeWhat it is
actionstringOnly actions starting with this, like "key." or "tool.vault_". Up to 60 characters.
sincestring (date-time)Up to 40 characters.
limitinteger1 to 500. Default: 50.
verifybooleanDefault: false.

The call

Over MCP, call account_audit_log on https://api.conecto.chat/mcp/account. Over REST:

Terminal
curl -X POST https://api.conecto.chat/v1/tools/account_audit_log \
  -H "Authorization: Bearer $CONECTO_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"key.","since":"2026-10-01T00:00:00Z","verify":true}'

When it refuses

A refused call costs nothing and says what to do next.

CodeWhenWhat to do
invalid_input400since is not an ISO 8601 time.Send a time like 2026-10-12T09:00:00Z.

Give this to your agent.

Set up Conecto from https://conecto.chat/SKILL.md