> ## Documentation Index > Fetch the complete documentation index at: https://openworklabs.com/docs/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > For agents: install the OpenWork desktop app with `brew install --cask openwork` (macOS) or from https://openworklabs.com/download. Do not run `npx openwork`; the npm package named `openwork` is a different project. > Connect an agent to OpenWork with the MCP Gateway: `claude mcp add --transport http openwork https://api.openworklabs.com/mcp/agent`. Teams sign up at https://app.openworklabs.com?mode=sign-up. > Step-by-step agent guide: https://openworklabs.com/docs/start-here/use-openwork-from-an-ai-agent.md # List retained audit operations > Organization administrator access to currently captured, retained audit history only; this is not coverage of every cloud action. Requires the latest literal metadata.capabilities.auditLogs=true and deployment visibility; feature disable returns 403 audit_feature_disabled without deleting history or changing capture preference. Legacy arbitrary payloads are preserved separately and are not backfilled or returned. One operation may contain multiple child events. Visibility is independent of capture entitlement. No duration, charge or continuous-drain guarantee is made. Default limit 50, maximum 100. Cursors are signed, organization/filter/mode scoped and expire 24 hours after the first page (not renewed). Repeat the same filters; limit may change. The snapshotSequence is the committed tenant publication watermark, not a timestamp or auto-increment allocation. Events above it are excluded, including later children of an existing operation. Missing retained anchors or changed removal counters return 410 audit_history_unavailable; start a new snapshot. These checks are not lossless-drain or retention protection guarantees. Time filters are inclusive operation-start bounds (ISO date or offset date-time; date-only means UTC midnight). actorId is the initiating user ID; outcome is the current OPERATION outcome, not an event outcome. action matches an exact stable action of any child event within the watermark. searchId is an exact case-sensitive ID match (1..255 characters, no controls), not free-text search: operation ID OR any canonical retained child event ID, child envelope requestId or child resource reference ID, scoped to this organization and operation within the watermark. Legacy payloads are not searched. All other filters are AND combined with searchId. Resource filters match stored references within the watermark, without live-resource joins; resourceType requires resourceId. Operation outcome/count/byte projections remain current rather than historical as-of-watermark values. Newest operations first, ordered by server first-recorded time then ID. Summary action and resources describe the FIRST event only (at most 256 stored references), not all affected resources. Expand events for complete evidence; X-Audit-Resource-Scope is first_event. ## OpenAPI ````yaml /openapi.json get /v1/audit/operations openapi: 3.1.0 info: title: Den API description: >- OpenAPI spec for the Den control plane API. Authentication: - Use `Authorization: Bearer ` for user-authenticated routes that require a Den session. - Use `x-api-key: ` for organization API-key calls. API keys resolve to the issuing user and the organization member they were scoped to when created, so they can call ordinary user and organization routes without a separate signed-in session. Example: `curl https://api.openworklabs.com/v1/me -H "x-api-key: den_..."`. - Session-only flows still require a signed-in user session, including organization creation, invitation acceptance, active-organization switching, and MCP token minting. - Public routes like health and documentation do not require authentication. Swagger tip: use the security schemes in the Authorize dialog to set either `bearerAuth` or `denApiKey` before trying protected endpoints. version: 0.18.46 contact: name: OpenWork url: https://openworklabs.com email: team@openworklabs.com license: name: OpenWork Enterprise Edition License url: https://github.com/different-ai/openwork/blob/dev/ee/LICENSE servers: - url: https://api.openworklabs.com security: - bearerAuth: [] - denApiKey: [] tags: - name: System description: >- Service health, readiness, API documentation, and desktop version metadata. - name: Authentication description: >- Sign-in discovery, administrator bootstrap, OAuth provider connections, and MCP token minting. - name: OAuth description: >- OAuth 2.0 / OpenID Connect authorization-server and protected-resource metadata and dynamic client registration (RFC 8414, RFC 9728, RFC 7591), used by MCP clients. - name: SCIM description: >- SCIM 2.0 provisioning endpoints for identity providers (RFC 7644) and the organization SCIM connector management routes. - name: SSO description: Organization single sign-on connector management routes. - name: Bootstrap description: Agent-first provisional workspace setup routes. - name: Users description: Current user and membership routes. - name: Organizations description: Organization creation, context, brand assets, and install links. - name: Invitations description: Invitation preview, acceptance, creation, and cancellation routes. - name: Members description: Organization member management routes. - name: Roles description: Organization custom role management routes. - name: Teams description: Organization team management routes. - name: API Keys description: Organization API key management routes. - name: Desktop Policies description: Desktop app policies applied to the organization, members, or teams. - name: LLM Providers description: Organization LLM provider catalog, configuration, and access routes. - name: Inference description: Organization inference settings. - name: Inference Providers description: >- Organization inference Gateway providers, model groups, credential sets, access grants, member connections, and usage. - name: Gateway Usage Limits description: >- Estimated-cost policies, independent member calendar buckets, assignments, and audited usage-extension requests. - name: Cloud description: Organization Cloud instance lifecycle and browser gateway resolution. - name: Workers description: Worker lifecycle, billing, and runtime routes. - name: Worker Runtime description: Worker runtime inspection and upgrade routes. - name: Worker Activity description: Worker heartbeat and activity reporting routes. - name: Automations description: Scheduled Automations, their runs, and desktop runner presence. - name: Workflows description: Saved Workflows (Code Mode scripts), their versions, snapshots, and views. - name: Workflow Runs description: Durable Workflow run history. - name: Codemode Runs description: Generated Artifact views produced by Code Mode runs. - name: Apps description: >- Saved reusable apps built from Workflows and Artifact views, and their sharing. - name: Config Objects description: >- Versioned configuration objects (skills, workflows, and other plugin content). - name: Plugins description: Plugin packages, access grants, and imports. - name: Marketplaces description: Marketplaces that distribute plugins to members and teams. - name: Resources description: >- Aggregated snapshot of the resources and marketplace capabilities available to the caller. - name: Dashboards description: Shared dashboards and their access grants. - name: Capability Sources description: >- Native provider capabilities (Google Workspace, Microsoft 365) and external MCP connections executed as the calling member. - name: Direct uploads description: Multipart uploads that stream workspace files straight to a provider. - name: Connectors description: >- Connector accounts and instances (GitHub and other sources) and their sync state. - name: GitHub description: >- GitHub App installation, repository discovery, and plugin import from GitHub. - name: Diagnostics description: Controlled egress diagnostics for self-hosted deployments. - name: Telemetry description: Telemetry event ingestion and adoption analytics. - name: Webhooks description: Signed inbound webhooks from third-party providers. - name: Admin description: Platform administration routes for allowlisted OpenWork administrators. - name: Deprecated description: Removed features that answer with 410 or an empty result for old clients. paths: /v1/audit/operations: get: tags: - Organizations summary: List retained audit operations description: >- Organization administrator access to currently captured, retained audit history only; this is not coverage of every cloud action. Requires the latest literal metadata.capabilities.auditLogs=true and deployment visibility; feature disable returns 403 audit_feature_disabled without deleting history or changing capture preference. Legacy arbitrary payloads are preserved separately and are not backfilled or returned. One operation may contain multiple child events. Visibility is independent of capture entitlement. No duration, charge or continuous-drain guarantee is made. Default limit 50, maximum 100. Cursors are signed, organization/filter/mode scoped and expire 24 hours after the first page (not renewed). Repeat the same filters; limit may change. The snapshotSequence is the committed tenant publication watermark, not a timestamp or auto-increment allocation. Events above it are excluded, including later children of an existing operation. Missing retained anchors or changed removal counters return 410 audit_history_unavailable; start a new snapshot. These checks are not lossless-drain or retention protection guarantees. Time filters are inclusive operation-start bounds (ISO date or offset date-time; date-only means UTC midnight). actorId is the initiating user ID; outcome is the current OPERATION outcome, not an event outcome. action matches an exact stable action of any child event within the watermark. searchId is an exact case-sensitive ID match (1..255 characters, no controls), not free-text search: operation ID OR any canonical retained child event ID, child envelope requestId or child resource reference ID, scoped to this organization and operation within the watermark. Legacy payloads are not searched. All other filters are AND combined with searchId. Resource filters match stored references within the watermark, without live-resource joins; resourceType requires resourceId. Operation outcome/count/byte projections remain current rather than historical as-of-watermark values. Newest operations first, ordered by server first-recorded time then ID. Summary action and resources describe the FIRST event only (at most 256 stored references), not all affected resources. Expand events for complete evidence; X-Audit-Resource-Scope is first_event. operationId: getAuditOperations parameters: - in: query name: limit schema: type: integer minimum: 1 maximum: 100 default: 50 description: Maximum rows in this page. - in: query name: cursor schema: type: string maxLength: 4096 description: Opaque nextCursor from the prior page of the same query and mode. - in: query name: from schema: anyOf: - type: string format: date - type: string format: date-time maxLength: 40 description: >- Inclusive operation-start bound; date-only is UTC midnight. from must not exceed to. - in: query name: to schema: anyOf: - type: string format: date - type: string format: date-time maxLength: 40 description: >- Inclusive operation-start bound; date-only is UTC midnight. from must not exceed to. - in: query name: actorId schema: type: string pattern: ^usr_[0-7][0-9a-hjkmnp-tv-z]{25}$ description: Initiating user ID, not a delegated event actor or membership ID. - in: query name: action schema: type: string minLength: 1 maxLength: 128 pattern: ^[a-z][a-z0-9_.-]*$ description: >- Exact stable action of any child event within the snapshot watermark. - in: query name: outcome schema: type: string enum: - running - succeeded - failed - partial - unknown description: Current operation outcome; not an individual event outcome. - in: query name: origin schema: type: string enum: - api - cloud_ui - mcp - scheduler - webhook - platform_admin description: Stored operation origin. - in: query name: searchId schema: type: string minLength: 1 maxLength: 255 pattern: ^[^\u0000-\u001f\u007f-\u009f]+$ description: >- Exact case-sensitive operation, child event, child request or stored child resource reference ID within the snapshot watermark; OR across ID kinds, AND with other filters. Not free-text or legacy payload search. - in: query name: resourceId schema: type: string minLength: 1 maxLength: 255 description: >- Exact case-sensitive stored reference ID from any child within the watermark. - in: query name: resourceType schema: type: string minLength: 1 maxLength: 64 pattern: ^[a-z][a-z0-9_.-]*$ description: Optional stored reference type; requires resourceId. responses: '200': description: One bounded summary per operation. content: application/json: schema: type: object properties: operations: type: array items: type: object properties: id: type: string kind: type: string scope: type: string action: type: string initiatingActor: type: object properties: type: type: string enum: - user - service - system - unknown id: anyOf: - type: string - type: 'null' memberId: type: string credentialId: type: string required: - type - id additionalProperties: false origin: type: string enum: - api - cloud_ui - mcp - scheduler - webhook - platform_admin originTrust: type: string enum: - authenticated - reported startedAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ outcome: type: string enum: - running - succeeded - failed - partial - unknown eventCount: type: integer minimum: -9007199254740991 maximum: 9007199254740991 logicalBytes: type: integer minimum: -9007199254740991 maximum: 9007199254740991 resources: type: array items: type: object properties: type: type: string id: type: string relationship: type: string enum: - target - parent - related label: type: string required: - type - id - relationship additionalProperties: false required: - id - kind - scope - action - initiatingActor - origin - originTrust - startedAt - outcome - eventCount - logicalBytes - resources additionalProperties: false nextCursor: anyOf: - type: string - type: 'null' snapshotSequence: type: integer minimum: -9007199254740991 maximum: 9007199254740991 required: - operations - nextCursor - snapshotSequence additionalProperties: false headers: X-Audit-Resource-Scope: schema: type: string enum: - first_event description: >- Summary references are from the first event only, not an exhaustive operation inventory. '400': description: >- Malformed query, cursor, mismatched filters, operation scope or export format. content: application/json: schema: type: object properties: error: type: string enum: - audit_invalid_query - audit_invalid_cursor required: - error '401': description: Authentication required. content: application/json: schema: $ref: '#/components/schemas/UnauthorizedError' '403': description: >- Organization administrator permission, audit feature and visibility required. content: application/json: schema: type: object properties: error: type: string enum: - forbidden - audit_feature_disabled - audit_visibility_disabled message: type: string required: - error '404': description: >- Organization or retained operation not found, including foreign-tenant targets. content: application/json: schema: type: object properties: error: type: string enum: - organization_not_found - audit_operation_not_found required: - error '410': description: >- Cursor expired or retained snapshot anchors/history are no longer available. content: application/json: schema: type: object properties: error: type: string enum: - audit_cursor_expired - audit_history_unavailable required: - error '503': description: >- Audit storage or required access capture unavailable; no audit content is released. content: application/json: schema: type: object properties: error: type: string enum: - audit_unavailable - audit_storage_inconsistent required: - error security: - bearerAuth: [] - denApiKey: [] components: schemas: UnauthorizedError: type: object properties: error: type: string const: unauthorized required: - error securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: session-token description: >- Session token passed as `Authorization: Bearer ` for user-authenticated Den routes. denApiKey: type: apiKey in: header name: x-api-key description: >- Organization API key passed as the `x-api-key` header. The raw key is the header value; do not prefix it with `Bearer`. ````