# List what was done under a support-access grant

> The support_access.list_actions operation: GET /api/v1/support_access_grants/{id}/actions in the REST API and the support_access_list_actions tool in the MCP server.

Lists every request Ownrecord staff made under one support-access grant, newest first (spec §39.3): reads as well
as changes, each with the operation (`action`), the object it was about (`target`), the entity or brand, the mode
and the surface. Each entry is an audit log entry carrying the grant's ID; `audit_log.list` has the full entry,
including before and after snapshots of configuration changes. Pass `next_cursor` as `starting_after` for the
next page.

## At a glance

- **REST:** `GET /api/v1/support_access_grants/{id}/actions`
- **MCP tool:** `support_access_list_actions`
- **Operation ID:** `support_access.list_actions`
- **Scope:** Organization
- **Permission:** `audit:read`
- **Risk tier:** `read`
- **Dry run:** Not supported
- **Idempotency:** Not needed (read only)
- **Modes:** Test and live
- **Pagination:** `limit` (at most 100) and `starting_after`
- **Authentication:** API key with the `audit:read` scope
- **Since:** M12

## Request

### Path parameters

| Field | Type       | Description |
| ----- | ---------- | ----------- |
| `id`  | `sag_…` ID | The grant.  |

### Query parameters

| Field            | Type               | Required | Description                             |
| ---------------- | ------------------ | -------- | --------------------------------------- |
| `limit`          | integer (1 to 100) | No       | Page size, 1 to 100 (default 10).       |
| `starting_after` | `aud_…` ID         | No       | The `next_cursor` of the previous page. |

## Response

`200 OK` with a JSON object, a page of the list (newest first):

| Field             | Type                                                                 | Description                                                                                                                         |
| ----------------- | -------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `object`          | `"list"`                                                             |                                                                                                                                     |
| `data`            | array of object                                                      |                                                                                                                                     |
| `data[].object`   | `"support_access_action"`                                            |                                                                                                                                     |
| `data[].id`       | `aud_…` ID                                                           | The audit entry.                                                                                                                    |
| `data[].at`       | date-time                                                            |                                                                                                                                     |
| `data[].action`   | string                                                               | What was done: the operation ID, e.g. `customers.get` (a read: the operation's reference says its risk tier) or `customers.update`. |
| `data[].target`   | string                                                               | The object it was about, e.g. `cus_…`, or the organization, entity or brand.                                                        |
| `data[].entityId` | `ent_…` ID or null                                                   |                                                                                                                                     |
| `data[].brandId`  | `brd_…` ID or null                                                   |                                                                                                                                     |
| `data[].livemode` | boolean or null                                                      |                                                                                                                                     |
| `data[].via`      | one of `console`, `api`, `mcp`, `assistant`, `portal`, `job` or null |                                                                                                                                     |
| `has_more`        | boolean                                                              |                                                                                                                                     |
| `next_cursor`     | `aud_…` ID or null                                                   |                                                                                                                                     |

## Examples

### The staff member read a subscription and its customer

```http
GET /api/v1/support_access_grants/sag_01m5wvkry1e6w94sjxgme33fs2/actions
Authorization: Bearer or_test_…
```

Response (`200`):

```json
{
  "object": "list",
  "data": [
    {
      "object": "support_access_action",
      "id": "aud_01m5wvkry1e6w94sjxgme33fsd",
      "at": "2026-11-03T08:23:40.000Z",
      "action": "customers.get",
      "target": "cus_01m5wvkry1e6w94sjxgme33fsj",
      "entityId": "ent_01m5wvkry1e6w94sjxgme33fsf",
      "brandId": "brd_01m5wvkry1e6w94sjxgme33fsh",
      "livemode": true,
      "via": "console"
    },
    {
      "object": "support_access_action",
      "id": "aud_01m5wvkry1e6w94sjxgme33fsc",
      "at": "2026-11-03T08:22:04.000Z",
      "action": "subscriptions.get",
      "target": "sub_01m5wvkry1e6w94sjxgme33fsm",
      "entityId": "ent_01m5wvkry1e6w94sjxgme33fsf",
      "brandId": "brd_01m5wvkry1e6w94sjxgme33fsh",
      "livemode": true,
      "via": "console"
    }
  ],
  "has_more": false,
  "next_cursor": null
}
```

## Errors

| Code                                                                                     | HTTP status | When                                                                                     | What to do                                                                                           |
| ---------------------------------------------------------------------------------------- | ----------- | ---------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
| [`resource_not_found`](https://ownrecord.io/docs/reference/errors.md#resource_not_found) | 404         | Your organization has no grant with this ID.                                             | Check the ID and that your credentials are scoped to the right organization, entity, brand and mode. |
| [`validation_failed`](https://ownrecord.io/docs/reference/errors.md#validation_failed)   | 400         | A pagination value is invalid, or `starting_after` isn't an entry made under this grant. | Fix the fields listed in `details.issues` and send the request again.                                |
| [`permission_denied`](https://ownrecord.io/docs/reference/errors.md#permission_denied)   | 403         | You can't read the organization's access log (owners and admins can).                    | Ask an organization owner or admin for a role or scope that allows this action.                      |

It can also return these [common errors](https://ownrecord.io/docs/reference.md#common-errors): [`api_version_unsupported`](https://ownrecord.io/docs/reference/errors.md#api_version_unsupported), [`authentication_required`](https://ownrecord.io/docs/reference/errors.md#authentication_required), [`api_key_invalid`](https://ownrecord.io/docs/reference/errors.md#api_key_invalid), [`dry_run_not_supported`](https://ownrecord.io/docs/reference/errors.md#dry_run_not_supported), [`rate_limited`](https://ownrecord.io/docs/reference/errors.md#rate_limited), [`internal_error`](https://ownrecord.io/docs/reference/errors.md#internal_error).