Teams and the audit log

Read the team, its members and invitations, invite people, and read and verify the audit log.

Team reads (scope team:read, needs "View audit log")

Invite people (scope team:write, critical)

curl -s -X POST $MYFORGE/team/invitations \
  -H "Authorization: Bearer $TOKEN" -H "Idempotency-Key: invite-1" -H "Content-Type: application/json" \
  -d '{"email":"new.person@example.com","role":"member"}'

The same rules as the dashboard: any role except owner, the plan's member limit, and at most 20 invitations per hour per team. The person gets an email. DELETE /team/invitations/{invitation} cancels one. Changing roles and removing members are not in the API: owners do that in the dashboard.

Do not give team:write to an AI assistant. Inviting a person gives them access to your servers.

The audit log

Every change a person or token makes is recorded permanently. Events cannot be edited or deleted, and each is chained to the previous one with a hash.

curl -s -H "Authorization: Bearer $TOKEN" "$MYFORGE/audit-log?area=sites&from=2026-10-01"

Filters: area, user (a member's email, or automatic for git pushes and pfcloud itself), from, until (dates or times, inclusive), page. Newest first, 50 per page, follow links.next. Each event has id, action, description, source (for API changes: api), user (name, email), ip_address, country, device and created_at. Changes made with a token carry the token's name.

GET /audit-log/verify returns the result of the nightly integrity check (or null if it has not run yet).

Where else to look

In the dashboard, API, then Activity shows the last 100 API calls (token, call, answer, address). Use both when you review what an AI did: AI security.