# Teams and the audit log

## Team reads (scope `team:read`, needs "View audit log")

| Call | Returns |
| --- | --- |
| `GET /team` | The team and its plan. |
| `GET /team/members` | Members and roles. |
| `GET /team/invitations` | Pending invitations. |
| `GET /team/notifications` | Where alerts go. |

## Invite people (scope `team:write`, critical)

```bash
curl -s -X POST $MYFORGE/team/invitations \
  -H "Authorization: Bearer $TOKEN" -H "Idempotency-Key: invite-1" -H "Content-Type: application/json" \
  -d '{"email":"new.person@example.com","role":"member"}'
```

The same rules as the dashboard: any role except owner, the plan's member limit, and at most 20 invitations per hour per team. The person gets an email. `DELETE /team/invitations/{invitation}` cancels one. Changing roles and removing members are not in the API: owners do that in the dashboard.

Do not give `team:write` to an AI assistant. Inviting a person gives them access to your servers.

## The audit log

Every change a person or token makes is recorded permanently. Events cannot be edited or deleted, and each is chained to the previous one with a hash.

```bash
curl -s -H "Authorization: Bearer $TOKEN" "$MYFORGE/audit-log?area=sites&from=2026-10-01"
```

Filters: `area`, `user` (a member's email, or `automatic` for git pushes and pfcloud itself), `from`, `until` (dates or times, inclusive), `page`. Newest first, 50 per page, follow `links.next`. Each event has `id`, `action`, `description`, `source` (for API changes: `api`), `user` (`name`, `email`), `ip_address`, `country`, `device` and `created_at`. Changes made with a token carry the token's name.

`GET /audit-log/verify` returns the result of the nightly integrity check (or null if it has not run yet).

## Where else to look

In the dashboard, **API**, then **Activity** shows the last 100 API calls (token, call, answer, address). Use both when you review what an AI did: [AI security](/developers/ai-security).