App activity API

Read activity with GET /api/v1/analytics/activity. The credential owner must be an active organisation owner or admin. The request remains bound to that credential’s organisation, including when the owner is a platform administrator. Enabling collection across several environments does not widen this scope. Deployment configuration is managed by the operator and is not writable through this endpoint or MCP.

Query field	Values
organizationId	Optional UUID. Must match the credential’s organisation.
userId	Optional UUID to filter one member.
minutes	1–1440, default 30.
limit	1–200, default 100.
scope	Optional tenant. Fleet scope is unavailable to generated credentials.

curl 'https://api.example.com/api/v1/analytics/activity?minutes=60&limit=100' \
  -H 'Authorization: Bearer <your-api-key>'

The JSON response contains sampledAt, environment, enabled, fleet, people, events, tenants, delivery and limited. people includes member names, tenant names and IDs, app areas, activity timestamps and an active indicator. events includes event/source metadata, member and tenant IDs, static API route templates and response codes. An interrupted response may have no HTTP code.

limited=true means you should narrow the filters. Presence requires a recent visible browser interaction; API calls do not mark a person active. Collection can be disabled by an operator, and this endpoint is not a complete audit log.

Invalid filters return 400. Missing or invalid authentication returns 401; insufficient role or an organisation mismatch returns 403. Membership is checked on each request. Responses must not be cached.

MCP parity

Use call_public_api with the same filters:

{
  "method": "GET",
  "path": "/analytics/activity",
  "query": { "minutes": 60, "limit": 100 }
}

Both generated REST keys and unscoped user MCP sessions use the same validation, permissions and organisation boundary. An MCP session token cannot be sent directly to the REST endpoint. The bridge supplies its required proof.

Browser presence submission and Google consent require a signed-in browser session and are not available to generated credentials. Cross-server operator queries are outside the public API and MCP surface.

See the App activity guide and REST API overview.