What the app sent in and what KudosCRM sent out

GET 
/app_installs/:id/activity_log

One list, newest first, ordered (at, in before out, id) behind one keyset cursor. An inbound payload rides along only when it renders to 16 KB of JSON or less — else payload: null, payload_truncated: true, and the whole body is GET /ingest/inbound_events/\{id\} (the row's id). An outbound row's external_ref is the record in the envelope's data. Inbound rows are the events this install received: a reinstall reuses the source, never its history, so what an earlier install received stays on that install's log. A forged or out-of-range cursor reads as the first page. integrations.view_logs. Throttle: app_installs/read/minute, 300 a minute.

A signed-in session or the person's own personal access token; an app's OAuth token is refused (403 resource_not_grantable).

Request

Responses

200

A page of log entries.

401

No session or token, or one that is no longer valid. A request that presented a token gets WWW-Authenticate: Bearer realm="KudosCRM", error="invalid_token" (refresh it); one with no credentials and no session cookie gets the bare challenge.

Response Headers

WWW-Authenticate
Example: Bearer realm="KudosCRM", error="invalid_token"

403

Not allowed: the permission this route needs is missing, the Integrations module is off (code: module_disabled, meta.module_key, meta.blocked_at_layer), or the caller is an app's own OAuth token (code: resource_not_grantable).

404

Not found in this workspace — or not something the caller may know exists.

422

invalid_direction at /direction.