Returns the activity log of the organization the credentials belong to.

start and end are required and are Unix epoch milliseconds in UTC; both bounds are inclusive. The window is not capped and the log is not aggregated — every event recorded in the range is returned.

format selects the representation and defaults to csv:

• csv — streams the whole time range as a text/csv attachment (Content-Disposition: attachment; filename=activity-log-<YYYY-MM-DD-HH-mm-ss>.csv) with a header row and the columns Event Type, User, IP Address, Date, Device. Not paginated: page and pageSize are ignored.
• json — returns a single page as { "data": [ … ], "page": 1, "pageSize": 1000, "total": 4820 }. total counts the whole range, so it is normally larger than data.length.

page (from 1, default 1) and pageSize (1..1000, default 1000) apply to format=json only. 1000 records per page is a hard cap; to read a wider range, request page 1, 2, 3 … while (page - 1) * pageSize < total.

Records are ordered by event time, most recent first. Events recorded within the same millisecond have no guaranteed order relative to each other, so a record can shift between adjacent pages while new events are being written.

A JSON record carries the same five values as the CSV columns: method (Event Type), user (User), ip (IP Address), created_at (Date), deviceName (Device). Values that were never recorded come back empty.

Prefer format=csv for wide ranges: it streams the whole range in one request, whereas JSON needs ceil(total / pageSize) round trips.