---
title: "Account API Reference"
description: "Silly Development API reference for your account: read the account an API key belongs to and its activity log, with what a key can never change."
url: "https://sillydev.co.uk/docs/panel/account"
updated: "2026-10-10"
---

API reference

# Account

Read the account a key belongs to and its activity.

[← API docs](https://sillydev.co.uk/docs/panel) · 2 endpoints · Updated 10 October 2026

**Browse the docs**

## Account

The account the API key belongs to. A key can only read the account (scope `account.read`); everything that changes it, such as the email address, password, two-factor, API keys and SSH keys, needs a browser session and is not part of the public API.

### Get the account

GET`/account`

Account scope account.read

Returns the account the API key belongs to. Works even when two-factor authentication is required but not yet set up.

Example

```
curl "https://sillydev.co.uk/panel/api/client/account" \
  -H "Authorization: Bearer $SILLYDEV_API_KEY" \
  -H "Accept: application/json"
```

Response 200The account.

```
{
    "object": "user",
    "attributes": {
        "id": 42,
        "admin": false,
        "username": "discordbotdev",
        "email": "you@example.com",
        "first_name": "Alex",
        "last_name": "Smith",
        "language": "en"
    }
}
```

**Every field in the response**

| Name | Type | Description |
| --- | --- | --- |
| objectrequired | string |  |
| attributesrequired | object |  |
| attributes.idrequired | integer |  |
| attributes.adminrequired | boolean | Whether the account is a panel administrator. |
| attributes.usernamerequired | string |  |
| attributes.emailrequired | string (email) |  |
| attributes.first_namerequired | string |  |
| attributes.last_namerequired | string |  |
| attributes.languagerequired | string | Interface language code, e.g. `en`. |

Errors

- 401 No API key was sent, or it is wrong, expired or deleted.
- 403 The key is valid but may not do this: it lacks the permission or account scope, it is limited to other servers or IP addresses, or the account may not do it at all.

### List the account's activity log

GET`/account/activity`

Account scope account.read

Returns the account's activity log, newest first when sorted by `-timestamp`, 25 entries per page by default and at most 100. Actions an administrator took on the account are not shown, except ones the requesting administrator took themselves.

Parameters

| Name | Type | Description |
| --- | --- | --- |
| page | integer | The page of results to return, starting at 1. |
| per_page | integer | How many results to return on each page. |
| filter\[event\] | string | Only entries whose event name contains this text, e.g. `server:power` or `user:api-key`. |
| sort | one of 'timestamp', '-timestamp' | Sort by time, `timestamp` for oldest first or `-timestamp` for newest first. |
| include | one of 'actor' | Set to `actor` to add the user who performed each action as `attributes.relationships.actor`. |

Example

```
curl "https://sillydev.co.uk/panel/api/client/account/activity" \
  -H "Authorization: Bearer $SILLYDEV_API_KEY" \
  -H "Accept: application/json"
```

Response 200A page of activity log entries.

```
{
    "object": "list",
    "data": [
        {
            "object": "activity_log",
            "attributes": {
                "id": "3f786850e387550fdab836ed7e6dc881de23001b",
                "batch": null,
                "event": "user:database.create",
                "is_api": true,
                "ip": "203.0.113.10",
                "description": null,
                "properties": {
                    "label": "Discord bot",
                    "version": "MariaDB 11.4"
                },
                "has_additional_metadata": false,
                "timestamp": "2026-10-10T12:00:00+00:00"
            }
        }
    ],
    "meta": {
        "pagination": {
            "total": 1,
            "count": 1,
            "per_page": 25,
            "current_page": 1,
            "total_pages": 1,
            "links": []
        }
    }
}
```

**Every field in the response**

| Name | Type | Description |
| --- | --- | --- |
| objectrequired | string |  |
| datarequired | array of object |  |
| data\[\].objectrequired | string |  |
| data\[\].attributesrequired | object | One thing that was done, by whom and when. |
| data\[\].attributes.idrequired | string | A stable unique key for the entry (a hash, not a database ID). |
| data\[\].attributes.batchrequired | string (uuid) \| null | Shared by entries logged together as part of one action. |
| data\[\].attributes.eventrequired | string | The event name, e.g. `server:power.start` or `server:file.write`. |
| data\[\].attributes.is_apirequired | boolean | Whether it was done with an API key. |
| data\[\].attributes.iprequired | string \| null | The IP address it came from. Only shown for your own actions (or to administrators). |
| data\[\].attributes.descriptionrequired | string \| null |  |
| data\[\].attributes.propertiesrequired | object | Details of the event, which vary by event. List values also get a `<key>_count` entry (or `count`, if there is only one list). An `ip` property is `[hidden]` unless it was your action. |
| data\[\].attributes.has_additional_metadatarequired | boolean | Whether `properties` holds anything beyond what the event's description already says. |
| data\[\].attributes.timestamprequired | string (date-time) |  |
| data\[\].attributes.relationships | object |  |
| data\[\].attributes.relationships.actor | any | Who did it. Only with `include=actor`; a `null_resource` if it was not a user (e.g. the system or a schedule). |
| metarequired | object |  |
| meta.paginationrequired | object |  |
| meta.pagination.total | integer |  |
| meta.pagination.count | integer |  |
| meta.pagination.per_page | integer |  |
| meta.pagination.current_page | integer |  |
| meta.pagination.total_pages | integer |  |
| meta.pagination.links | object |  |
| meta.pagination.links.previous | string (uri) |  |
| meta.pagination.links.next | string (uri) |  |

Errors

- 401 No API key was sent, or it is wrong, expired or deleted.
- 403 The key is valid but may not do this: it lacks the permission or account scope, it is limited to other servers or IP addresses, or the account may not do it at all.