The audit log API (
GET /v1/audit-log
) can't filter results by the user or identity that performed an action. Anyone who needs the activity of a single user or service account has to pull every event in the org and filter them on their own side.
Adding a filter by user ID and by user email or client ID, covering both human users and service accounts will help a lot with that.