Timestamped audit log across every company the calling connection reaches through its active firm authorizations. Firm-scoped on purpose: a firm with many clients does not have to make one request per client. Each row carries its own companyId, matching the ids returned by GET /companies.

startDate and endDate are interpreted in UTC, unlike the per-company endpoints which use the company's timezone, because the feed can span companies in different zones.

companyIds narrows to a subset of the firm's companies; naming a company the connection is not authorized for returns 403 rather than an empty result.

Required: read:company