Add audit-only token scope without org:write

SIEM and compliance integrations that only need management-plane audit logs currently require org:write because OrganizationAuditPermission gates GET /api/0/organizations/{org_slug}/audit-logs/ on that scope. That forces over-privileged tokens for a read-only use case.

Current behavior

• Audit log API access is enforced by OrganizationAuditPermission, which maps GET to org:write (plus active superuser).
• The endpoint itself already exists on OrganizationAuditLogsEndpoint.
• Related: public documentation/promotion of the endpoint is tracked in https://github.com/getsentry/sentry/issues/115757.

Gap

Customers pulling audit logs into a SIEM cannot mint a least-privilege token limited to audit-log read access. Any token that can call the endpoint also carries broader org write capability.

Requested capability

• Add a purpose-built audit-only scope (or equivalent token permission) that can read org audit logs.
• Ensure that scope does not grant org:write or other write/admin org capabilities.
• Allow auth tokens / org tokens using only that scope to call the audit-logs endpoint.

Requested by Gene Wright via Junior.

--

View Junior Session in Sentry

Start by reading OrganizationAuditPermission in src/sentry/api/bases/organization.py and the request handling in src/sentry/core/endpoints/organization_auditlogs.py. Trace how auth-token and organization-token scopes are represented and checked, then identify the relevant permission tests. Done means an audit-only scope can read the audit-log endpoint without granting org:write or other write/admin capabilities.