diff --git a/outlook_web/app.py b/outlook_web/app.py
index 0d5f857..b2e496f 100644
--- a/outlook_web/app.py
+++ b/outlook_web/app.py
@@ -79,7 +79,7 @@ def create_app(*, autostart_scheduler: Optional[bool] = None):
         app.register_blueprint(settings.create_blueprint())
         app.register_blueprint(scheduler.create_blueprint(impl=legacy))
         app.register_blueprint(system.create_blueprint())
-        app.register_blueprint(audit.create_blueprint(impl=legacy))
+        app.register_blueprint(audit.create_blueprint())
 
         _APP_INSTANCE = app
 
diff --git a/outlook_web/controllers/audit.py b/outlook_web/controllers/audit.py
new file mode 100644
index 0000000..ff6d3bc
--- /dev/null
+++ b/outlook_web/controllers/audit.py
@@ -0,0 +1,23 @@
+from __future__ import annotations
+
+from typing import Any
+
+from flask import jsonify, request
+
+from outlook_web.audit import query_audit_logs
+from outlook_web.security.auth import login_required
+
+
+# ==================== 审计日志 API ====================
+
+
+@login_required
+def api_get_audit_logs() -> Any:
+    """获取审计日志（敏感操作可追溯）"""
+    data = query_audit_logs(
+        limit=request.args.get("limit", type=int) or 50,
+        offset=request.args.get("offset", type=int) or 0,
+        action=request.args.get("action") or "",
+        resource_type=request.args.get("resource_type") or "",
+    )
+    return jsonify({"success": True, **data})
diff --git a/outlook_web/routes/audit.py b/outlook_web/routes/audit.py
index 3c2bc20..14402c9 100644
--- a/outlook_web/routes/audit.py
+++ b/outlook_web/routes/audit.py
@@ -2,8 +2,11 @@ from __future__ import annotations
 
 from flask import Blueprint
 
+from outlook_web.controllers import audit as audit_controller
 
-def create_blueprint(*, impl) -> Blueprint:
+
+def create_blueprint() -> Blueprint:
+    """创建 audit Blueprint"""
     bp = Blueprint("audit", __name__)
-    bp.add_url_rule("/api/audit-logs", view_func=impl.api_get_audit_logs, methods=["GET"])
+    bp.add_url_rule("/api/audit-logs", view_func=audit_controller.api_get_audit_logs, methods=["GET"])
     return bp