AWS CloudTrail is the correct service for reviewing user activity through API calls. It provides event history of AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. CloudTrail logs API calls and related events, making it essential for security monitoring, compliance auditing, and operational troubleshooting.

Why other options are incorrect:

• AWS WAF: Web Application Firewall that protects web applications from common web exploits
• Amazon Detective: Security service that analyzes and visualizes security data to identify root causes of potential security issues
• Amazon CloudWatch: Monitoring and observability service for AWS resources and applications, but not specifically designed for API call auditing