List audit logs

Lists stored audit events for the authorized organization or team. Organization scope includes child team events. Filters use stored identifiers so deleted resources remain queryable. Set `includeSpec` to return decrypted before and after resource specifications when the caller has audit log specification access. Specifications can contain secret values. Cursor pagination supports browsing, not durable export.

Required permission

Account > Admin > AuditLogs > Read

Query parameters

cursor
string
The cursor returned from the previous page of results, used to request the next page.
min length
24
max length
24
per_page
integer
The number of results to return. When `includeSpec` is true, the default and maximum are 20.
min
1
max
100
includeSpec
boolean
Include decrypted before and after resource specifications. This can expose secret values and requires audit log specification access.
after
string
Include events created at or after this ISO-8601 timestamp.
before
string
Include events created at or before this ISO-8601 timestamp.
event
string
Stored audit event name. Repeat `event` to select up to 50 distinct event names.
min length
1
max length
256
apiTokenUid
string
Stored API token UID.
min length
24
max length
24
sourceWorkloadUid
string
Stored source workload UID.
min length
24
max length
24
teamUid
string
Stored child team UID. This filter is available only for organization scope.
min length
24
max length
24
projectUid
string
Stored project UID.
min length
24
max length
24
resourceType
string
Stored resource type.
min length
1
max length
256
resourceUid
string
Stored resource UID.
min length
24
max length
24
resourceId
string
Stored resource ID. This filter requires `resourceType`.
min length
1
max length
256

Response body

{object}
Response object.

data
{object} required
Result data.

auditLogs
[array] required
Audit events in newest-first cursor order.

{object}
Public audit log list item.

uid
string required
Audit event UID.
min length
24
max length
24
event
string
Stored audit event name when available.
createdAt
string required
Time when the audit event was created.
updatedAt
string required
Time when the audit event was last updated.
operationCompletedAt
string
Time when the audited operation completed.
origin
string
Stored audit event origin.
trigger
string
Stored audit event trigger.
pending
boolean required
Whether the audited operation is pending.
success
boolean
Whether the audited operation succeeded.
finalizationStatus
string
Completeness of audit event finalization.
one of
pending, complete, incomplete
stateCapture
{object}
Completeness of the stored before and after state.

before
string
one of
pending, complete, incomplete, skipped, notCaptured
after
string
one of
pending, complete, incomplete, skipped, notCaptured

caller
{object}
Stored caller identifiers. Values are not resolved from live identity records.

uid
string required
Stored root caller UID.
min length
24
max length
24
apiToken
{object}
Stored API token snapshot for the request.

uid
string required
Stored API token UID.
min length
24
max length
24

scope
{object} required
Stored scope of the audit event.

entityUid
string
Stored entity UID.
min length
24
max length
24
entityType
string
Stored entity type.
organizationUid
string
Stored organization UID.
min length
24
max length
24
projectUid
string
Stored project UID.
min length
24
max length
24
sourceWorkloadUid
string
Stored source workload UID.
min length
24
max length
24
sourceWorkloadType
string
Stored source workload type.

resources
[array] required
Deduplicated stored resource references without specifications.

{object}
Stored resource reference. Resource specifications are not returned.

uid
string required
Permanent identifier for the resource. Unlike `id`, it never changes and is never reused.
min length
24
max length
24
id
string
Stored resource ID.
type
string
Stored resource type.

before
[array]
Stored resource states before the event. Returned only when `includeSpec` is true.

{object}
Stored resource state with its decrypted specification when available.

uid
string required
Permanent identifier for the resource. Unlike `id`, it never changes and is never reused.
min length
24
max length
24
id
string
Stored resource ID.
type
string
Stored resource type.
spec
{object}
Stored decrypted resource specification.

specSanitization
string
Protection that the audit store applied to the specification.
one of
schema_encrypted, secrets_excluded
specSanitizationVersion
integer
Stored specification protection version.
min
1

after
[array]
Stored resource states after the event. Returned only when `includeSpec` is true.

{object}
Stored resource state with its decrypted specification when available.

uid
string required
Permanent identifier for the resource. Unlike `id`, it never changes and is never reused.
min length
24
max length
24
id
string
Stored resource ID.
type
string
Stored resource type.
spec
{object}
Stored decrypted resource specification.

specSanitization
string
Protection that the audit store applied to the specification.
one of
schema_encrypted, secrets_excluded
specSanitizationVersion
integer
Stored specification protection version.
min
1

parentUids
[array] required
Stored parent audit event UIDs.

string
min length
24
max length
24

pagination
{object} required
Data about the endpoint pagination.

hasNextPage
boolean required
Is there another page of results available?
cursor
string
The cursor to access the next page of results.
count
number required
The number of results returned by this request.

GET /v1/audit-logs

GET /v1/teams/{teamId}/audit-logs

Example response

200 OK

The list of audit events.

JSON

{
  "data": {
    "auditLogs": [
      {
        "resources": [
          {
            "uid": "68f0aa1b9c4e2d7f11a3b402"
          }
        ],
        "before": [
          {
            "uid": "68f0aa1b9c4e2d7f11a3b402"
          }
        ],
        "after": [
          {
            "uid": "68f0aa1b9c4e2d7f11a3b402"
          }
        ]
      }
    ]
  },
  "pagination": {
    "hasNextPage": false,
    "count": 1
  }
}