# List audit logs Lists stored audit events for the authorized organization or team. Organization scope includes child team events. Filters use stored identifiers so deleted resources remain queryable. Set `includeSpec` to return decrypted before and after resource specifications when the caller has audit log specification access. Specifications can contain secret values. Cursor pagination supports browsing, not durable export. Required permission: Account > Admin > AuditLogs > Read **Query parameters:** {object} - `cursor`: (string) The cursor returned from the previous page of results, used to request the next page. (min length: 24) (max length: 24) - `per_page`: (integer) The number of results to return. When `includeSpec` is true, the default and maximum are 20. - `includeSpec`: (boolean) Include decrypted before and after resource specifications. This can expose secret values and requires audit log specification access. - `after`: (string) Include events created at or after this ISO-8601 timestamp. (format: date-time) - `before`: (string) Include events created at or before this ISO-8601 timestamp. (format: date-time) - `event`: (string) Stored audit event name. Repeat `event` to select up to 50 distinct event names. (min length: 1) (max length: 256) - `apiTokenUid`: (string) Stored API token UID. (min length: 24) (max length: 24) - `sourceWorkloadUid`: (string) Stored source workload UID. (min length: 24) (max length: 24) - `teamUid`: (string) Stored child team UID. This filter is available only for organization scope. (min length: 24) (max length: 24) - `projectUid`: (string) Stored project UID. (min length: 24) (max length: 24) - `resourceType`: (string) Stored resource type. (min length: 1) (max length: 256) - `resourceUid`: (string) Stored resource UID. (min length: 24) (max length: 24) - `resourceId`: (string) Stored resource ID. This filter requires `resourceType`. (min length: 1) (max length: 256) **Response body:** {object} - `data`: {object} - `auditLogs`: [array of] {object} - `uid`: (string) (required) Audit event UID. (min length: 24) (max length: 24) - `event`: (string) Stored audit event name when available. - `createdAt`: (string) (required) Time when the audit event was created. (format: date-time) - `updatedAt`: (string) (required) Time when the audit event was last updated. (format: date-time) - `operationCompletedAt`: (string) Time when the audited operation completed. (format: date-time) - `origin`: (string) Stored audit event origin. - `trigger`: (string) Stored audit event trigger. - `pending`: (boolean) (required) Whether the audited operation is pending. - `success`: (boolean) Whether the audited operation succeeded. - `finalizationStatus`: (string) Completeness of audit event finalization. (enum: pending, complete, incomplete) - `stateCapture`: {object} - `before`: (string) (enum: pending, complete, incomplete, skipped, notCaptured) - `after`: (string) (enum: pending, complete, incomplete, skipped, notCaptured) - `caller`: {object} - `uid`: (string) Stored root caller UID. (min length: 24) (max length: 24) - `apiToken`: {object} - `uid`: (string) (required) Stored API token UID. (min length: 24) (max length: 24) - `scope`: {object} - `entityUid`: (string) Stored entity UID. (min length: 24) (max length: 24) - `entityType`: (string) Stored entity type. - `organizationUid`: (string) Stored organization UID. (min length: 24) (max length: 24) - `projectUid`: (string) Stored project UID. (min length: 24) (max length: 24) - `sourceWorkloadUid`: (string) Stored source workload UID. (min length: 24) (max length: 24) - `sourceWorkloadType`: (string) Stored source workload type. - `resources`: [array of] {object} - `uid`: (string) (required) Permanent identifier for the resource. Unlike `id`, it never changes and is never reused. (min length: 24) (max length: 24) - `id`: (string) Stored resource ID. - `type`: (string) Stored resource type. - `before`: [array of] {object} - `uid`: (string) (required) Permanent identifier for the resource. Unlike `id`, it never changes and is never reused. (min length: 24) (max length: 24) - `id`: (string) Stored resource ID. - `type`: (string) Stored resource type. - `spec`: {object} - `specSanitization`: (string) Protection that the audit store applied to the specification. (enum: schema_encrypted, secrets_excluded) - `specSanitizationVersion`: (integer) Stored specification protection version. - `after`: [array of] {object} - `uid`: (string) (required) Permanent identifier for the resource. Unlike `id`, it never changes and is never reused. (min length: 24) (max length: 24) - `id`: (string) Stored resource ID. - `type`: (string) Stored resource type. - `spec`: {object} - `specSanitization`: (string) Protection that the audit store applied to the specification. (enum: schema_encrypted, secrets_excluded) - `specSanitizationVersion`: (integer) Stored specification protection version. - `parentUids`: [array of] (string) (min length: 24) (max length: 24) - `pagination`: {object} - `hasNextPage`: (boolean) (required) Is there another page of results available? - `cursor`: (string) The cursor to access the next page of results. - `count`: (number) (required) The number of results returned by this request. (format: float) ## API reference GET /v1/audit-logs GET /v1/teams/{teamId}/audit-logs ### Example Response 200 OK: The list of audit events. ```json { "data": { "auditLogs": [ { "resources": [ { "uid": "68f0aa1b9c4e2d7f11a3b402" } ], "before": [ { "uid": "68f0aa1b9c4e2d7f11a3b402" } ], "after": [ { "uid": "68f0aa1b9c4e2d7f11a3b402" } ] } ] }, "pagination": { "hasNextPage": false, "count": 1 } } ``` ## CLI reference $ northflank get audit-logs Options: - `--cursor `: The cursor returned from the previous page of results, used to request the next page. - `--per_page `: The number of results to return. When `includeSpec` is true, the default and maximum are 20. - `--includeSpec `: Include decrypted before and after resource specifications. This can expose secret values and requires audit log specification access. - `--after `: Include events created at or after this ISO-8601 timestamp. - `--before `: Include events created at or before this ISO-8601 timestamp. - `--event `: Stored audit event name. Repeat `event` to select up to 50 distinct event names. - `--apiTokenUid `: Stored API token UID. - `--sourceWorkloadUid `: Stored source workload UID. - `--teamUid `: Stored child team UID. This filter is available only for organization scope. - `--projectUid `: Stored project UID. - `--resourceType `: Stored resource type. - `--resourceUid `: Stored resource UID. - `--resourceId `: Stored resource ID. This filter requires `resourceType`. - `--verbose `: Verbose output - `--quiet `: No console output - `-o --output `: Output formatting ### Example Response The list of audit events. ```json { "auditLogs": [ { "resources": [ { "uid": "68f0aa1b9c4e2d7f11a3b402" } ], "before": [ { "uid": "68f0aa1b9c4e2d7f11a3b402" } ], "after": [ { "uid": "68f0aa1b9c4e2d7f11a3b402" } ] } ] } ``` ## JavaScript client reference ### Example request With an organization token, add `parameters.teamId`. [Organization API access](/docs/v1/api/use-the-api#organization-api-access). ```javascript await apiClient.get.auditLogs({ options: { "per_page": 50 } }); ``` ### Example Response The list of audit events. ```json { "data": { "auditLogs": [ { "resources": [ { "uid": "68f0aa1b9c4e2d7f11a3b402" } ], "before": [ { "uid": "68f0aa1b9c4e2d7f11a3b402" } ], "after": [ { "uid": "68f0aa1b9c4e2d7f11a3b402" } ] } ] }, "pagination": { "hasNextPage": false, "count": 1 }, "rawResponse": "...", "request": "...", "error": "..." } ``` ## Python client reference ### Example request [Set up the Python client](/docs/v1/api/use-the-python-client#usage). With an organization token, add `team_id`. [Organization API access](/docs/v1/api/use-the-api#organization-api-access). Python SDK 2.1.0 has no generated method for this endpoint. Use the API example for this request. Previous: [Delete a key from an API token](/docs/v1/api/team/api-tokens/delete-a-key-from-an-api-token) Next: [Get credit balance](/docs/v1/api/org/billing/get-credit-balance)