Skip to main content
GET
List organisation audit log entries
Returns your organisation’s audit log, newest first, with pagination. Filter by action, target_type, actor_id, and a from/to date range.

Permission

Requires organisation_settings:read, which the Owner and Admin roles hold by default. A caller without it receives 403.

What Is Recorded

Only the following actions are recorded. Reading data, uploading files and creating cases are not.

Who Made the Change

actor_type says who made each change: For an action taken with an API key, actor_id is the ID of the person who created the key, and actor_email is API key.

Authorizations

x-api-key
string
header
required

Query Parameters

limit
integer
default:50
Required range: 1 <= x <= 100
offset
integer
default:0
Required range: 0 <= x <= 9007199254740991
action
enum<string>
Available options:
member.role_changed,
role_config.updated,
file.risk_score_overridden,
file.archived,
file.deleted,
file.reassigned,
case.label_updated,
team.created,
team.deleted,
team.member_added,
team.member_removed,
api_key.created,
api_key.revoked,
verification_settings.updated,
knowledge_access.granted,
knowledge_access.revoked,
knowledge_graph_mode.updated
target_type
enum<string>
Available options:
member,
organisation,
file,
case,
team,
api_key
actor_id
string<uuid>
Pattern: ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
from
string<date-time>
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
to
string<date-time>
Pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$

Response

Audit log entries retrieved successfully

entries
object[]
required
total
integer
required
Required range: 0 <= x <= 9007199254740991
limit
integer
required
Required range: x <= 9007199254740991
offset
integer
required
Required range: 0 <= x <= 9007199254740991