> ## Documentation Index
> Fetch the complete documentation index at: https://docs.veridox.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Audit Log

> List the audit log entries recorded for your organisation.

Returns your organisation's audit log, newest first, with pagination. Filter by `action`, `target_type`, `actor_id`, and a `from`/`to` date range.

## Permission

Requires `organisation_settings:read`, which the Owner and Admin roles hold by default. A caller without it receives `403`.

## What Is Recorded

Only the following actions are recorded. Reading data, uploading files and creating cases are not.

| `action` | Recorded when |
| - | - |
| `member.role_changed` | A member's role changes |
| `role_config.updated` | The permissions a role holds change |
| `file.risk_score_overridden` | A file's risk score is changed |
| `file.archived` | A file is archived |
| `file.deleted` | A file is permanently deleted |
| `file.reassigned` | A file is moved to another case |
| `case.label_updated` | A case label changes |
| `team.created`, `team.deleted` | A team is created or deleted |
| `team.member_added`, `team.member_removed` | A member joins or leaves a team |
| `api_key.created`, `api_key.revoked` | An API key is created or revoked |
| `verification_settings.updated` | The verification setting changes |
| `knowledge_access.granted`, `knowledge_access.revoked` | Knowledge access is granted or revoked |
| `knowledge_graph_mode.updated` | The knowledge graph mode changes |

## Who Made the Change

`actor_type` says who made each change:

| `actor_type` | Meaning | `actor_name` |
| - | - | - |
| `user` | A person in your organisation | The person's name, or `[deleted user]` if their account no longer exists |
| `api_key` | An API key | The key's name, which stays after the key is revoked. `API key` if the name cannot be told apart from another key's, and `[deleted API key]` only if no matching key exists |
| `system` | Veridox, acting on your organisation's behalf | `[Veridox admin tool]` |

For an action taken with an API key, `actor_id` is the ID of the person who created the key, and `actor_email` is `API key`.

## Related

* [Permissions and API Keys](/guides/permissions.md) describes which actions an API key can take.


## OpenAPI

````yaml GET /organisations/audit-log
openapi: 3.1.0
info:
  title: Veridox Core API
  description: Veridox Core Platform API
  version: 0.0.1
  contact: {}
servers:
  - url: https://api.uk.veridox.ai
    description: Live (UK)
  - url: https://api.ca.veridox.ai
    description: Live (CA)
security: []
tags:
  - name: Status
    description: System status and health check endpoints
  - name: Cases
    description: Case and case file management
  - name: Organisations
    description: Organisation management
  - name: Document Requests
    description: Document request management
  - name: Search
    description: Search functionality
  - name: Admin
    description: Administrative endpoints
paths:
  /organisations/audit-log:
    get:
      tags:
        - Organisations
      summary: List organisation audit log entries
      description: >-
        Returns paginated, filterable audit log entries for the organisation,
        with actor email/name hydrated (degrading to '[deleted user]' if the
        actor's account no longer resolves). Requires
        organisation_settings:read.
      operationId: OrganisationsController_getAuditLog
      parameters:
        - name: limit
          required: false
          in: query
          x-nestjs_zod-parent-additional-properties: false
          schema:
            minimum: 1
            maximum: 100
            default: 50
            type: integer
        - name: offset
          required: false
          in: query
          x-nestjs_zod-parent-additional-properties: false
          schema:
            minimum: 0
            maximum: 9007199254740991
            default: 0
            type: integer
        - name: action
          required: false
          in: query
          x-nestjs_zod-parent-additional-properties: false
          schema:
            type: string
            enum:
              - member.role_changed
              - role_config.updated
              - file.risk_score_overridden
              - file.archived
              - file.deleted
              - file.reassigned
              - case.label_updated
              - team.created
              - team.deleted
              - team.member_added
              - team.member_removed
              - api_key.created
              - api_key.revoked
              - verification_settings.updated
              - knowledge_access.granted
              - knowledge_access.revoked
              - knowledge_graph_mode.updated
        - name: target_type
          required: false
          in: query
          x-nestjs_zod-parent-additional-properties: false
          schema:
            type: string
            enum:
              - member
              - organisation
              - file
              - case
              - team
              - api_key
        - name: actor_id
          required: false
          in: query
          x-nestjs_zod-parent-additional-properties: false
          schema:
            type: string
            format: uuid
            pattern: >-
              ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
        - name: from
          required: false
          in: query
          x-nestjs_zod-parent-additional-properties: false
          schema:
            type: string
            format: date-time
            pattern: >-
              ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
        - name: to
          required: false
          in: query
          x-nestjs_zod-parent-additional-properties: false
          schema:
            type: string
            format: date-time
            pattern: >-
              ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
      responses:
        '200':
          description: Audit log entries retrieved successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditLogResponseDto'
        '400':
          description: Invalid query parameters
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorDto'
        '401':
          description: Unauthorized (invalid or missing authentication token)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorDto'
        '403':
          description: Caller lacks organisation_settings:read
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorDto'
        '429':
          description: Too many requests (rate limit exceeded)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorDto'
      security:
        - api-key: []
components:
  schemas:
    AuditLogResponseDto:
      type: object
      properties:
        entries:
          type: array
          items:
            type: object
            properties:
              id:
                type: string
                format: uuid
                pattern: >-
                  ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
              action:
                type: string
                enum:
                  - member.role_changed
                  - role_config.updated
                  - file.risk_score_overridden
                  - file.archived
                  - file.deleted
                  - file.reassigned
                  - case.label_updated
                  - team.created
                  - team.deleted
                  - team.member_added
                  - team.member_removed
                  - api_key.created
                  - api_key.revoked
                  - verification_settings.updated
                  - knowledge_access.granted
                  - knowledge_access.revoked
                  - knowledge_graph_mode.updated
              target_type:
                type: string
                enum:
                  - member
                  - organisation
                  - file
                  - case
                  - team
                  - api_key
              target_id:
                type: string
                format: uuid
                pattern: >-
                  ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
              actor_id:
                anyOf:
                  - type: string
                    format: uuid
                    pattern: >-
                      ^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$
                  - type: 'null'
              actor_role:
                type: string
              actor_type:
                type: string
                enum:
                  - user
                  - api_key
                  - system
              actor_email:
                type: string
              actor_name:
                type: string
              metadata:
                anyOf:
                  - type: object
                    propertyNames:
                      type: string
                    additionalProperties: {}
                  - type: 'null'
              created_at:
                type: string
                format: date-time
                pattern: >-
                  ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
            required:
              - id
              - action
              - target_type
              - target_id
              - actor_id
              - actor_role
              - actor_type
              - actor_email
              - actor_name
              - metadata
              - created_at
          x-nestjs_zod-uses-3-point-1-syntax: true
        total:
          type: integer
          minimum: 0
          maximum: 9007199254740991
          x-nestjs_zod-uses-3-point-1-syntax: true
        limit:
          type: integer
          exclusiveMinimum: 0
          maximum: 9007199254740991
          x-nestjs_zod-uses-3-point-1-syntax: true
        offset:
          type: integer
          minimum: 0
          maximum: 9007199254740991
          x-nestjs_zod-uses-3-point-1-syntax: true
      required:
        - entries
        - total
        - limit
        - offset
    ErrorDto:
      type: object
      properties:
        error_code:
          type: string
          description: Machine-readable error code for programmatic handling
          examples:
            - request.cases.file.missing-risk-score
            - request.authentication.invalid-token
            - request.forbidden
            - request.cases.case.not-found
            - request.cases.case.already-locked
        error_message:
          type: string
          description: Human-readable error message explaining what went wrong
          example: >-
            User tried to perform an invalid operation on a file without a risk
            score.
        error_details:
          type: object
          example:
            field: email_address
      required:
        - error_code
        - error_message
  securitySchemes:
    api-key:
      type: apiKey
      in: header
      name: x-api-key

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.