List audit log events
Queries audit events in the organization (console management operations, login events, and Admin API operations), newest first, with cursor pagination.
curl --request GET \
--url https://api.moonshot.ai/v1/admin/organizations/audit_logs \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.moonshot.ai/v1/admin/organizations/audit_logs"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.moonshot.ai/v1/admin/organizations/audit_logs', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.moonshot.ai/v1/admin/organizations/audit_logs",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.moonshot.ai/v1/admin/organizations/audit_logs"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.moonshot.ai/v1/admin/organizations/audit_logs")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.moonshot.ai/v1/admin/organizations/audit_logs")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": [
{
"id": "<string>",
"event_type": "api_key.created",
"organization_id": "<string>",
"actor": {
"type": "user",
"id": "<string>",
"name": "<string>",
"ip": "<string>",
"user_agent": "<string>"
},
"result": "success",
"created_at": "2023-11-07T05:31:56Z",
"project_id": "<string>",
"target": {
"type": "api_key",
"id": "<string>",
"name": "<string>"
},
"error_code": "<string>",
"error_message": "<string>",
"detail": {}
}
],
"has_more": true,
"next": "<string>"
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}audit:read scope.Audit logging is enabled per organization: an organization admin turns it on under Console → Organization → Admin API Keys → the audit log card. While disabled, this endpoint returns an empty list — indistinguishable from “no events”. Once enabled, events become queryable from that moment on: nothing is backfilled, and gaps while disabled are unrecoverable. Every call to this endpoint itself records an audit_log.read audit event.Authorizations
Send the Admin API secret as a Bearer token in the Authorization header (Bearer sk-admin-***). Create Admin Keys under Console → Organization → Admin API Keys.
Query Parameters
Start time in milliseconds, inclusive, e.g. 1790784000000 (2026-10-01 00:00 CST).
x >= 0End time in milliseconds, exclusive, e.g. 1792598400000 (2026-10-22 00:00 CST).
x >= 0Event type filter. Only events whose event_type is in this list are returned. Accepts repeated parameters or a comma-separated value.
Audit event type. New values may be added over time.
| Value | Meaning |
|---|---|
api_key.created | Business API key created. |
api_key.updated | Business API key updated (rename / enable-disable). |
api_key.deleted | Business API key deleted (revoked). |
admin_api_key.created | Admin key created (console self-serve issuance). |
admin_api_key.updated | Admin key updated (name / scopes / expiry); rotation reuses this event with detail.action=rotate. |
admin_api_key.deleted | Admin key deleted (soft-deleted, kept grayed-out in the list). |
organization.member_invited | Organization member invitation created. |
organization.member_joined | Invitee accepted the invitation and joined the organization. |
organization.member_role_updated | Organization member role changed (admin ↔ member). |
organization.member_removed | Organization member removed. |
organization.ip_whitelist_updated | Organization IP whitelist overwritten as a whole. |
organization.audit_log_enabled | Organization audit log enabled (by an org admin). |
organization.audit_log_disabled | Organization audit log disabled. |
project.created | Project created. |
project.updated | Project updated (name / description). |
project.archived | Project archived. |
project.member_added | Project member added (upsert semantics). |
project.member_role_updated | Project member role changed. |
project.member_removed | Project member removed. |
project.spend_limit_updated | Project spend limits changed. |
project.rate_limit_updated | Project rate limits (TPM dimension) changed. |
audit_log.read | Audit logs queried (self-audit; one event per GET audit_logs call). |
auth.login_succeeded | Login succeeded. |
auth.login_failed | Login failed (the only failed-result event retained, for security audit). |
api_key.created, api_key.updated, api_key.deleted, admin_api_key.created, admin_api_key.updated, admin_api_key.deleted, organization.member_invited, organization.member_joined, organization.member_role_updated, organization.member_removed, organization.ip_whitelist_updated, organization.audit_log_enabled, organization.audit_log_disabled, project.created, project.updated, project.archived, project.member_added, project.member_role_updated, project.member_removed, project.spend_limit_updated, project.rate_limit_updated, audit_log.read, auth.login_succeeded, auth.login_failed Actor id filter (uid or admin key id).
Actor type filter.
user, api_key Target type filter. Audit event target type.
| Value | Meaning |
|---|---|
api_key | Business API key (ak- prefixed). |
admin_api_key | Admin key (admk_ prefixed). |
member | Organization / project member (uid). |
project | Project (proj- prefixed). |
invite | Invitation. |
ip_whitelist | Organization IP whitelist. |
user | Platform user (login event subject). |
organization | Organization. |
audit_log | Audit log (self-audit event target). |
api_key, admin_api_key, member, project, invite, ip_whitelist, user, organization, audit_log Target id filter.
Result filter.
success, failed Page size. Defaults to 20, maximum 100.
1 <= x <= 100Cursor from the previous response next field. The cursor carries only the page position; all query parameters must be restated on every page. Keep them unchanged while paginating (except limit) — the server does not check them for consistency.
Was this page helpful?
curl --request GET \
--url https://api.moonshot.ai/v1/admin/organizations/audit_logs \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.moonshot.ai/v1/admin/organizations/audit_logs"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.moonshot.ai/v1/admin/organizations/audit_logs', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.moonshot.ai/v1/admin/organizations/audit_logs",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.moonshot.ai/v1/admin/organizations/audit_logs"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.moonshot.ai/v1/admin/organizations/audit_logs")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.moonshot.ai/v1/admin/organizations/audit_logs")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"data": [
{
"id": "<string>",
"event_type": "api_key.created",
"organization_id": "<string>",
"actor": {
"type": "user",
"id": "<string>",
"name": "<string>",
"ip": "<string>",
"user_agent": "<string>"
},
"result": "success",
"created_at": "2023-11-07T05:31:56Z",
"project_id": "<string>",
"target": {
"type": "api_key",
"id": "<string>",
"name": "<string>"
},
"error_code": "<string>",
"error_message": "<string>",
"detail": {}
}
],
"has_more": true,
"next": "<string>"
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}{
"error": {
"type": "invalid_request_error",
"code": "invalid_request",
"message": "<string>",
"request_id": "<string>",
"param": "<string>"
}
}