Skip to main content
GET
List audit log events
This endpoint requires an Admin Key with the audit:read scope.Audit logging is enabled per organization: an organization admin turns it on under Console → Organization → Admin API Keys → the audit log card. While disabled, this endpoint returns an empty list — indistinguishable from “no events”. Once enabled, events become queryable from that moment on: nothing is backfilled, and gaps while disabled are unrecoverable. Every call to this endpoint itself records an audit_log.read audit event.

Authorizations

Authorization
string
header
required

Send the Admin API secret as a Bearer token in the Authorization header (Bearer sk-admin-***). Create Admin Keys under Console → Organization → Admin API Keys.

Query Parameters

start
integer<int64>
required

Start time in milliseconds, inclusive, e.g. 1790784000000 (2026-10-01 00:00 CST).

Required range: x >= 0
end
integer<int64>
required

End time in milliseconds, exclusive, e.g. 1792598400000 (2026-10-22 00:00 CST).

Required range: x >= 0
event_types
enum<string>[]

Event type filter. Only events whose event_type is in this list are returned. Accepts repeated parameters or a comma-separated value.

Audit event type. New values may be added over time.

Available options:
api_key.created,
api_key.updated,
api_key.deleted,
admin_api_key.created,
admin_api_key.updated,
admin_api_key.deleted,
organization.member_invited,
organization.member_joined,
organization.member_role_updated,
organization.member_removed,
organization.ip_whitelist_updated,
organization.audit_log_enabled,
organization.audit_log_disabled,
project.created,
project.updated,
project.archived,
project.member_added,
project.member_role_updated,
project.member_removed,
project.spend_limit_updated,
project.rate_limit_updated,
audit_log.read,
auth.login_succeeded,
auth.login_failed
actor_id
string

Actor id filter (uid or admin key id).

actor_type
enum<string>

Actor type filter.

Available options:
user,
api_key
target_type
enum<string>

Target type filter. Audit event target type.

Available options:
api_key,
admin_api_key,
member,
project,
invite,
ip_whitelist,
user,
organization,
audit_log
target_id
string

Target id filter.

result
enum<string>

Result filter.

Available options:
success,
failed
limit
integer
default:20

Page size. Defaults to 20, maximum 100.

Required range: 1 <= x <= 100
cursor
string

Cursor from the previous response next field. The cursor carries only the page position; all query parameters must be restated on every page. Keep them unchanged while paginating (except limit) — the server does not check them for consistency.

Response

Audit events, newest first.

data
object[]
required

Audit events.

has_more
boolean
required

Whether there is a next page.

next
string | null
required

Cursor for the next page. Pass it back verbatim as the cursor query parameter.