---
title: "auditLog.list"
method: POST
path: "/auditLog.list"
tags: ["Audit Log"]
---

# auditLog.list

`POST /auditLog.list`

> **Beta**
>
> **This API is in active development and only available in a closed beta with early design partners.**

Lists an organization's audit log entries, newest first. The `targetTypes` and
`categories` you can filter on are a fixed, code-defined vocabulary; see the
[Audit Log Vocabulary](/docs/audit-log-vocabulary) guide for valid values and filter examples.

**Pagination:** follow opaque `cursor` / `nextCursor`; see
[Pagination and Incremental Synchronization](/docs/pagination-and-incremental-sync).

Returns audit events for **all** objects in the organization, including confidential jobs
and projects, with no confidentiality filtering.

**Error codes:**

| Code | Description |
|---|---|
| `invalid_input` | A date bound is not a valid ISO 8601 date, `endDate` is before `startDate`, the explicit span exceeds 18 months, or a `targetTypes` / `categories` value is not in the vocabulary. |
| `audit_logs_not_enabled` | Your organization does not have the Audit Logs feature. |
| `cursor_invalid` | The provided `cursor` could not be decoded. |
| `missing_endpoint_permission` | The API key lacks the `auditLogsRead` scope. Returned with HTTP `403`. |

**Requires the [`auditLogsRead`](authentication#permissions-auditloglist) permission.**

## Request body

- AuditLogListRequest
  - `cursor` string — Opaque pagination cursor from a previous response's nextCursor. Reuse it only with the same startDate, endDate, and filter parameters as the request that produced it; changing the window or filters while keeping a cursor can return empty or incomplete pages.
  - `limit` integer — Maximum entries per page. Defaults to 100 when omitted. Maximum is 100.
  - `startDate` string — ISO 8601 start of the date window (UTC). When omitted, defaults to 24 hours before endDate. When only startDate is supplied, endDate defaults to startDate plus 24 hours (not until now) — use both bounds for a custom span.
  - `endDate` string — ISO 8601 end of the date window (UTC). When omitted with startDate, defaults to startDate plus 24 hours; when both are omitted, defaults to the current time.
  - `actorIds` string[] — Restricts results to entries whose actor id is one of these values. An empty array is ignored, same as omitting this field. Max 100 items.
  - `targetIds` string[] — Restricts results to entries whose target object id is one of these values. Combined with other filters using AND (all conditions must match). An empty array is ignored. Max 100 items.
  - `targetTypes` string[] — Restricts results to entries whose target type is one of these values (e.g. "job", "app_user"). When both targetTypes and categories are supplied, matching uses OR (entries that match either filter). Combined with targetIds and actorIds using AND. An empty array is ignored. Max 100 items.
  - `categories` string[] — Restricts results to entries in one of categories (e.g. "JobStatusChanged"). Max 100 items. See the Audit Log Vocabulary guide.

## Response `200`

Responses from the auditLog.list endpoint

- union
  - AuditLogListSuccessResponse
    - `success` true, required
    - `results` AuditLogEntry[], required
      - `id` string, required — The unique identifier for the audit log entry
      - `timestamp` string, required — When the audited action occurred, as an ISO 8601 timestamp in UTC (e.g. 2026-06-02T15:04:05.123Z).
      - `actor` AuditLogActor, required
        - `type` string, required — The kind of actor that performed the action: "User", "Automation", or "Other".
        - `id` string, nullable, required — The unique identifier of the actor when one exists (typically a user id for User actors).
      - `target` AuditLogTarget, required
        - `type` string, nullable, required — The target object type. See the Audit Log Vocabulary guide.
        - `id` string, nullable, required — The unique identifier of the target object.
      - `category` string, required — The action category with new categories appearing in responses over time; see the Audit Log Vocabulary guide.
      - `description` string, required — A human-readable description of the audited action.
      - `request` AuditLogRequest, required
        - `id` string, nullable, required — The unique identifier of the HTTP request that triggered the action, if any.
        - `ipAddress` string, nullable, required — The IP address of the client that made the request, if available.
      - `parentAction` AuditLogParentAction, required
        - `id` string, nullable, required — The unique identifier of the parent action that caused this entry, if any.
        - `type` string, nullable, required — The kind of parent action (e.g. the bulk operation type).
        - `name` string, nullable, required — A human-readable name for the parent action, if available.
      - `changedFields` AuditLogChangedFields, nullable, required — Per-field before/after change map for update actions; `null` for creates, deletes, or entries that pre-date the changeset.
    - `nextCursor` string — Opaque cursor for the next page when moreDataAvailable is true. Pass unchanged with the same date range and filters.
    - `moreDataAvailable` boolean, required — True when another page exists within the same date range and filter set.
  - ErrorResponse
    - `success` false, required
    - `errors` ErrorDetail[], required
      - `message` string, required
      - `parameter` string

---

[API](https://skmtc.net/ashbyhq/apis/ashby-api.md) · [All operations](https://skmtc.net/ashbyhq/apis/ashby-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ashbyhq/ashby-api/revisions/778b919dc743/schema)