--- title: "List audit log entries" method: GET path: "/iam/v2beta/audit-log-entries" tags: ["Audit logs"] --- # List audit log entries `GET /iam/v2beta/audit-log-entries` Returns a list of audit log entries. ## Query parameters - `limit` integer - `token` string ## Response `200` A list of audit log entries. - object - `items` AuditLogEntry[], required — A list of resources. - `id` string, required — Unique resource identifier. - `organizationId` string — Unique resource identifier for an Organization. - `userId` string — Unique resource identifier. - `roleId` string — Unique resource identifier. - `sessionId` string, required — Unique resource identifier. - `requestId` string, required — ID of the request that triggered the action. - `actionTimestamp` string, date-time, required — Timestamp when the action was performed. - `details` union, required — Details of the action that was performed. The details are specific to the type of action. - AuditLogEntrySignUpSucceededDetails — A user has successfully signed up. The user also needs to verify their email address before they can authenticate and log in. Note that a user does not have to sign up when authenticating using SSO. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `invitationId` string — Unique resource identifier. - AuditLogEntrySignUpFailedDetails — A user sign up has failed. See reason for more details. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `reason` 'USER_ALREADY_EXISTS' | 'PASSWORD_INVALID', required - `invitationId` string — Unique resource identifier. - AuditLogEntrySignUpEmailConfirmationResentDetails — An email confirmation has been resent to the user. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `invitationId` string — Unique resource identifier. - AuditLogEntrySignUpEmailConfirmationSucceededDetails — The user has successfully confirmed their email address. Note that a user does not have to confirm their email address when authenticating using SSO. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `invitationId` string — Unique resource identifier. - AuditLogEntrySignUpEmailConfirmationFailedDetails — An email confirmation has failed. See reason for more details. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `reason` 'CONFIRMATION_CODE_INVALID' | 'CONFIRMATION_CODE_EXPIRED', required - `invitationId` string — Unique resource identifier. - AuditLogEntryLoginStepPasswordSucceededDetails — A user has provided a correct combination of username and password. Note that the user might need to do an MFA step in order to be fully authenticated and able to log in. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `invitationId` string — Unique resource identifier. - AuditLogEntryLoginStepPasswordFailedDetails — A user authenticating using username and password has failed. See reason for more details. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `reason` 'USER_DOES_NOT_EXIST' | 'PASSWORD_INCORRECT' | 'EMAIL_ADDRESS_NOT_CONFIRMED' | 'PASSWORD_RESET_REQUIRED' | 'USER_BLOCKED', required - `invitationId` string — Unique resource identifier. - AuditLogEntryLoginStepSSOSucceededDetails — A user has successfully authenticated using an identity provider. Note that the user might need to do an MFA step in order to be fully authenticated and able to log in. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `identityProviderId` string, required — Unique resource identifier. - `invitationId` string — Unique resource identifier. - AuditLogEntryLoginStepSSOFailedDetails — A user authentication using an identity provider has failed. See reason for more details. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `reason` 'IDENTITY_PROVIDER_DISABLED' | 'EMAIL_ADDRESS_DOMAIN_NOT_ALLOWED' | 'INVITATION_REQUIRED' | 'EMAIL_ADDRESS_NOT_MATCHING_INVITATION' | 'USER_BLOCKED', required - `identityProviderId` string, required — Unique resource identifier. - `invitationId` string — Unique resource identifier. - AuditLogEntryMFACredentialCreatedDetails — A user has successfully added a new MFA credential. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `credential` AuditLogEntryMFACredentialWebAuthn, required — Information related to the WebAuthn credential. - `type` 'WEBAUTHN', required - `id` string, required — Unique resource identifier. - AuditLogEntryMFACredentialDeletedDetails — A user has successfully added a new MFA credential. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `credential` AuditLogEntryMFACredentialWebAuthn, required — Information related to the WebAuthn credential. - `type` 'WEBAUTHN', required - `id` string, required — Unique resource identifier. - AuditLogEntryLoginStepMFASucceededDetails — A user has successfully authenticated using MFA and is now fully authenticated. They can now log in. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `credential` AuditLogEntryMFACredentialWebAuthn, required — Information related to the WebAuthn credential. - `type` 'WEBAUTHN', required - `id` string, required — Unique resource identifier. - AuditLogEntryLoginStepMFAFailedDetails — A user authentication using MFA has failed. See reason for more details. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `reason` 'SESSION_EXPIRED' | 'MFA_FAILED' | 'CLIENT_ERROR', required - AuditLogEntryLoginDetails — Login represents a user logging into an organization with a specific role specified by the membership. Note that this happens after the user has been authenticated, which is a separate entry. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `roleId` string, required — Unique resource identifier. - AuditLogEntryPasswordResetSentDetails — A user has requested to reset their password. An email with a reset link has been sent. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - AuditLogEntryPasswordResetSucceededDetails — A user has successfully reset their password. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - AuditLogEntryPasswordResetFailedDetails — A user password reset has failed. See reason for more details. - `type` 'SIGNUP_SUCCEEDED' | 'SIGNUP_FAILED' | 'SIGNUP_EMAIL_CONFIRMATION_RESENT' | 'SIGNUP_EMAIL_CONFIRMATION_SUCCEEDED' | 'SIGNUP_EMAIL_CONFIRMATION_FAILED' | 'LOGIN_STEP_PASSWORD_SUCCEEDED' | 'LOGIN_STEP_PASSWORD_FAILED' | 'LOGIN_STEP_SSO_SUCCEEDED' | 'LOGIN_STEP_SSO_FAILED' | 'MFA_CREDENTIAL_CREATED' | 'MFA_CREDENTIAL_DELETED' | 'LOGIN_STEP_MFA_SUCCEEDED' | 'LOGIN_STEP_MFA_FAILED' | 'LOGIN' | 'PASSWORD_RESET_SENT' | 'PASSWORD_RESET_SUCCEEDED' | 'PASSWORD_RESET_FAILED', required - `reason` 'CONFIRMATION_CODE_INVALID' | 'CONFIRMATION_CODE_EXPIRED' | 'NEW_PASSWORD_INVALID', required - `version` integer, required — Resource version. Starts at value `1` when the resource is created and increases by one for each successive update. - `etag` string, required — [ETag](https://en.wikipedia.org/wiki/HTTP_ETag) based on the resource version. This can be passed along in `If-Match` HTTP header when updating a resource to perform a conditional update. - `created` string, date-time, required — Time at which the resource was created. - `nextToken` string, required — Pagination token for next page. The value will be a non-empty string if there are more resources to be fetched. The value will be an empty string if there are no more resources to be fetched. - `token` string, required — The pagination token that was used for this request. The value will be an empty string if no `token` query parameter was provided with the request. - `limit` integer, required — The page limit that was used for this request. ## Other responses - `400` — Bad request. --- [API](https://skmtc.net/atlar/apis/atlar-api-v2.md) · [All operations](https://skmtc.net/atlar/apis/atlar-api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/atlar/atlar-api-v2/revisions/9c5e194ccf5d/schema)