---
title: "Get audit records"
method: GET
path: "/wiki/rest/api/audit"
tags: ["Audit"]
---

# Get audit records

`GET /wiki/rest/api/audit`

Returns all records in the audit log, optionally for a certain date range.
This contains information about events like space exports, group membership
changes, app installations, etc. For more information, see
[Audit log](https://confluence.atlassian.com/confcloud/audit-log-802164269.html)
in the Confluence administrator's guide.

**[Permissions](https://confluence.atlassian.com/x/_AozKw) required**:
'Confluence Administrator' global permission.

## Query parameters

- `startDate` string
- `endDate` string
- `searchString` string
- `start` integer
- `limit` integer

## Response `200`

Returned if the requested records are returned.

- AuditRecordArray
  - `results` AuditRecord[], required
    - `author` object, required
      - `type` 'user', required
      - `displayName` string, required
      - `operations` OperationCheckResult[], nullable
        - `operation` 'administer' | 'archive' | 'clear_permissions' | 'copy' | 'create' | 'create_space' | 'delete' | 'export' | 'move' | 'purge' | 'purge_version' | 'read' | 'restore' | 'restrict_content' | 'update' | 'use', required — The operation itself.
        - `targetType` string, required — The space or content type that the operation applies to. Could be one of- - application - page - blogpost - comment - attachment - space
      - `username` string, nullable — This property is no longer available and will be removed from the documentation soon. Use `accountId` instead. See the [deprecation notice](/cloud/confluence/deprecation-notice-user-privacy-api-migration-guide/) for details.
      - `userKey` string, nullable — This property is no longer available and will be removed from the documentation soon. Use `accountId` instead. See the [deprecation notice](/cloud/confluence/deprecation-notice-user-privacy-api-migration-guide/) for details.
      - `accountId` string, nullable — The account ID of the user, which uniquely identifies the user across all Atlassian products. For example, `384093:32b4d9w0-f6a5-3535-11a3-9c8c88d10192`.
      - `accountType` string
      - `externalCollaborator` boolean — This is deprecated. Use `isGuest` instead.
      - `isExternalCollaborator` boolean — This is deprecated. Use `isGuest` instead. Whether the user is an external collaborator user
      - `isGuest` boolean — Whether the user is a guest user
      - `publicName` string — The public name or nickname of the user. Will always contain a value.
    - `remoteAddress` string, required
    - `creationDate` integer, required — The creation date-time of the audit record, as a timestamp.
    - `summary` string, required
    - `description` string, required
    - `category` string, required
    - `sysAdmin` boolean, required
    - `superAdmin` boolean
    - `affectedObject` AffectedObject, required
      - `name` string, required
      - `objectType` string, required
    - `changedValues` ChangedValue[], required
      - `name` string, required
      - `oldValue` string, required
      - `hiddenOldValue` string
      - `newValue` string, required
      - `hiddenNewValue` string
    - `associatedObjects` AffectedObject[], required
      - `name` string, required
      - `objectType` string, required
  - `start` integer, required
  - `limit` integer, required
  - `size` integer, required
  - `_links` GenericLinks, required

## Other responses

- `401` — Returned if the authentication credentials are incorrect or missing from the request.
- `403` — Returned if the calling user does not have permission to view the audit log.

---

[API](https://skmtc.net/atlassian/apis/the-confluence-cloud-rest-api.md) · [All operations](https://skmtc.net/atlassian/apis/the-confluence-cloud-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/atlassian/the-confluence-cloud-rest-api/revisions/70088490f406/schema)