v1

latestOpenAPI 3.1.02026-08-04147764567.0 KB

auditLogs

List audit logs with filters

List audit logs with structured filters for actor, module, and event type

Filtering

Use the filters field to narrow results. Pass an empty array or omit the field to retrieve all records.

Each filter object has the following fields:

Field	Type	Description
attribute	string	The field to filter on (see Supported attributes below)
operator	string	Comparison operator (see Available operators below)
values	array	One or more { "value": <scalar> } objects

Supported attributes

Attribute	Typical operator	Description
event_at	IS_BETWEEN	Event timestamp. Requires exactly two values: [start, end] (both inclusive). Accepts ISO 8601 (2024-01-01T00:00:00Z) or date-only (2024-01-01 — end date is automatically extended to T23:59:59Z). On export, defaults to the last 6 months if omitted.
actor_id	IS_ANY_OF	Numeric user ID of the person who performed the action (the id field from GET /api/v1/users).
module	IS_ANY_OF	Module integer ID (not the name). See the Module IDs reference table below.
event_type	IS_ANY_OF	Event type integer ID (not the name). See the Event Type IDs reference table below. Not every event type is valid for every module — unsupported combinations return zero results.

Available operators

Operator	Meaning
EQUALS	Exact match
NOT_EQUALS	Exclude exact match
IN / IS_ANY_OF	Match any value in the list
IS_NOT_ANY_OF	Exclude all listed values
IS_BETWEEN	Inclusive range — pass exactly two values: [start, end]
IS_ON_OR_BEFORE / IS_ON_OR_AFTER	Date/time boundary comparisons
CONTAINS / TEXT_CONTAINS	Substring or set membership
IS_NULL / IS_NOT_NULL	Null checks — values array can be empty
STARTS_WITH / ENDS_WITH	String prefix/suffix match

Module IDs (use with attribute: "module")

ID	Module	What it covers
0	APPS	Third-party app connections (connect / disconnect / update)
1	USERS	User creation and profile updates
2	WORKFLOWS	Automation workflow changes
3	SERVICE_CATALOG	Service catalog items
4	SECURITY	Login, logout, API key creation / deletion
5	SKILL	AI skill changes
6	WORKSPACES	Workspace settings changes
7	TENANT_MIGRATION	Sandbox import / export
8	AGENT_GROUPS	Agent group changes
9	ACCESS_MANAGEMENT	Role and access control changes
10	AI_AGENTS	AI agent changes
11	AGENT_AVAILABILITY	Agent availability updates
12	CUSTOM_OBJECTS	Custom object type changes

Event Type IDs (use with attribute: "event_type")

ID	Event Type
0	CONNECTED
1	DISCONNECTED
2	CREATED
3	UPDATED
4	ENABLED
5	DISABLED
6	DELETED
7	IMPORT
8	EXPORT
9	RESTORED
10	LOGIN
12	LOGOUT

Module → valid event types

Module	Valid event type IDs
APPS (0)	0 (CONNECTED), 1 (DISCONNECTED), 3 (UPDATED)
USERS (1)	2 (CREATED), 3 (UPDATED)
WORKFLOWS (2)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
SERVICE_CATALOG (3)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
SECURITY (4)	2 (CREATED), 6 (DELETED), 10 (LOGIN), 12 (LOGOUT)
SKILL (5)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
WORKSPACES (6)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
TENANT_MIGRATION (7)	7 (IMPORT), 8 (EXPORT)
AGENT_GROUPS (8)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
ACCESS_MANAGEMENT (9)	2 (CREATED), 3 (UPDATED), 6 (DELETED), 9 (RESTORED)
AI_AGENTS (10)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
AGENT_AVAILABILITY (11)	3 (UPDATED)
CUSTOM_OBJECTS (12)	2 (CREATED), 3 (UPDATED), 6 (DELETED)

Example

[
  {
    "attribute": "event_at",
    "operator": "IS_BETWEEN",
    "values": [
      {
        "value": "2024-01-01T00:00:00Z"
      },
      {
        "value": "2024-12-31T23:59:59Z"
      }
    ]
  },
  {
    "attribute": "module",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 1
      },
      {
        "value": 9
      }
    ]
  },
  {
    "attribute": "event_type",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 2
      },
      {
        "value": 3
      }
    ]
  },
  {
    "attribute": "actor_id",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 123
      }
    ]
  }
]

post/api/v1/audit-logs/list

Headers

X-Api-Keystring required

X-Workspace-Idstring

Request body

search_keystring

pageinteger

per_pageinteger

next_page_tokenstring

sort_order'EVENT_AT_DESC' | 'EVENT_AT_ASC'

Response

Successful response

AuditLogsPostapiV1AuditLogsListResponse200 required

Empty response body