---
title: "List audit log events"
method: GET
path: "/v3/accounts/organizations/{organization_id}/audit-log-events"
tags: ["Account Management"]
---

# List audit log events

`GET /v3/accounts/organizations/{organization_id}/audit-log-events`

Retrieve audit log events for an organization. Use query parameters to filter events by time range, user, and event type.<br><br>This endpoint does not cost any credits to execute.

## Path parameters

- `organization_id` string, uuid, required — The ID of a Censys organization. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.

## Query parameters

- `page_size` integer — Amount of events to return per page.
- `page_token` string — Page token for the requested page of audit log events.
- `start_time` string, date-time — Only return events that occurred after this time. This value must be on or after 2026-01-01T00:00:00Z. If not provided, will default to the earliest possible date.
- `end_time` string, date-time — Only return events that occurred before this time. This value must not be in the future. If not provided, it defaults to the current time.
- `event_type` 'user_created' | 'user_login' | 'user_login_failed' | 'user_password_changed' | 'user_password_reset' | 'user_mfa_changed' | 'user_settings_changed' | 'user_enabled' | 'user_disabled' | 'invitation_created' | 'invitation_resent' | 'invitation_accepted' | 'invitation_deleted' | 'membership_created' | 'membership_updated' | 'membership_removed' | 'org_created' | 'org_updated' | 'org_deleted' | 'saml_config_created' | 'saml_config_updated' | 'saml_config_deleted' | 'saml_config_domain_verified' | 'pat_created' | 'pat_deleted' | 'global_data_search_executed' | 'global_data_lookup_executed' | 'global_data_aggregation_executed' | 'asm_seed_created' | 'asm_seed_deleted' | 'asm_exclude_created' | 'asm_exclude_deleted' | 'asm_risk_instance_severity_changed' | 'asm_risk_instance_accepted' | 'asm_risk_instance_unaccepted' | 'asm_risk_type_severity_changed' | 'asm_risk_type_enabled' | 'asm_risk_type_disabled' | 'asm_risk_type_default_enabled' | 'tag_created' | 'tag_updated' | 'tag_deleted' | 'tag_assigned' | 'tag_unassigned' | 'tag_bulk_operation_started' | 'tag_bulk_operation_completed' | 'tag_bulk_operation_cancelled' | 'comment_created' | 'comment_updated' | 'comment_deleted' | 'scim_token_generated' | 'scim_token_revoked' | 'scim_user_provisioned' | 'scim_user_updated' | 'scim_user_deprovisioned' — Only return events of this type. This field is deprecated and will be removed in a future version. Use event_types instead.
- `event_types` string[], nullable — Only return events of these types.
- `exclude_event_types` string[], nullable — Exclude events of these types.
- `user_email` string — Only return events performed by this user.
- `order_by` 'timestamp_desc' | 'timestamp_asc' — Order events by this field.

## Response `200`

OK

- ResponseEnvelopeAuditLogEventsResponse
  - `result` AuditLogEventsResponse
    - `events` AuditLogEvent[], nullable, required — The page of audit log events for the requested filters and pagination parameters.
      - `actor` ActorInfo, required
        - `email` string — The email of the entity that performed the action.
        - `id` string — The ID of the entity that performed the action. This will depend on the type of entity, as it could either be a Censys user ID or an ASM workspace ID.
        - `type` 'unknown' | 'user' | 'system' | 'customer_support' | 'asm_workspace', required — The type of entity that performed the action.
      - `authentication_method` string — The method used by the actor to authenticate before performing the action.
      - `event_type` 'user_created' | 'user_login' | 'user_login_failed' | 'user_password_changed' | 'user_password_reset' | 'user_mfa_changed' | 'user_settings_changed' | 'user_enabled' | 'user_disabled' | 'invitation_created' | 'invitation_resent' | 'invitation_accepted' | 'invitation_deleted' | 'membership_created' | 'membership_updated' | 'membership_removed' | 'org_created' | 'org_updated' | 'org_deleted' | 'saml_config_created' | 'saml_config_updated' | 'saml_config_deleted' | 'saml_config_domain_verified' | 'pat_created' | 'pat_deleted' | 'global_data_search_executed' | 'global_data_lookup_executed' | 'global_data_aggregation_executed' | 'asm_seed_created' | 'asm_seed_deleted' | 'asm_exclude_created' | 'asm_exclude_deleted' | 'asm_risk_instance_severity_changed' | 'asm_risk_instance_accepted' | 'asm_risk_instance_unaccepted' | 'asm_risk_type_severity_changed' | 'asm_risk_type_enabled' | 'asm_risk_type_disabled' | 'asm_risk_type_default_enabled' | 'tag_created' | 'tag_updated' | 'tag_deleted' | 'tag_assigned' | 'tag_unassigned' | 'tag_bulk_operation_started' | 'tag_bulk_operation_completed' | 'tag_bulk_operation_cancelled' | 'comment_created' | 'comment_updated' | 'comment_deleted' | 'scim_token_generated' | 'scim_token_revoked' | 'scim_user_provisioned' | 'scim_user_updated' | 'scim_user_deprovisioned', required — The type of action that was audited.
      - `metadata` object — Event-specific metadata. Contents vary by event type.
      - `source` string — Where the audited action originated from.
      - `source_ip` string — The IP address of the source of the audited action.
      - `subject` SubjectInfo, required
        - `display_name` string — A human-readable name for the subject resource, if available. The value and format depend on the subject type and may be omitted if not applicable.
        - `id` string — The unique identifier of the subject resource. The identifier format depends on the subject type (for example, a Censys user ID or ASM workspace ID). Not all events will have a subject ID.
        - `type` 'organization' | 'user' | 'saml_config' | 'pat' | 'collection' | 'organization_membership' | 'organization_invitation' | 'asm_workspace' | 'asm_seed' | 'asm_exclude' | 'asm_risk_type' | 'asm_risk_instance' | 'global_data' | 'tag' | 'comment', required — The type of resource that was affected by the audited action.
      - `timestamp` string, date-time, required — The timestamp of the audit log event.
      - `user_agent` string — The user agent of the source of the audited action.
    - `pagination` PaginationInfo, required
      - `next_page_token` string — The token to use to retrieve the next page of results.
      - `page_size` integer, required — The number of results requested per page.
    - `total_results` integer, required

## Other responses

- `400` — Bad request
- `401` — Request does not contain a valid Authorization token
- `403` — User does not have permission to access this data
- `404` — User not found
- `422` — Invalid request parameters
- `500` — Internal server error

---

[API](https://skmtc.net/censys/apis/censys-platform-api.md) · [All operations](https://skmtc.net/censys/apis/censys-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/censys/censys-platform-api/revisions/261c916bf05b/schema)