Sign in

v1

latestOpenAPI 3.1.02026-07-2481742657.4 KB
Account Management

List audit log events

Retrieve audit log events for an organization. Use query parameters to filter events by time range, user, and event type.<br><br>This endpoint does not cost any credits to execute.

get/v3/accounts/organizations/{organization_id}/audit-log-events

Path parameters

organization_idstring uuid required

The ID of a Censys organization. See the Getting Started docs for more information.

Example:11111111-2222-3333-4444-555555555555

The ID of a Censys organization. See the Getting Started docs for more information.

Query parameters

page_sizeinteger

Amount of events to return per page.

Example:1

Amount of events to return per page.

page_tokenstring

Page token for the requested page of audit log events.

Page token for the requested page of audit log events.

start_timestring date-time

Only return events that occurred after this time. This value must be on or after 2026-01-01T00:00:00Z. If not provided, will default to the earliest possible date.

Example:2026-01-01T00:00:00Z

Only return events that occurred after this time. This value must be on or after 2026-01-01T00:00:00Z. If not provided, will default to the earliest possible date.

end_timestring date-time

Only return events that occurred before this time. This value must not be in the future. If not provided, it defaults to the current time.

Example:2026-02-01T00:00:00Z

Only return events that occurred before this time. This value must not be in the future. If not provided, it defaults to the current time.

event_type'user_created' | 'user_login' | 'user_login_failed' | 'user_password_changed' | 'user_password_reset' | 'user_mfa_changed' | 'user_settings_changed' | 'user_enabled' | 'user_disabled' | 'invitation_created' | 'invitation_resent' | 'invitation_accepted' | 'invitation_deleted' | 'membership_created' | 'membership_updated' | 'membership_removed' | 'org_created' | 'org_updated' | 'org_deleted' | 'saml_config_created' | 'saml_config_updated' | 'saml_config_deleted' | 'saml_config_domain_verified' | 'pat_created' | 'pat_deleted' | 'global_data_search_executed' | 'global_data_lookup_executed' | 'global_data_aggregation_executed' | 'asm_seed_created' | 'asm_seed_deleted' | 'asm_exclude_created' | 'asm_exclude_deleted' | 'asm_risk_instance_severity_changed' | 'asm_risk_instance_accepted' | 'asm_risk_instance_unaccepted' | 'asm_risk_type_severity_changed' | 'asm_risk_type_enabled' | 'asm_risk_type_disabled' | 'asm_risk_type_default_enabled' | 'tag_created' | 'tag_updated' | 'tag_deleted' | 'tag_assigned' | 'tag_unassigned' | 'tag_bulk_operation_started' | 'tag_bulk_operation_completed' | 'tag_bulk_operation_cancelled' | 'comment_created' | 'comment_updated' | 'comment_deleted' | 'scim_token_generated' | 'scim_token_revoked' | 'scim_user_provisioned' | 'scim_user_updated' | 'scim_user_deprovisioned'

Only return events of this type. This field is deprecated and will be removed in a future version. Use event_types instead.

Only return events of this type. This field is deprecated and will be removed in a future version. Use event_types instead.

event_typesstring[] nullable

Only return events of these types.

Only return events of these types.

[
  "user_login",
  "pat_created"
]
exclude_event_typesstring[] nullable

Exclude events of these types.

Exclude events of these types.

[
  "user_login",
  "pat_created"
]
user_emailstring

Only return events performed by this user.

Example:user@example.com

Only return events performed by this user.

order_by'timestamp_desc' | 'timestamp_asc'

Order events by this field.

Order events by this field.

Response

OK