---
title: "Get a list of audit logs"
method: GET
path: "/v1/audit-logs/search"
tags: ["audit-logs"]
---

# Get a list of audit logs

`GET /v1/audit-logs/search`

Get a list of all audit logs in the specified workspace. This call supports pagination; default page size includes 20 logs.

## Query parameters

- `ticketIds` string[]
- `remediation` boolean — Filter by whether the log was part of a remediation action.
- `fromTime` number — Start date/time (inclusive) in milliseconds.
- `toTime` number — End date/time (inclusive) in milliseconds.
- `types` string[]
- `subTypes` string[]
- `autoGenerated` boolean — Filter by whether the log was auto generated.
- `pageSize` string — API responses use pagination to reduce loading time. Return a maximum of this many items per page. Used only for the very first request subsequent request should use cursor value
- `cursor` string — A base64-encoded pagination cursor used to retrieve a specific page of results. This value should be taken from the nextPage or prevPage field in a previous response. If omitted, the API returns the first page of results. Use this parameter to navigate forward or backward through paginated data.

## Headers

- `Workspace` string, required

## Response `200`

Success

- AuditLogPageResponse
  - `items` AuditLogResponse[] — unresolved $ref
  - `totalElements` integer — The total number of records that exist for the request.
  - `nextPage` string — A base64-encoded cursor value to retrieve the next page of results. To get the next page, pass this value in the cursor query parameter of your next request (e.g., ?cursor=nextPage).
  - `prevPage` string — A base64-encoded cursor value to retrieve the previous page of results. To get the previous page, pass this value in the cursor query parameter of your request (e.g., ?cursor=prevPage).

## Other responses

- `400` — Bad request, validation error
- `401` — Unauthorized request
- `403` — Access forbidden
- `429` — Too Many Requests
- `500` — Internal server error

---

[API](https://skmtc.net/coro/apis/coro-cybersecurity-public-api.md) · [All operations](https://skmtc.net/coro/apis/coro-cybersecurity-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/coro/coro-cybersecurity-public-api/revisions/b635522b2393/schema)