---
title: "List audit log entries"
method: GET
path: "/audit"
tags: ["audit"]
---

# List audit log entries

`GET /audit`

Returns audit log entries matching the filter criteria. Manager or admin only.

## Query parameters

- `remoteNode` string
- `category` string
- `action` string
- `source` string
- `surface` string
- `result` string
- `correlationId` string
- `resourceType` string
- `resourceId` string
- `workspace` string
- `credentialId` string
- `credentialType` string
- `mcpTool` string
- `ipAddress` string
- `userId` string
- `startTime` string, date-time
- `endTime` string, date-time
- `limit` integer
- `offset` integer

## Response `200`

List of audit log entries

- AuditLogsResponse — Response containing audit log entries
  - `entries` AuditEntry[], required — List of audit log entries
    - `id` string, required — Unique identifier for this entry
    - `timestamp` string, date-time, required — When the event occurred
    - `category` string, required — Category of the audit event (e.g., terminal, user, dag)
    - `action` string, required — The action that was performed (e.g., session_start, command, login)
    - `source` string — Source surface that produced the event
    - `surface` string — Externally accepted credential surface
    - `result` string — Event result such as succeeded, failed, or denied
    - `correlationId` string — Correlation ID linking related audit events
    - `resourceType` string — Affected resource type
    - `resourceId` string — Affected resource ID
    - `workspace` string — Canonical workspace for filtering
    - `credentialId` string — Credential ID used for the request
    - `credentialType` string — Credential type used for the request
    - `mcpTool` string — MCP tool name when source is MCP
    - `userId` string, required — ID of the user who performed the action
    - `username` string, required — Username of the user who performed the action
    - `details` string — JSON-encoded action-specific details
    - `ipAddress` string — Client IP address if available
  - `total` integer, required — Total number of entries matching the filter (before pagination)

## Other responses

- `401` — Not authenticated
- `403` — Forbidden - requires manager or admin role
- `default` — Unexpected error

---

[API](https://skmtc.net/dagucloud/apis/dagu.md) · [All operations](https://skmtc.net/dagucloud/apis/dagu/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/dagucloud/dagu/revisions/93cc41f2018a/schema)