---
title: "Get a list of Audit Logs events"
method: GET
path: "/api/v2/audit/events"
tags: ["Audit"]
---

# Get a list of Audit Logs events

`GET /api/v2/audit/events`

List endpoint returns events that match a Audit Logs search query.
[Results are paginated][1].

Use this endpoint to see your latest Audit Logs events.

[1]: https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination

## Query parameters

- `filter[query]` string
- `filter[from]` string, date-time
- `filter[to]` string, date-time
- `sort` 'timestamp' | '-timestamp' — Sort parameters when querying events.
- `page[cursor]` string
- `page[limit]` integer

## Response `200`

OK

- AuditLogsEventsResponse — Response object with all events matching the request and pagination information.
  - `data` AuditLogsEvent[] — Array of events matching the request.
    - `attributes` AuditLogsEventAttributes — JSON object containing all event attributes and their associated values.
      - `attributes` object — JSON object of attributes from Audit Logs events.
      - `message` string — Message of the event.
      - `service` string — Name of the application or service generating Audit Logs events. This name is used to correlate Audit Logs to APM, so make sure you specify the same value when you use both products.
      - `tags` string[] — Array of tags associated with your event.
      - `timestamp` string, date-time — Timestamp of your event.
    - `id` string — Unique ID of the event.
    - `type` 'audit' — Type of the event.
  - `links` AuditLogsResponseLinks — Links attributes.
    - `next` string — Link for the next set of results. Note that the request can also be made using the POST endpoint.
  - `meta` AuditLogsResponseMetadata — The metadata associated with a request.
    - `elapsed` integer — Time elapsed in milliseconds.
    - `page` AuditLogsResponsePage — Paging attributes.
      - `after` string — The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of `page[cursor]`.
    - `request_id` string — The identifier of the request.
    - `status` 'done' | 'timeout' — The status of the response.
    - `warnings` AuditLogsWarning[] — A list of warnings (non-fatal errors) encountered. Partial results may return if warnings are present in the response.
      - `code` string — Unique code for this type of warning.
      - `detail` string — Detailed explanation of this specific warning.
      - `title` string — Short human-readable summary of the warning.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)