---
title: "Search Audit Logs events"
method: POST
path: "/api/v2/audit/events/search"
tags: ["Audit"]
---

# Search Audit Logs events

`POST /api/v2/audit/events/search`

List endpoint returns Audit Logs events that match an Audit search query.
[Results are paginated][1].

Use this endpoint to build complex Audit Logs events filtering and search.

[1]: https://docs.datadoghq.com/logs/guide/collect-multiple-logs-with-pagination

## Request body

- AuditLogsSearchEventsRequest — The request for a Audit Logs events list.
  - `filter` AuditLogsQueryFilter — Search and filter query settings.
    - `from` string — Minimum time for the requested events. Supports date, math, and regular timestamps (in milliseconds).
    - `query` string — Search query following the Audit Logs search syntax.
    - `to` string — Maximum time for the requested events. Supports date, math, and regular timestamps (in milliseconds).
  - `options` AuditLogsQueryOptions — Global query options that are used during the query. Note: Specify either timezone or time offset, not both. Otherwise, the query fails.
    - `time_offset` integer — Time offset (in seconds) to apply to the query.
    - `timezone` string — The timezone can be specified as GMT, UTC, an offset from UTC (like UTC+1), or as a Timezone Database identifier (like America/New_York).
  - `page` AuditLogsQueryPageOptions — Paging attributes for listing events.
    - `cursor` string — List following results with a cursor provided in the previous query.
    - `limit` integer — Maximum number of events in the response.
  - `sort` 'timestamp' | '-timestamp' — Sort parameters when querying events.

## Response `200`

OK

- AuditLogsEventsResponse — Response object with all events matching the request and pagination information.
  - `data` AuditLogsEvent[] — Array of events matching the request.
    - `attributes` AuditLogsEventAttributes — JSON object containing all event attributes and their associated values.
      - `attributes` object — JSON object of attributes from Audit Logs events.
      - `message` string — Message of the event.
      - `service` string — Name of the application or service generating Audit Logs events. This name is used to correlate Audit Logs to APM, so make sure you specify the same value when you use both products.
      - `tags` string[] — Array of tags associated with your event.
      - `timestamp` string, date-time — Timestamp of your event.
    - `id` string — Unique ID of the event.
    - `type` 'audit' — Type of the event.
  - `links` AuditLogsResponseLinks — Links attributes.
    - `next` string — Link for the next set of results. Note that the request can also be made using the POST endpoint.
  - `meta` AuditLogsResponseMetadata — The metadata associated with a request.
    - `elapsed` integer — Time elapsed in milliseconds.
    - `page` AuditLogsResponsePage — Paging attributes.
      - `after` string — The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of `page[cursor]`.
    - `request_id` string — The identifier of the request.
    - `status` 'done' | 'timeout' — The status of the response.
    - `warnings` AuditLogsWarning[] — A list of warnings (non-fatal errors) encountered. Partial results may return if warnings are present in the response.
      - `code` string — Unique code for this type of warning.
      - `detail` string — Detailed explanation of this specific warning.
      - `title` string — Short human-readable summary of the warning.

## Other responses

- `400` — Bad Request
- `403` — Not Authorized
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)