---
title: "Get Workspace Audit Logs"
method: GET
path: "/v1/workspace/audit-logs"
tags: ["workspace"]
---

# Get Workspace Audit Logs

`GET /v1/workspace/audit-logs`

Returns the audit log for the workspace. Requires enterprise tier and the audit_log_read permission.

## Query parameters

- `limit` integer — Maximum number of entries per page
- `cursor` string, nullable — Cursor for the next page (from previous response)
- `time_from_unix_ms` integer, nullable — Only include entries at or after this time (ms since epoch)
- `time_to_unix_ms` integer, nullable — Only include entries at or before this time (ms since epoch)
- `actor_uid` string, nullable — Filter by actor user ID
- `class_name` string, nullable — Filter by OCSF event class name (e.g. Account Change)
- `activity_name` string, nullable — Filter by audit activity name (e.g. Subscription Creation)

## Headers

- `xi-api-key` string, nullable — Your API key. This is required by most endpoints to access our API programmatically. You can view your xi-api-key using the 'Profile' tab on the website.

## Response `200`

Successful Response

- WorkspaceAuditLogsPageResponse — Paginated workspace audit log response.
  - `entries` WorkspaceAuditLogEntryResponse[], required
    - `metadata` object — Event metadata
    - `time` integer — Event time in milliseconds since epoch
    - `activity_id` union, required — Activity ID
      - 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 99 — OCSF Activity IDs for Account Change [3001] events. Spec: https://schema.ocsf.io/1.6.0/classes/account_change
      - 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 99 — OCSF Activity IDs for Authentication [3002] events. Spec: https://schema.ocsf.io/1.6.0/classes/authentication
      - 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 99 — OCSF Activity IDs for Entity Management [3004] events. Spec: https://schema.ocsf.io/1.6.0/classes/entity_management
      - 0 | 1 | 2 | 99 — OCSF Activity IDs for User Access Management [3005] events. Spec: https://schema.ocsf.io/1.6.0/classes/user_access_management
      - 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 99 — OCSF Activity IDs for Group Management [3006] events. Spec: https://schema.ocsf.io/1.6.0/classes/group_management
    - `activity_name` string, required — Activity name
    - `category_name` string — Event category
    - `category_uid` integer — Category UID for IAM
    - `class_name` string — Event class name
    - `class_uid` integer — Event class UID
    - `severity_id` 0 | 1 | 2 | 3 | 4 | 5 | 6 | 99 — OCSF Severity levels. Spec: https://schema.ocsf.io/1.6.0/objects/severity_id
    - `status_id` 0 | 1 | 2 | 99, required — OCSF Status levels. Spec: https://schema.ocsf.io/1.6.0/objects/status_id
    - `actor` ActorModel, required — OCSF Actor object - describes the entity that performed the action. Spec: https://schema.ocsf.io/1.6.0/objects/actor
      - `user` UserModel, required — OCSF User object. Spec: https://schema.ocsf.io/1.6.0/objects/user
        - `name` string, nullable — Username
        - `uid` string, nullable — Unique user identifier
        - `type_id` 0 | 1 | 2 | 3 | 4 | 99 — OCSF User type IDs. Spec: https://schema.ocsf.io/1.6.0/objects/user
        - `type` string, nullable — Account type description
        - `email_addr` string, nullable — User email address
        - `full_name` string, nullable — Full name of the user
        - `domain` string, nullable — User's domain
      - `app_name` string, nullable — Client application or service name
      - `app_uid` string, nullable — Client application unique identifier
      - `session` object, nullable — Session information
    - `device` DeviceModel — Device information. Spec: https://schema.ocsf.io/1.6.0/objects/device
      - `ip` string, nullable — IP address
      - `hostname` string, nullable — Device hostname
      - `type_id` integer — Device type ID (99 = Unknown)
    - `http_request` HttpRequestModel — HTTP request details. Spec: https://schema.ocsf.io/1.6.0/objects/http_request
      - `http_method` string, required — HTTP method (GET, POST, etc.)
      - `url` UrlModel, required — OCSF URL object. Spec: https://schema.ocsf.io/1.6.0/objects/url
        - `url_string` string, nullable — Full URL string
        - `scheme` string, nullable — URL scheme (e.g., https)
        - `hostname` string, nullable — URL hostname
        - `port` integer, nullable — URL port
        - `path` string, nullable — URL path
        - `query_string` string, nullable — URL query string
      - `user_agent` string, nullable — User agent string
      - `x_forwarded_for` string[], nullable — X-Forwarded-For header as a list
    - `message` string, required — Human-readable event description
    - `unmapped` object — Attributes not mapped to OCSF
    - `id` string, required — Firestore document ID
    - `time_dt` string, required — Event time in human-readable RFC 3339 format, derived from 'time'.
    - `type_uid` integer, required — OCSF type_uid is class_uid * 100 + activity_id.
    - `type_name` string, required — OCSF type_name combines class_name and activity_name.
  - `has_more` boolean, required
  - `next_cursor` string, nullable, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/elevenlabs/apis/elevenlabs-api-documentation.md) · [All operations](https://skmtc.net/elevenlabs/apis/elevenlabs-api-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elevenlabs/elevenlabs-api-documentation/revisions/db6eec599cbe/schema)