---
title: "Query Audit Logs"
method: GET
path: "/api/audit-logs"
tags: ["Audit Logs"]
---

# Query Audit Logs

`GET /api/audit-logs`

Query audit events with cursor-based pagination. Returns events in ECS (Elastic Common Schema)
format by default, with optional Splunk CIM format support.

This endpoint is designed for SIEM integration with platforms like Azure Sentinel,
Splunk, Elastic SIEM, and other security monitoring tools.

**Authentication:** Requires a tenant-level audit API key (different from team API tokens).
Contact support to obtain your audit API key.

## Query parameters

- `startTime` string, date-time
- `endTime` string, date-time
- `cursor` string
- `limit` integer
- `eventType` 'auth.login' | 'auth.logout' | 'iam.user.created' | 'iam.user.deleted' | 'iam.user.invited' | 'iam.role.granted' | 'iam.role.revoked' | 'admin.api_key.created' | 'admin.api_key.deleted' | 'admin.settings.changed' | 'admin.integration.connected' | 'admin.integration.disconnected' | 'admin.team.created' | 'admin.team.deleted' | 'data.file.created' | 'data.file.archived' | 'data.file.deleted' | 'data.file.exported' | 'data.file.invite_sent' | 'data.file.visited' | 'data.file.settings.changed'
- `userId` string
- `format` 'ecs' | 'splunk'

## Response `200`

Audit events retrieved successfully

- object
  - `events` AuditEventECS[], required — Array of audit events in the requested format
    - `id` string, required — Unique identifier for the audit event
    - `@timestamp` string, date-time, required — ISO 8601 timestamp when the event occurred
    - `event` object, required
      - `id` string, required — Event identifier (same as top-level id)
      - `category` string[], required — ECS event category
      - `action` 'auth.login' | 'auth.logout' | 'iam.user.created' | 'iam.user.deleted' | 'iam.user.invited' | 'iam.role.granted' | 'iam.role.revoked' | 'admin.api_key.created' | 'admin.api_key.deleted' | 'admin.settings.changed' | 'admin.integration.connected' | 'admin.integration.disconnected' | 'admin.team.created' | 'admin.team.deleted' | 'data.file.created' | 'data.file.archived' | 'data.file.deleted' | 'data.file.exported' | 'data.file.invite_sent' | 'data.file.visited' | 'data.file.settings.changed', required — The specific action that occurred
      - `outcome` 'success' | 'failure', required — Whether the action succeeded or failed
    - `organization` object — Organization/tenant information (for multi-tenant deployments)
      - `id` string — Organization identifier
    - `user` object — The user who performed the action
      - `id` string — User identifier
    - `user.target` object — Target user for IAM events (e.g., user being invited or having role changed)
      - `id` string — Target user identifier
    - `url` object — URL information for the request
      - `path` string — URL path of the request
    - `eraser` object — Eraser-specific event context
      - `teamId` string — Team identifier
      - `workspaceId` string — Workspace/file identifier
      - `organizationId` string — Organization identifier
      - `metadata` object — Additional event-specific metadata
  - `nextCursor` string, nullable — Opaque cursor for fetching the next page. Pass this value as the `cursor` parameter in subsequent requests. Null when there are no more results.
  - `hasMore` boolean, required — Whether there are more events available beyond this page
  - `serverTime` string, date-time, required — Server timestamp when the response was generated (ISO 8601)

## Other responses

- `400` — Invalid request parameters
- `401` — Invalid or missing audit API key
- `500` — Internal server error
- `503` — Audit logging not configured for this deployment

---

[API](https://skmtc.net/eraser/apis/render.md) · [All operations](https://skmtc.net/eraser/apis/render/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/eraser/render/revisions/c31350b435dc/schema)