---
title: "Query activities"
method: POST
path: "/audit-log/activities"
tags: ["Activities"]
---

# Query activities

`POST /audit-log/activities`

Query activity logs with filtering, pagination, sorting, and free-text search.

## Free-Text Search
The `search` parameter performs a multi-field search across:
- `actor.email` - Email address of the actor
- `action` - Action performed
- `target.type` - Type of target resource
- `target.id` - ID of target resource
- `scope` - Scope/domain of the activity

Search uses n-gram tokenization (3-4 characters) for partial matching.

## Facets
The response includes faceted aggregations for:
- `actor_emails` - Top 100 actor emails with counts
- `scopes` - Top 100 scopes with counts
- `statuses` - Status values with counts

## Request body

- QueryActivitiesRequest — Request body for querying activities
  - `search` string — Free-text search query. Searches across actor.email, action, target.type, target.id, and scope fields using n-gram matching.
  - `actor_types` string[] — Filter by actor type
  - `actor_ids` string[] — Filter by actor IDs
  - `actor_emails` string[] — Filter by actor email addresses
  - `actions` string[] — Filter by action names
  - `target_types` string[] — Filter by target types
  - `target_ids` string[] — Filter by target IDs
  - `scopes` string[] — Filter by scope/domain
  - `methods` string[] — Filter by HTTP method
  - `statuses` string[] — Filter by status (outcome of the action)
  - `start_time` string, date-time — Filter activities after this time (inclusive, RFC3339 format)
  - `end_time` string, date-time — Filter activities before this time (inclusive, RFC3339 format)
  - `limit` integer — Maximum number of activities to return
  - `offset` integer — Number of activities to skip for pagination
  - `sort_by` string — Field to sort results by
  - `sort_order` 'asc' | 'desc' — Sort order

## Response `200`

Successful query

- QueryActivitiesResponse
  - `activities` Activity[], required — List of activities matching the query
    - `id` string, required — Unique activity identifier
    - `event_time` string, date-time, required — When the activity occurred (RFC3339 format)
    - `source` string, required — Source of the activity event
    - `account_id` string, required — Account the activity belongs to
    - `actor` Actor, required
      - `type` 'user' | 'api', required — Type of actor
      - `id` string, required — Actor identifier
      - `email` string, email — Actor email address (optional)
    - `action` string, required — Action that was performed
    - `target` Target, required
      - `type` string, required — Type of target resource
      - `id` string, required — Target resource identifier
    - `scope` string, required — Scope or domain of the activity
    - `method` string, required — HTTP method used for the request
    - `status` 'success' | 'failure', required — Outcome of the action
    - `request` Request — Request context (optional, included when available)
      - `body` string — Request body as JSON string (max 4KB)
      - `source_ip` string — Source IP address of the request
      - `user_agent` string — User agent string
    - `response` Response — Response context (optional, included when available)
      - `status_code` integer — HTTP status code of the response
      - `body` string — Response body as JSON string (max 4KB)
  - `total` integer, required — Total number of activities matching the query
  - `has_more` boolean, required — Indicates if there are more results beyond the current page
  - `facets` Facets — Aggregated filter data for building UI filters
    - `actor_emails` FacetBucket[] — Top actor emails with counts
      - `key` string, required — Facet value
      - `count` integer, required — Number of activities with this value
    - `scopes` FacetBucket[] — Top scopes with counts
      - `key` string, required — Facet value
      - `count` integer, required — Number of activities with this value
    - `statuses` FacetBucket[] — Status values with counts
      - `key` string, required — Facet value
      - `count` integer, required — Number of activities with this value

## Other responses

- `400` — Invalid request parameters
- `500` — Internal server error

---

[API](https://skmtc.net/firefly/apis/audit-log-api.md) · [All operations](https://skmtc.net/firefly/apis/audit-log-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/firefly/audit-log-api/revisions/3076153cf1b7/schema)