---
title: "List Audit Logs"
method: GET
path: "/v2/audit-logs"
---

# List Audit Logs

`GET /v2/audit-logs`

Query audit logs with filtering and cursor-based pagination.

System-admin-only endpoint for retrieving audit logs.
Use `cursor_id` from the previous response's `next_cursor_id` to get the next page.

## Query parameters

- `start` string, date-time, required
- `end` string, date-time, required
- `action` 'http_request' | 'login' | 'logout' | 'resource' | 'refresh_token' | 'failed_login' | 'account_lockout'
- `user_id` string, nullable
- `path_contains` string, nullable
- `cursor_id` integer, nullable
- `limit` integer

## Response `200`

Successful Response

- AuditLogListResponse — Response for audit log list endpoint.
  - `records` AuditLogRecord[], required
    - `id` integer, required
    - `created_at` string, date-time, required
    - `user_id` string, required
    - `ip_address` string
    - `action` 'http_request' | 'login' | 'logout' | 'resource' | 'refresh_token' | 'failed_login' | 'account_lockout', required
    - `raw_event` string, required
  - `next_cursor_id` integer, nullable

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/galileo/apis/galileo-api-server.md) · [All operations](https://skmtc.net/galileo/apis/galileo-api-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/galileo/galileo-api-server/revisions/ec2affc66693/schema)