---
title: "List activity logs of a secret incident"
method: GET
path: "/v1/incidents/secrets/{incident_id}/activity-logs"
tags: ["Internal Secret Incident Activity Logs"]
---

# List activity logs of a secret incident

`GET /v1/incidents/secrets/{incident_id}/activity-logs`

List every activity log entry of a secret incident in chronological order.
Entries include both user-written notes and system-generated actions.

To list only user notes, use the `/notes` endpoint instead.

## Path parameters

- `incident_id` integer, required

## Query parameters

- `cursor` string
- `per_page` integer
- `ordering` 'created_at' | '-created_at' | 'updated_at' | '-updated_at'
- `member_id` integer
- `api_token_id` string, uuid
- `content_key` string
- `search` string — Search entries based on the note comment content.

## Response `200`

Incident Activity Log List

- object[]
  - `id` integer
  - `incident_id` integer — Id of the related Incident
  - `member` object, nullable — Member at the origin of the entry. Null for system actions or when the user is no longer a member of the workspace.
    - `id` integer
    - `name` string
    - `email` string
    - `access_level` string
  - `api_token_id` string, uuid, nullable — ID of the API key at the origin of this entry. Can be null if the entry was not produced via the API.
  - `created_at` string, date-time — Creation date of the entry
  - `updated_at` string, date-time, nullable — Last time the entry was updated. Null if it was never modified.
  - `content` union
    - object — Content of an entry that is a user-written note.
      - `type` 'note' — Discriminator identifying the entry as a user note.
      - `comment` string — Content of the user note.
    - object — Content of an entry that is a system-generated action.
      - `type` 'action' — Discriminator identifying the entry as a system action.
      - `content_key` string — Machine-readable key identifying the system action.
      - `data` object, nullable — Contextual data describing the action; its shape depends on `content_key`.

## Other responses

- `400` — Invalid data
- `401` — Invalid API key
- `404` — Secret Incident not found
- `503` — API under maintenance

---

[API](https://skmtc.net/gitguardian/apis/gitguardian-api.md) · [All operations](https://skmtc.net/gitguardian/apis/gitguardian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gitguardian/gitguardian-api/revisions/511b067cdcb1/schema)