Sign in

v1

latestOpenAPI 3.0.12026-07-22231676.5 KB
Query

Query Audit Logs

Paginates forward in time from a given audit log ID. It takes a log ID parameter to begin fetching from and a take parameter for the number of log entries to fetch.

For a complete list of all audit log types and their descriptions, see the Audit Logs Guide.

get/api/v1/logs/audit

Query parameters

fromstring uuid required

Audit log ID to begin fetching from.

takeinteger required

Number of audit log entries to fetch, max 1000

log_typestring

Optional filter to return only logs of a specific type. For Microsoft add-in activity, use add-in-specific log types such as user:word_add_in_docx_drafting or user:outlook_add_in_ask. See the Audit Logs Guide for a complete list of log types.

Example:auth:login

Response

List of audit log entries

idstring uuid required

Unique identifier for the log entry.

ipstring required

IP address of the actor.

timestampstring date-time required

Date when the event occurred in ISO format.

typestring required

Type of audit log event. Microsoft add-in activity is returned through the same Audit Log API, with event types such as user:word_add_in_docx_drafting and user:outlook_add_in_ask. We may add more types at any time, so in developing and maintaining your code, you should not assume that only these types exist. For a complete list of all audit log types and their descriptions, see the Audit Logs Guide.

userstring required

Email of the user who triggered the event.

user_agentstring required

User agent of the actor who triggered the event.

Example response

[
  {
    "id": "0194f5c5-2021-75ae-b202-f049fca9dce2",
    "ip": "0.0.0.0",
    "timestamp": "2025-02-11T16:08:44.324452",
    "type": "admin:fetch_workspace_history",
    "user": "user@example.com",
    "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36"
  }
]