---
title: "Fetch audit logs"
method: POST
path: "/omni/executive-events/find"
tags: ["Organization"]
---

# Fetch audit logs

`POST /omni/executive-events/find`

Use this API to retrieve records of activities performed within your organization. These logs include key events such as changes to organization settings, executive actions, updates to flows, workflows and user identities, as well as changes made to organization’s watchlist.
Note: Requires admin login token.

## Query parameters

- `avoidCounting` boolean
- `pageable` Pageable, required
  - `page` integer
  - `size` integer
  - `sort` string[]

## Headers

- `api-version` string, required

## Request body

- ExecutiveEventFilter — Provides filter for audit logs.
  - `codes` string[]
  - `before` string, date-time
  - `after` string, date-time
  - `executiveIds` string[]
  - `entityTypes` string[]
  - `entityIds` string[]
  - `applications` string[]
  - `email` string
  - `ipAddress` string
  - `userAgent` string

## Response `200`

OK

- ExecutiveEventResponse
  - `content` ExecutiveEventDto[]
    - `id` string
    - `code` 'SESSION_DELETED' | 'IDENTITY_DELETED' | 'SESSION_FACE_ADDED' | 'IDENTITY_FACE_ADDED' | 'SESSION_MANUALLY_APPROVED' | 'SESSION_MANUALLY_REJECTED' | 'SESSION_VIEWED' | 'SESSIONS_VIEWED' | 'SESSION_PDF_DOWNLOADED' | 'LOGIN_ATTEMPT' | 'LOGOUT' | 'USER_CREATED' | 'USER_DELETED' | 'USER_UPDATED' | 'CONFIGURATION_CREATE' | 'CONFIGURATION_CLONED' | 'CONFIGURATION_RESET' | 'CONFIGURATION_UPDATE' | 'FLOW_CREATE' | 'FLOW_UPDATE' | 'FLOW_DELETE' | 'FLOW_CLONE' | 'IDENTITIES_REPORT_GENERATED' | 'SESSIONS_REPORT_GENERATED' | 'AUTHENTICATIONS_REPORT_GENERATED' | 'WATCH_LISTS_REPORT_GENERATED' | 'USERS_REPORT_GENERATED' | 'DOUBLE_CHECK_RECORD_FETCHED' | 'DOUBLE_CHECK_RECORD_UPDATED' | 'DOUBLE_CHECK_FINISHED' | 'SESSION_ANTIFRAUD_RESOLVED' | 'WATCH_LISTS_ENTRY_CREATED' | 'GOVERNMENT_VERIFICATION_PROVIDERS_UPDATED' | 'GOVERNMENT_VERIFICATION_PROVIDERS_CREATED' | 'GOVERNMENT_VERIFICATION_PROVIDERS_DELETED' | 'WATCHLIST_PROVIDER_SETTINGS_CREATED' | 'WATCHLIST_PROVIDER_SETTINGS_UPDATED' | 'WATCHLIST_PROVIDER_SETTINGS_DELETED' | 'PERSONAL_IDENTIFICATION_NUMBER_PROVIDERS_UPDATED' | 'PERSONAL_IDENTIFICATION_NUMBER_PROVIDERS_DELETED' | 'PERSONAL_IDENTIFICATION_NUMBER_PROVIDERS_CREATED' | 'EKYB_PROVIDERS_UPDATED' | 'EKYB_PROVIDERS_CREATED' | 'EKYB_PROVIDERS_DELETED' | 'EKYC_PROVIDERS_CREATED' | 'EKYC_PROVIDERS_UPDATED' | 'EKYC_PROVIDERS_DELETED' | 'QES_PROVIDERS_UPDATED' | 'QES_PROVIDERS_DELETED' | 'QES_PROVIDERS_CREATED' | 'GENERAL_PROVISIONING_SETTINGS_UPDATED' | 'MODULES_PROVISIONING_SETTINGS_UPDATED' | 'WORKFLOW_CREATED' | 'WORKFLOW_IMPORTED' | 'WORKFLOW_EDITED' | 'WORKFLOW_UPDATED' | 'WORKFLOW_DELETED' | 'WORKFLOW_ACTIVATED' | 'WORKFLOW_PAUSED' | 'CONSENT_CREATED' | 'CONSENT_UPDATED' | 'CONSENT_DELETED' | 'FRAUD_REPORTED' | 'FRAUD_REPORT_REVOKED' | 'WEBHOOK_CREATED' | 'WEBHOOK_UPDATE' | 'WEBHOOK_DELETE' | 'WEBHOOK_AUTH_CONFIG_CREATE' | 'WEBHOOK_AUTH_CONFIG_UPDATE' | 'DATA_DELETION_UPDATE' | 'WATCHLIST_ENTRY_DELETED' | 'WATCHLIST_ENTRY_UPDATED' | 'WATCHLIST_LIST_VIEWED' | 'AUTHENTICATION_LIST_VIEWED' | 'IDENTITY_VIEWED' | 'SESSION_LIST_VIEWED' | 'IDENTITY_LIST_VIEWED' | 'AUDIT_LOG_REPORT_GENERATED' | 'SINGLE_SESSION_REPORT_GENERATED' | 'DATA_DELETION_DISABLE' | 'FACE_ADDED_TO_DATABASE' | 'SELFIE_ADDED_TO_IDENTITY_TEMPLATE' | 'FRAUD_RING_RENAMED' | 'FRAUD_RING_NOTE_ADDED'
    - `timestamp` string, date-time
    - `executiveId` string
    - `managedEntityType` 'SESSION' | 'IDENTITY' | 'EXECUTIVE' | 'FLOW' | 'CONFIGURATION' | 'WORKFLOW' | 'WATCHLIST' | 'PROVISIONING' | 'CONSENT' | 'DATA' | 'WEBHOOK' | 'AUDIT_LOG' | 'AUTHENTICATION' | 'USER' | 'FRAUD_RING'
    - `managedEntityId` string
    - `payload` object
    - `apiKey` string
    - `role` 'OPEN' | 'STATISTICS' | 'LIMITED' | 'INCODE_IDENTITY' | 'INCODE_ID_USER' | 'ACCESS' | 'AUTHENTICATOR' | 'REFRESH' | 'REGISTER' | 'INCODE_ID_CLIENT' | 'EXECUTIVE' | 'ADMIN' | 'SCIM_ADMIN' | 'MULTI_ORG_ADMIN' | 'INTEGRATOR' | 'INCODE_EXECUTIVE' | 'INCODE_ADMIN' | 'WIDGET_CLIENT' | 'INTERNAL_SERVICE' | 'AUTHORIZATION_SERVER' | 'KEYCLOAK_SESSION' | 'HIPAA_ADMIN' | 'HIPAA_VIEWER' | 'WORKFORCE_ADMIN' | 'WORKFORCE_HELPDESK_STAFF' | 'WORKFORCE_RECRUITER' | 'SERVER' | 'IDENTITY_SERVICE' | 'TRUST_GRAPH_DATA_LOADER'
    - `application` 'USER_SERVICE'
    - `ipAddress` string
    - `userAgent` string
    - `email` string
  - `page` Page
    - `size` integer
    - `totalElements` integer
    - `totalPages` integer
    - `currentPageNumber` integer
  - `total` integer
  - `more` boolean

## Other responses

- `400` — Bad Request

---

[API](https://skmtc.net/incode/apis/incode-omni-api.md) · [All operations](https://skmtc.net/incode/apis/incode-omni-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/incode/incode-omni-api/revisions/30cd6d926ea3/schema)