---
title: "List audit logs"
method: GET
path: "/audit-logs"
tags: ["Audit Logs"]
---

# List audit logs

`GET /audit-logs`

API for searching audit logs. Limited to at most 30 day search, returns up to 100 records per page. Not recommended for bulk export.

## Query parameters

- `start` string, date-time, required
- `end` string, date-time, required
- `auth_strategy` string
- `service` string
- `method` string
- `exclude_method` string[]
- `search` string
- `search_user_id` string[]
- `limit` integer
- `page_token` string

## Response `200`

A list of audit log records.

- AuditLogEntry[]
  - `timestamp` string, date-time, required — UTC time when the request was received.
  - `auth_strategy` string, required — Authentication strategy used for the request.
  - `user_id` string, required — ID of the authenticated user, if any.
  - `email` string, required — Email of the authenticated user at request time, if any.
  - `status` integer, required — HTTP response status code.
  - `method` string, required — HTTP method.
  - `path` string, required — Request path.
  - `route` string, required — Matched API route pattern, if available.
  - `domain` string, required — Request host.
  - `duration_ms` integer, required — Request duration in milliseconds.
  - `client_ip` string, required — Client IP address.
  - `user_agent` string, required — User agent header.

## Other responses

- `400` — Bad Request – invalid input
- `401` — Unauthorized – missing or invalid authorization token
- `500` — Internal Server Error

---

[API](https://skmtc.net/kernel/apis/kernel-api.md) · [All operations](https://skmtc.net/kernel/apis/kernel-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kernel/kernel-api/revisions/9e8ce9fcf5e1/schema)