---
title: "Audit Logs"
method: GET
path: "/api/v2/AuditLogs"
tags: ["AuditLogs"]
---

# Audit Logs

`GET /api/v2/AuditLogs`

Get audit logs by invoking the following endpoint:

  > `GET https://YourAccount.lacework.net/api/v2/AuditLogs` 

  Optionally specify the `startTime` and `endTime` time range filters using the following formats:

  * `yyyy-MM-dd` for example, `2020-12-18` 

  * `yyyy-MM-ddTHH` for example, `2020-12-18T08` 

  * `yyyy-MM-ddTHH:mm:ssZ` for example, `2020-12-18T08:00:00Z` 

  * `yyyy-MM-ddTHH:mm:ss.SSSZ` for example, `2020-12-18T08:00:00.000Z` 

 To use the current time as the end time, exclude the endTime  parameter. 


  Here is an example invocation: 

  > `GET https://YourAccount.lacework.net/api/v2/AuditLogs?startTime=2020-12-11T08:00:00Z&endTime=2020-12-18T08:00:00Z`

## Query parameters

- `startTime` string
- `endTime` string

## Headers

- `Authorization` string, required
- `Content-Type` string, required
- `Org-Access` boolean
- `Account-Name` string

## Response `200`

No Error (List of Audit Logs)

- object
  - `data` AuditLogsResponseSchema[]
    - `createdTime` string — The creation timestamp of the log file.
    - `accountName` string — The account name associated with the logged action.
    - `userName` string — The username of the user associated with the logged action.
    - `eventName` string
    - `userAction` string — Summary of the action such as `Login with OAuth Succeeded` or `Alert Channel Created`.
    - `eventDescription` string — Summary of the event such as `User test-user@test-domain.net logged in to ALERTPLATFORM account using OAuth credentials`.

## Other responses

- `204` — No Data
- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)