---
title: "Search Audit Logs"
method: POST
path: "/api/v2/AuditLogs/search"
tags: ["AuditLogs"]
---

# Search Audit Logs

`POST /api/v2/AuditLogs/search`

Search the audit logs by invoking the following endpoint:

  > `POST https://YourAccount.lacework.net/api/v2/AuditLogs/search` 

  Optionally specify filters in the request body. For more information about using filters, see the [Simple & Advanced Search section](/api/v2/docs/#tag/OVERVIEW). 

  For the `timeFilter` filter, these are the supported time formats:

  * `yyyy-MM-dd` for example, `2020-12-18` 

  * `yyyy-MM-ddTHH` for example, `2020-12-18T08` 

  * `yyyy-MM-ddTHH:mm:ssZ` for example, `2020-12-18T08:00:00Z` 

  * `yyyy-MM-ddTHH:mm:ss.SSSZ`, for example, `2020-12-18T08:00:00.000Z` 

 To use the current time as the end time, exclude the endTime field.

## Headers

- `Authorization` string, required
- `Content-Type` string, required
- `Org-Access` boolean
- `Account-Name` string

## Request body

- GETDATAREQUESTBODYTIMEFILTERS
  - `timeFilter` object — The date/time range during which actions occurred.
    - `startTime` string — Returns only recorded actions that occurred after this timestamp.
    - `endTime` string — Returns only recorded actions that occurred before this timestamp. If empty or missing, the current time is used.
  - `filters` object[] — One or more condition statements you can use to refine the data returned by the request. Only records that satisfy filtering conditions are returned. If there are multiple conditions, a record must satisfy all conditions for a match.
    - `expression` 'eq' | 'ne' | 'in' | 'not_in' | 'like' | 'ilike' | 'not_like' | 'not_ilike' | 'not_rlike' | 'rlike' | 'gt' | 'ge' | 'lt' | 'le' | 'between', required — The comparison operator for the filter condition.
    - `field` string, required — The name of the data field to which the condition applies.
    - `value` string — The value that the condition checks for in the specified field. Use this attribute when specifying a single value.
    - `values` string[] — The values that the condition checks for in the specified field. Use this attribute when specifying multiple values.
  - `returns` string[] — Use this attribute to specify which top-level fields of the response schema you want to receive.

## Response `200`

No Error (List of Audit Logs)

- object
  - `data` AuditLogsResponseSchema[]
    - `createdTime` string — The creation timestamp of the log file.
    - `accountName` string — The account name associated with the logged action.
    - `userName` string — The username of the user associated with the logged action.
    - `eventName` string
    - `userAction` string — Summary of the action such as `Login with OAuth Succeeded` or `Alert Channel Created`.
    - `eventDescription` string — Summary of the event such as `User test-user@test-domain.net logged in to ALERTPLATFORM account using OAuth credentials`.

## Other responses

- `204` — No Data
- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)