--- title: "Get Audit Logs" method: GET path: "/api/v1/audit-logs" tags: ["audit-logs"] --- # Get Audit Logs `GET /api/v1/audit-logs` Retrieve audit log records for the authenticated user's organization in OCSF format. Requires both start_time and end_time parameters to filter logs within a date range. Supports cursor-based pagination. Returns results in OCSF API Activity (Class UID: 6003) format, which is compatible with security monitoring and SIEM tools. Reference: https://schema.ocsf.io/1.7.0/classes/api_activity ## Query parameters - `limit` integer — Number of items to return - `cursor` string, nullable — Cursor for pagination (base64-encoded JSON string) - `workspace_id` string, uuid, nullable — Filter by workspace ID - `start_time` string, date-time, required — Start datetime (inclusive) in ISO 8601 format - `end_time` string, date-time, required — End datetime (inclusive) in ISO 8601 format - `operations` AuditLogOperation[], nullable — Filter by operation names. If omitted, all operations are returned. ## Response `200` Successful Response - ListAuditLogsOCSFResponse — Response model for listing audit logs in OCSF format with pagination. - `cursor` string, nullable, required - `items` OCSFApiActivity[], required - `class_uid` 6003, required — OCSF class UIDs. - `class_name` 'API Activity', required — OCSF class names. - `category_uid` 6, required — OCSF category UIDs. - `category_name` 'Application Activity', required — OCSF category names. - `severity_id` 99, required — Severity levels for OCSF events. - `type_uid` 600300 | 600301 | 600302 | 600303 | 600304 | 600399, required — OCSF type UIDs for API Activity (class_uid * 100 + activity_id). - `activity_id` 0 | 1 | 2 | 3 | 4 | 99, required — Activity types for API Activity class. - `activity_name` string, required - `status_id` 0 | 1 | 2 | 99, required — Status values for OCSF events. - `status` string, required - `time` integer, required - `metadata` OCSFMetadata, required — OCSF event metadata. - `uid` string, uuid, required - `product` OCSFProduct, required — OCSF product object. - `name` string, required - `vendor_name` string, required - `api` OCSFApi, required — OCSF API details object. - `operation` 'create_api_key' | 'delete_api_key' | 'create_personal_access_token' | 'delete_personal_access_token' | 'create_service_key' | 'delete_service_key' | 'create_role' | 'update_role' | 'delete_role' | 'invite_user_to_org' | 'invite_users_to_org_batch' | 'add_basic_auth_users_to_org' | 'update_basic_auth_user' | 'delete_org_pending_member' | 'delete_org_member' | 'update_org_member' | 'create_sso_settings' | 'update_sso_settings' | 'delete_sso_settings' | 'update_default_sso_provision_organization' | 'update_login_methods' | 'update_organization_info' | 'update_business_info' | 'update_payment_plan' | 'update_payment_method' | 'create_payment_setup_intent' | 'create_payment_checkout_session' | 'confirm_payment_checkout_session' | 'create_payment_account_link' | 'create_workspace' | 'update_workspace' | 'delete_workspace' | 'add_member_to_workspace' | 'add_members_to_workspace_batch' | 'delete_workspace_member' | 'update_workspace_member' | 'delete_workspace_pending_member' | 'update_workspace_secrets' | 'unshare_entities' | 'set_tenant_handle' | 'create_tag_key' | 'update_tag_key' | 'delete_tag_key' | 'create_tag_value' | 'update_tag_value' | 'delete_tag_value' | 'create_tagging' | 'delete_tagging' | 'update_tracer_session' | 'delete_tracer_session' | 'delete_tracer_sessions' | 'delete_runs' | 'create_dataset' | 'create_csv_dataset' | 'create_experiment_via_upload' | 'create_playground_experiment' | 'create_comparative_experiment' | 'delete_comparative_experiment' | 'delete_dataset' | 'delete_datasets' | 'update_dataset' | 'update_dataset_version' | 'update_dataset_splits' | 'share_dataset' | 'unshare_dataset' | 'clone_dataset' | 'download_dataset' | 'create_example' | 'create_examples' | 'update_example' | 'update_examples' | 'sync_examples' | 'delete_example' | 'delete_examples' | 'create_bulk_export' | 'cancel_bulk_export' | 'read_bulk_export_destination' | 'create_bulk_export_destination' | 'update_bulk_export_destination' | 'update_ttl_settings' | 'update_usage_limit' | 'delete_usage_limit' | 'create_model_price_map' | 'update_model_price_map' | 'delete_model_price_map' | 'create_chart' | 'update_chart' | 'delete_chart' | 'create_chart_section' | 'update_chart_section' | 'delete_chart_section' | 'clone_chart_section' | 'create_org_chart' | 'update_org_chart' | 'delete_org_chart' | 'create_org_chart_section' | 'update_org_chart_section' | 'delete_org_chart_section' | 'create_prompt_webhook' | 'update_prompt_webhook' | 'delete_prompt_webhook' | 'test_prompt_webhook' | 'create_deployment' | 'update_deployment' | 'delete_deployment' | 'create_access_policy' | 'delete_access_policy' | 'list_access_policies' | 'read_access_policy' | 'attach_access_policies' | 'read_role_access_policies' | 'create_scim_token' | 'update_scim_token' | 'delete_scim_token' | 'create_scim_user' | 'update_scim_user' | 'delete_scim_user' | 'create_scim_group' | 'update_scim_group' | 'delete_scim_group' | 'create_prompt_canvas_quick_action' | 'update_prompt_canvas_quick_action' | 'delete_prompt_canvas_quick_action' | 'create_fleet_usage_limit' | 'update_fleet_usage_limit' | 'delete_fleet_usage_limit' | 'create_experiment_view_override' | 'update_experiment_view_override' | 'delete_experiment_view_override' | 'create_alert_rule' | 'update_alert_rule' | 'delete_alert_rule' | 'test_alert_rule' | 'create_forge_configuration' | 'update_forge_configuration' | 'delete_forge_configuration' | 'trigger_forge_configuration' | 'add_annotation_queue_reviewer' | 'remove_annotation_queue_reviewer' | 'submit_nps_response' | 'create_mcp_server' | 'update_mcp_server' | 'delete_mcp_server' | 'register_mcp_server_oauth' | 'create_credential' | 'create_tool' | 'update_tool' | 'delete_tool' | 'create_mcp_vendor_settings' | 'update_mcp_vendor_settings' | 'delete_mcp_vendor_settings' | 'create_evaluator' | 'update_evaluator' | 'delete_evaluator' | 'bulk_delete_evaluators' | 'upsert_feature_default_model' | 'delete_feature_default_model' | 'upsert_feature_disabled_model' | 'delete_feature_disabled_model' | 'create_fleet_webhook' | 'update_fleet_webhook' | 'delete_fleet_webhook' | 'test_fleet_webhook' | 'create_commit' | 'create_hub_environment' | 'update_hub_environment' | 'delete_hub_environment' | 'create_directory_commit' | 'delete_directory' | 'create_gateway_policy' | 'update_gateway_policy' | 'delete_gateway_policy' | 'invoke_gateway' | 'create_sandbox_proxy_profile' | 'update_sandbox_proxy_profile' | 'delete_sandbox_proxy_profile' | 'create_sandbox_policy' | 'update_sandbox_policy' | 'delete_sandbox_policy' | 'list_sandbox_claims' | 'get_sandbox_claim' | 'get_sandbox_claim_status' | 'create_sandbox_claim' | 'update_sandbox_claim' | 'delete_sandbox_claim' | 'batch_delete_sandbox_claims' | 'start_sandbox_claim' | 'stop_sandbox_claim' | 'generate_sandbox_service_url' | 'capture_sandbox_snapshot' | 'list_sandbox_snapshots' | 'get_sandbox_snapshot' | 'create_sandbox_snapshot' | 'delete_sandbox_snapshot' | 'list_sandbox_registries' | 'get_sandbox_registry' | 'create_sandbox_registry' | 'update_sandbox_registry' | 'delete_sandbox_registry' | 'create_data_plane' | 'create_annotation_queue' | 'populate_annotation_queue' | 'delete_annotation_queue' | 'delete_annotation_queues' | 'update_annotation_queue' | 'add_runs_to_annotation_queue' | 'export_annotation_queue' | 'update_annotation_queue_run' | 'delete_annotation_queue_run' | 'delete_annotation_queue_runs' | 'create_annotation_queue_run_status' | 'login' | 'send_sso_email_confirmation' | 'confirm_sso_user_email' | 'execute_custom_code' | 'generate_dataset' | 'evaluate_experiment' | 'create_feedback_formula' | 'update_feedback_formula' | 'delete_feedback_formula' | 'create_feedback_config' | 'update_feedback_config' | 'delete_feedback_config' | 'invalidate_mcp_tools_cache' | 'mcp_proxy' | 'create_onboarding_state' | 'update_onboarding_state' | 'create_organization' | 'delete_pending_organization_invite' | 'claim_pending_organization_invite' | 'create_playground_settings' | 'update_playground_settings' | 'delete_playground_settings' | 'create_service_account' | 'delete_service_account' | 'create_tenant' | 'create_filter_view' | 'update_filter_view' | 'rename_filter_view' | 'delete_filter_view' | 'create_insights_job' | 'create_insights_job_config' | 'update_insights_job_config' | 'delete_insights_job_config' | 'update_insights_job' | 'delete_insights_job' | 'read_charts' | 'read_chart_preview' | 'read_chart' | 'read_chart_section' | 'validate_example' | 'validate_examples' | 'read_shared_delta' | 'read_shared_delta_stream' | 'generate_shared_dataset_query' | 'generate_runs_query' | 'read_tracing_dashboard' | 'generate_insights_job_config' | 'read_dataset_delta' | 'delete_pending_workspace_invite' | 'claim_pending_workspace_invite' | 'list_annotation_queues' | 'get_annotation_queue' | 'get_annotation_queue_runs' | 'get_annotation_queue_run' | 'get_annotation_queues_for_run' | 'get_annotation_queue_size' | 'get_annotation_queue_archived_size' | 'get_annotation_queue_total_size' | 'resolve_annotation_queue_run' | 'get_audit_logs' | 'get_sso_settings' | 'list_bulk_exports' | 'list_bulk_export_destinations' | 'get_bulk_export' | 'get_bulk_export_runs' | 'get_bulk_export_run' | 'get_bulk_export_runs_filtered' | 'list_chart_sections' | 'get_dataset_versions' | 'diff_dataset_versions' | 'get_dataset_version' | 'read_dataset_share_state' | 'count_examples' | 'list_feedback_formulas' | 'get_feedback_formula' | 'list_feedback_configs' | 'get_mcp_tools' | 'mcp_proxy_get' | 'get_onboarding_state' | 'read_model_price_map' | 'list_organizations' | 'get_organization_info' | 'get_organization_billing_info' | 'get_org_dashboard' | 'get_company_info' | 'list_organization_roles' | 'list_permissions' | 'list_pending_organization_invites' | 'list_org_members' | 'get_org_usage' | 'get_granular_usage' | 'export_granular_usage_csv' | 'export_usage_backfill_csv' | 'get_login_methods' | 'get_sso_settings_current' | 'list_org_service_keys' | 'list_org_personal_access_tokens' | 'list_service_accounts' | 'list_filter_views' | 'get_filter_view' | 'list_insights_jobs' | 'list_insights_job_configs' | 'get_insights_job' | 'get_insights_job_runs' | 'get_run_cluster' | 'get_usage_limits' | 'get_org_usage_limits' | 'list_workspaces' | 'list_pending_workspace_invites' | 'get_workspace_stats' | 'list_workspace_members' | 'get_shared_tokens' | 'get_workspace_usage_limits_info' | 'list_tag_keys' | 'get_tag_key' | 'list_tag_values' | 'get_tag_value' | 'list_tags' | 'list_tags_for_resource' | 'list_taggings' | 'get_shared_examples_count' | 'list_examples' | 'get_example' | 'get_experiment_view_overrides' | 'get_experiment_view_override' | 'get_dataset_comparison_view' | 'stream_dataset_comparison_view' | 'stream_feedback_delta' | 'read_comparative_experiments' | 'stream_grouped_experiments' | 'query_run' | 'query_runs' | 'query_trace' | 'query_trace_messages' | 'batch_query_trace_messages' | 'query_thread_messages' | 'query_single_thread_stats' | 'query_thread_traces' | 'query_threads' | 'list_pairwise_queues' | 'get_pairwise_queue' | 'list_pairwise_entries' | 'read_run' | 'read_runs' | 'read_example' | 'read_examples' | 'read_feedback' | 'read_feedbacks' | 'create_license_share_link' | 'create_provisioned_saas_org' | 'mint_self_hosted_license' | 'invite_provisioned_org_member' | 'create_self_hosted_customer' | 'update_self_hosted_customer' | 'update_self_hosted_license' | 'test_op_generic', required — Operations that are logged in audit_logs database table. - `http_request` OCSFHttpRequest, required — OCSF HTTP request object. - `http_method` string, required - `url` OCSFUrl, required — OCSF URL object. - `path` string, required - `http_response` OCSFHttpResponse, required — OCSF HTTP response object. - `code` integer, nullable, required - `actor` OCSFActor, required — OCSF actor object. - `user` OCSFUser, required — OCSF user object within actor. - `uid` string, uuid, nullable, required - `credential_uid` string, uuid, nullable, required - `src_endpoint` OCSFEndpoint, required — OCSF network endpoint object. - `ip` string, nullable, required - `port` integer, nullable, required - `intermediate_ips` string[], nullable, required - `resources` OCSFResourceDetails[], required - `uid` string, uuid, required - `unmapped` OCSFUnmapped, required — OCSF unmapped attribute for source-specific data. Reference: https://schema.ocsf.io/1.7.0/classes/base_event - `original_audit_log` AuditLogMessage, required — Represents an audit log message. Indexed columns are individual DB columns. All other fields (request_method, request_path, client_host, etc.) live in the enrichments JSONB column. - `id` string, uuid, required - `operation_name` string, required - `operation_succeeded` boolean, nullable, required - `request_time` string, date-time, required - `api_key_id` string, uuid, nullable, required - `user_id` string, uuid, nullable, required - `ls_user_id` string, uuid, nullable, required - `organization_id` string, uuid, nullable, required - `workspace_id` string, uuid, nullable, required - `enrichments` AuditLogEnrichments, required — Non-indexed request metadata stored in the enrichments JSONB column. - `request_method` string - `request_path` string - `client_host` string, nullable - `client_port` integer, nullable - `x_forwarded_for` string, nullable - `response_status_code` integer, nullable - `resource_ids` string[], nullable ## Other responses - `422` — Validation Error --- [API](https://skmtc.net/langchain-ai/apis/langsmith.md) · [All operations](https://skmtc.net/langchain-ai/apis/langsmith/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/langchain-ai/langsmith/revisions/a0acb3a6a101/schema)