---
title: "Search Audit Events"
method: GET
path: "/v1/audit-events"
tags: ["Audit API"]
---

# Search Audit Events

`GET /v1/audit-events`

Retrieve a paginated list of audit events. Supports filtering by event type, action, result, resource, and date range. Results use cursor-based pagination.

## Query parameters

- `eventType` string
- `action` string
- `result` 'SUCCESS' | 'FAILED'
- `resourceType` 'workflow' | 'execution' | 'provider_config'
- `resourceId` string, uuid
- `dateFrom` string, date-time
- `dateTo` string, date-time
- `limit` integer
- `cursor` string
- `sortOrder` 'ASC' | 'DESC'

## Response `200`

Indicates that the request was successful and the response contains the requested data.

- AuditEntryListOutput — Paginated list of audit event entries.
  - `items` AuditEntryOutput[] — Audit event entries in the current page.
    - `eventId` string, uuid — Unique identifier of the audit event.
    - `eventType` string — Type of audit event (e.g., `WORKFLOW_CREATED`, `EXECUTION_STARTED`, `PROVIDER_CONFIG_UPDATED`).
    - `action` string — Action performed: `CREATE`, `UPDATE`, `DELETE`, `ACTIVATE`, `DEACTIVATE`, `DRAFT`, or `EXECUTE`.
    - `result` string — Outcome of the action: `SUCCESS` or `FAILED`.
    - `resourceId` string — Identifier of the resource that was acted upon.
    - `resourceType` string — Type of resource: `workflow`, `execution`, or `provider_config`.
    - `actor` AuditActorOutput — Actor who performed the audited action.
      - `type` string — Type of actor: `user`, `system`, or `api_key`.
      - `id` string — Identifier of the actor (user ID, service name, or API key reference).
      - `ipAddress` string — IP address of the actor at the time of the action.
    - `context` object — Additional context about the event.
    - `metadata` object — Extra metadata associated with the event.
    - `timestamp` string, date-time — Timestamp when the event occurred (RFC 3339).
    - `hash` string — SHA-256 hash for this entry in the audit hash chain.
    - `previousHash` string — Hash of the previous entry in the chain. Empty for the first entry.
  - `nextCursor` string — Cursor for the next page. Empty if this is the last page.
  - `hasMore` boolean — Whether more pages are available.

## Other responses

- `400` — Indicates that the request was malformed or contained invalid parameters.
- `500` — Indicates an unexpected internal error. If this persists, please contact support.

---

[API](https://skmtc.net/lerian/apis/identity-plugin.md) · [All operations](https://skmtc.net/lerian/apis/identity-plugin/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lerian/identity-plugin/versions/25daba385532/schema)