---
title: "List Protection Audit Events"
method: GET
path: "/v1/organizations/{organization_id}/protection/audit"
tags: ["Protection API"]
---

# List Protection Audit Events

`GET /v1/organizations/{organization_id}/protection/audit`

## Path parameters

- `organization_id` string, uuid, required

## Query parameters

- `limit` string — Maximum number of events to return (default 20)
- `cursor` string — Opaque pagination cursor
- `sort_order` string — Sort order: asc or desc (default desc)
- `action` string — Filter by action
- `actor` string — Filter by actor
- `outcome` string — Filter by outcome: success, failure, or already_exists
- `start_date` string — Inclusive lower time bound (yyyy-mm-dd or RFC3339)
- `end_date` string — Inclusive upper time bound (yyyy-mm-dd or RFC3339)

## Headers

- `X-Request-Id` string, uuid
- `Authorization` string

## Response `200`

OK

- AuditEventsEnvelope
  - `items` AuditEventResponse[], nullable, required
    - `action` string, required
    - `actor` string, required
    - `from_status` string, required
    - `id` string, required
    - `outcome` string, required
    - `reason` string, required
    - `request_id` string, required
    - `timestamp` string, required
    - `to_status` string, required
  - `limit` integer, required
  - `next_cursor` string
  - `organization_id` string, required
  - `prev_cursor` string

## Other responses

- `default` — Error

---

[API](https://skmtc.net/lerian/apis/identity-plugin.md) · [All operations](https://skmtc.net/lerian/apis/identity-plugin/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lerian/identity-plugin/revisions/25daba385532/schema)