---
title: "Query workspace audit logs (Preview)"
method: GET
path: "/v1beta/workspaces/{workspace_id}/audit-logs"
tags: ["security-governance"]
---

# Query workspace audit logs (Preview)

`GET /v1beta/workspaces/{workspace_id}/audit-logs`

**Plan:** `Enterprise`

Returns workspace audit log entries newest first (event timestamp descending, event ID as the cursor tie-breaker), paginated via an opaque cursor. Pagination and total-count behavior may change before this operation graduates to the stable surface.

This operation is in public preview (beta) and served under `/v1beta`. Request and response shapes may change before it graduates to the stable `/v1` surface.

## Path parameters

- `workspace_id` string, required — Workspace ID

## Query parameters

- `limit` integer — Maximum results per page.
- `cursor` string — Opaque cursor returned by a previous page; omit for the first page.
- `actions` string — Comma-separated audit-log action filter (exact match, e.g. workspace.member.added).
- `actor_ids` string — Comma-separated list of actor user IDs to filter by.
- `target_ids` string — Comma-separated list of target resource IDs to filter by.
- `search` string — Token-based search on target_id and target_display_name. Minimum 3 characters.
- `start_date` string — RFC3339 inclusive start of the time range. Defaults to 30 days ago. When paginating with cursor, pass an explicit start_date so the default lower bound does not drift between pages.
- `end_date` string — RFC3339 inclusive end of the time range. Defaults to now.

## Response `200`

OK

- V1WorkspaceAuditLogsBody
  - `data` V1WorkspaceAuditLogEntry[], nullable, required
    - `action` string, required — Action name (e.g. workspace.member.added).
    - `action_description` string, required — Human-readable description of the action, derived from the action name (e.g. Workspace member added).
    - `actor_display_name` string — Display name of the actor at the time of the event.
    - `actor_id` string, required — User ID of the actor (or system actor ID for non-user actions).
    - `actor_type` string — Actor classification (user, scim, system).
    - `details` object — Action-specific structured detail payload.
    - `id` string, required — Event ID.
    - `ip_address` string — IP address that initiated the action.
    - `status` string, required — success or failed.
    - `status_message` string — Optional message describing the failure cause when status is failed.
    - `target_display_name` string — Display name of the target at the time of the event.
    - `target_id` string — ID of the target resource.
    - `target_type` string — Type of the target resource (project, workspace, membership, etc.).
    - `timestamp` string, date-time, required — When the action occurred.
    - `trace_group_id` string — Group ID linking multi-event flows together.
    - `user_agent` string — User agent string for the request.
  - `pagination` Pagination, required
    - `has_more` boolean, required — Whether more results are available beyond this page
    - `next_cursor` string, nullable, required — Cursor for the next page; null when there are no more results

## Other responses

- `401` — Missing or invalid API key.
- `402` — This operation or requested configuration requires a workspace plan that includes this feature.
- `403` — The key or caller lacks the required scope or permission.
- `406` — The Accept header excludes every media type this endpoint produces.
- `429` — Too many requests. Retry after the interval in Retry-After when present.
- `default` — Error. The response body uses the standard error envelope; status matches the HTTP status code and type is a machine-readable error code.

---

[API](https://skmtc.net/lovable/apis/lovable-api.md) · [All operations](https://skmtc.net/lovable/apis/lovable-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lovable/lovable-api/revisions/aa8d44585147/schema)