---
title: "Get Audit Logs"
method: GET
path: "/v1/auditLogs"
tags: ["Audit Logs"]
---

# Get Audit Logs

`GET /v1/auditLogs`

Retrieves audit log events for the account. This API is exclusive to Enterprise Shield accounts. This endpoint is paginated.

## Query parameters

- `from` string, date-time
- `to` string, date-time
- `pageSize` integer
- `pageToken` string

## Response `200`

OK. Returns an array of audit log events.

- AuditLog[]
  - `accountId` integer — The unique ID for the account.
  - `eventTimestamp` string, date-time — The time the audit log event occurred.
  - `actor` object — Identifies the acting user that triggered the audit log event.
    - `actorType` string — The type of actor
    - `actorAccountId` integer — The account ID of the actor.
    - `actorEmail` string — The email address of the actor.
    - `actorUserId` number — The user ID of the actor.
    - `actorClient` string, nullable
    - `actorIsExternal` boolean — Whether the actor is external to the account.
  - `event` object — Audit event for when a document is opened.
    - `eventType` string — The event type.
    - `documentId` string, uuid — The ID of the document opened.
    - `product` string — The product of the document.
    - `documentOpenedMethod` object — The method used to open the document.
      - `methodType` string — The method used to open the document.
  - `target` object[] — A list of objects identifying the target of the audit event.
    - `targetType` string — The type of the target.
    - `targetId` union — Unique identifier of the target. The type depends on `targetType`: numeric for `userTarget`, `folderTarget`, `groupTarget`, `teamTarget`, and `repositoryTarget`; a UUID string for `documentTarget` and `assetTarget`; an arbitrary string for `emailInvitationTarget` and `restApiTarget`. Absent for `unknownTarget`.
      - number
      - string
    - `displayName` string — The display name of the target.
    - `userEmail` string, email — The email of the target user.
    - `isExternal` boolean — Whether the target is external to the organization.
  - `flowId` string, nullable — A flow id identifier.

## Other responses

- `400` — Bad request. Occurs when the query parameters are invalid.
- `403` — Forbidden. Occurs when the authorized token does not have permission to access audit logs.

---

[API](https://skmtc.net/lucid/apis/lucid-rest-api.md) · [All operations](https://skmtc.net/lucid/apis/lucid-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lucid/lucid-rest-api/revisions/6a32cb9e1aa7/schema)