---
title: "Query Audit Logs"
method: POST
path: "/v1/auditLogs/query"
tags: ["Audit Logs"]
---

# Query Audit Logs

`POST /v1/auditLogs/query`

Queries audit log events for the account using filter criteria specified in the request body. This API is exclusive to Enterprise Shield accounts. This endpoint is paginated.

## Query parameters

- `pageSize` integer
- `pageToken` string

## Request body

- AuditLogQueryRequestBody
  - `from` string, date-time — The start date for the audit log query range.
  - `to` string, date-time — The end date for the audit log query range.
  - `userIds` integer[] — Array of user IDs who initiated the logged events.
  - `eventTypes` string[] — Array of event types to filter the audit logs.
  - `actorIsExternal` boolean — Whether the actor is external to the organization.
  - `actorTypes` string[] — Array of actor types to filter the audit logs, see 'Actors and Targets' for more details.

## Response `200`

OK. Returns an array of audit log events matching the query.

- AuditLog[]
  - `accountId` integer — The unique ID for the account.
  - `eventTimestamp` string, date-time — The time the audit log event occurred.
  - `actor` object — Identifies the acting user that triggered the audit log event.
    - `actorType` string — The type of actor
    - `actorAccountId` integer — The account ID of the actor.
    - `actorEmail` string — The email address of the actor.
    - `actorUserId` number — The user ID of the actor.
    - `actorClient` string, nullable
    - `actorIsExternal` boolean — Whether the actor is external to the account.
  - `event` object — Audit event for when a document is opened.
    - `eventType` string — The event type.
    - `documentId` string, uuid — The ID of the document opened.
    - `product` string — The product of the document.
    - `documentOpenedMethod` object — The method used to open the document.
      - `methodType` string — The method used to open the document.
  - `target` object[] — A list of objects identifying the target of the audit event.
    - `targetType` string — The type of the target.
    - `targetId` union — Unique identifier of the target. The type depends on `targetType`: numeric for `userTarget`, `folderTarget`, `groupTarget`, `teamTarget`, and `repositoryTarget`; a UUID string for `documentTarget` and `assetTarget`; an arbitrary string for `emailInvitationTarget` and `restApiTarget`. Absent for `unknownTarget`.
      - number
      - string
    - `displayName` string — The display name of the target.
    - `userEmail` string, email — The email of the target user.
    - `isExternal` boolean — Whether the target is external to the organization.
  - `flowId` string, nullable — A flow id identifier.

## Other responses

- `400` — Bad request. Occurs when the query parameters are invalid.
- `403` — Forbidden. Occurs when the authorized token does not have permission to access audit logs.

---

[API](https://skmtc.net/lucid/apis/lucid-rest-api.md) · [All operations](https://skmtc.net/lucid/apis/lucid-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lucid/lucid-rest-api/revisions/6a32cb9e1aa7/schema)