---
title: "Get instance logs"
method: POST
path: "/admin/logs"
tags: ["Logs"]
---

# Get instance logs

`POST /admin/logs`

## Request body

- object
  - `page` integer, nullable
  - `limit` integer, nullable — Maximum number of results to be returned. Can't be greater than the one set for your role. 0 means maximum.
  - `id` string
  - `title` string
  - `created` union
    - string, nullable — You can use any of the valid time related filters (examples: 7d, timestamps, [14d, 7d] for ranges, etc.)
    - DateRestSearchFilter[] — Interval described by two dates
  - `model` 'AdminSetting' | 'Allowedlist' | 'AttachmentScan' | 'Attribute' | 'AttributeTag' | 'AuditLog' | 'AuthKey' | 'Bruteforce' | 'Cerebrate' | 'Community' | 'CorrelationExclusion' | 'Correlation' | 'Dashboard' | 'DecayingModelMapping' | 'DecayingModel' | 'EventBlocklist' | 'EventDelegation' | 'EventGraph' | 'EventLock' | 'Event' | 'EventReport' | 'EventTag' | 'FavouriteTag' | 'Feed' | 'FuzzyCorrelateSsdeep' | 'GalaxyClusterBlocklist' | 'GalaxyCluster' | 'GalaxyClusterRelation' | 'GalaxyClusterRelationTag' | 'GalaxyElement' | 'Galaxy' | 'Inbox' | 'Job' | 'Log' | 'MispObject' | 'Module' | 'News' | 'NoticelistEntry' | 'Noticelist' | 'NotificationLog' | 'ObjectReference' | 'ObjectRelationship' | 'ObjectTemplateElement' | 'ObjectTemplate' | 'Organisation' | 'OrgBlocklist' | 'Post' | 'Regexp' | 'RestClientHistory' | 'Role' | 'Server' | 'ShadowAttribute' | 'SharingGroupOrg' | 'SharingGroup' | 'SharingGroupServer' | 'SightingdbOrg' | 'Sightingdb' | 'Sighting' | 'TagCollection' | 'TagCollectionTag' | 'Tag' | 'Task' | 'TaxonomyEntry' | 'Taxonomy' | 'TaxonomyPredicate' | 'TemplateElementAttribute' | 'TemplateElementFile' | 'TemplateElement' | 'TemplateElementText' | 'Template' | 'TemplateTag' | 'Thread' | 'ThreatLevel' | 'User' | 'UserSetting' | 'WarninglistEntry' | 'Warninglist' | 'WarninglistType'
  - `model_id` string
  - `action` 'accept' | 'accept_delegation' | 'acceptRegistrations' | 'add' | 'admin_email' | 'attachTags' | 'auth' | 'auth_fail' | 'blocklisted' | 'captureRelations' | 'change_pw' | 'delete' | 'disable' | 'discard' | 'discardRegistrations' | 'edit' | 'email' | 'enable' | 'enrichment' | 'error' | 'export' | 'fetchEvent' | 'file_upload' | 'galaxy' | 'include_formula' | 'login' | 'login_fail' | 'logout' | 'merge' | 'pruneUpdateLogs' | 'publish' | 'publish_sightings' | 'publish alert' | 'pull' | 'purge_events' | 'push' | 'registration' | 'registration_error' | 'remove_dead_workers' | 'request' | 'request_delegation' | 'reset_auth_key' | 'send_mail' | 'security' | 'serverSettingsEdit' | 'tag' | 'undelete' | 'update' | 'update_database' | 'update_db_worker' | 'upgrade_24' | 'upload_sample' | 'version_warning' | 'warning' | 'wipe_default'
  - `user_id` string
  - `change` string — Text search for log change property
  - `email` string, email
  - `org` string — Text search for log organisation name property
  - `description` string — Text search for log change property
  - `ip` string — Text search for log ip property

## Response `200`

Get logs response

- object[]
  - `Log` Log
    - `id` string
    - `title` string
    - `created` string, date-time
    - `model` 'AdminSetting' | 'Allowedlist' | 'AttachmentScan' | 'Attribute' | 'AttributeTag' | 'AuditLog' | 'AuthKey' | 'Bruteforce' | 'Cerebrate' | 'Community' | 'CorrelationExclusion' | 'Correlation' | 'Dashboard' | 'DecayingModelMapping' | 'DecayingModel' | 'EventBlocklist' | 'EventDelegation' | 'EventGraph' | 'EventLock' | 'Event' | 'EventReport' | 'EventTag' | 'FavouriteTag' | 'Feed' | 'FuzzyCorrelateSsdeep' | 'GalaxyClusterBlocklist' | 'GalaxyCluster' | 'GalaxyClusterRelation' | 'GalaxyClusterRelationTag' | 'GalaxyElement' | 'Galaxy' | 'Inbox' | 'Job' | 'Log' | 'MispObject' | 'Module' | 'News' | 'NoticelistEntry' | 'Noticelist' | 'NotificationLog' | 'ObjectReference' | 'ObjectRelationship' | 'ObjectTemplateElement' | 'ObjectTemplate' | 'Organisation' | 'OrgBlocklist' | 'Post' | 'Regexp' | 'RestClientHistory' | 'Role' | 'Server' | 'ShadowAttribute' | 'SharingGroupOrg' | 'SharingGroup' | 'SharingGroupServer' | 'SightingdbOrg' | 'Sightingdb' | 'Sighting' | 'TagCollection' | 'TagCollectionTag' | 'Tag' | 'Task' | 'TaxonomyEntry' | 'Taxonomy' | 'TaxonomyPredicate' | 'TemplateElementAttribute' | 'TemplateElementFile' | 'TemplateElement' | 'TemplateElementText' | 'Template' | 'TemplateTag' | 'Thread' | 'ThreatLevel' | 'User' | 'UserSetting' | 'WarninglistEntry' | 'Warninglist' | 'WarninglistType'
    - `model_id` string
    - `action` 'accept' | 'accept_delegation' | 'acceptRegistrations' | 'add' | 'admin_email' | 'attachTags' | 'auth' | 'auth_fail' | 'blocklisted' | 'captureRelations' | 'change_pw' | 'delete' | 'disable' | 'discard' | 'discardRegistrations' | 'edit' | 'email' | 'enable' | 'enrichment' | 'error' | 'export' | 'fetchEvent' | 'file_upload' | 'galaxy' | 'include_formula' | 'login' | 'login_fail' | 'logout' | 'merge' | 'pruneUpdateLogs' | 'publish' | 'publish_sightings' | 'publish alert' | 'pull' | 'purge_events' | 'push' | 'registration' | 'registration_error' | 'remove_dead_workers' | 'request' | 'request_delegation' | 'reset_auth_key' | 'send_mail' | 'security' | 'serverSettingsEdit' | 'tag' | 'undelete' | 'update' | 'update_database' | 'update_db_worker' | 'upgrade_24' | 'upload_sample' | 'version_warning' | 'warning' | 'wipe_default'
    - `user_id` string
    - `change` string
    - `email` string, email
    - `org` string
    - `description` string
    - `ip` string

## Other responses

- `403` — Authentication failed. Please make sure you pass the API key of an API enabled user along in the Authorization header.
- `404` — The specified resource was not found
- `default` — Unexpected API error

---

[API](https://skmtc.net/misp/apis/misp-automation-api.md) · [All operations](https://skmtc.net/misp/apis/misp-automation-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/misp/misp-automation-api/revisions/88b34ff032a1/schema)