---
title: "List audit logs"
method: GET
path: "/organizations/{organization_id}/audit_logs"
---

# List audit logs

`GET /organizations/{organization_id}/audit_logs`

Retrieve a paginated, time-scoped list of audit log events for an organization. Requires an Enterprise plan with the audit logs entitlement enabled.

## Path parameters

- `organization_id` string, required

## Query parameters

- `start_time` string
- `end_time` string
- `cursor` string
- `limit` integer
- `app_ids` string[]
- `actions` string[]
- `actor_ids` string[]
- `actor_emails` string[]
- `target_types` string[]
- `target_ids` string[]
- `ip_addresses` string[]

## Headers

- `Authorization` string, required

## Response `200`

200

- object
  - `audit_logs` object[] — Array of audit log events, ordered by `occurred_at` ascending.
    - `id` string — UUID of the audit log event.
    - `organization_id` string — UUID of the organization the event belongs to.
    - `app_id` string — UUID of the app the event is associated with. Absent for org-level events.
    - `action` string — The action that was performed (e.g. `notification.sent`, `segment.created`, `member.invited`).
    - `occurred_at` string — RFC 3339 timestamp of when the event occurred (e.g. `2026-02-18T12:34:56Z`).
    - `version` integer — Schema version of the event payload.
    - `actor` object — The user or service that performed the action. Absent if the actor is unknown.
      - `type` string — Actor type (e.g. `user`, `service`).
      - `id` string — UUID of the actor.
      - `name` string — Display name of the actor. Absent if unavailable.
      - `email` string — Email address of the actor. Absent if unavailable.
      - `metadata` object — Additional actor-specific data.
    - `targets` object[] — The resources the action was performed on. May be empty for org-level events.
      - `type` string — Resource type (e.g. `notification`, `segment`, `journey`, `app`).
      - `id` string — UUID of the resource.
      - `name` string — Display name of the resource. Absent if unavailable.
      - `metadata` object — Additional resource-specific data.
    - `context` object — Request context at the time of the event. Absent if context was not captured.
      - `ip` string — IP address the request originated from.
      - `user_agent` string — User agent of the client that made the request.
      - `country` string — Country code derived from the request IP.
      - `metadata` object — Additional context-specific data.
    - `metadata` object — Additional event-specific data that does not fit into the standard fields.
  - `has_more` boolean — `true` if additional events exist beyond this page. Use `next_cursor` to fetch the next page.
  - `next_cursor` string — Opaque cursor to pass as `cursor` in the next request. Only present when `has_more` is `true`.

## Other responses

- `400` — 400
- `403` — 403
- `429` — Rate limit exceeded. Wait the number of seconds in the `Retry-After` header before retrying.
- `503` — Service temporarily unavailable. Retry after a short backoff. The body may be empty or non-JSON in some failure modes.

---

[API](https://skmtc.net/onesignal/apis/api-onesignal-com.md) · [All operations](https://skmtc.net/onesignal/apis/api-onesignal-com/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onesignal/api-onesignal-com/revisions/0fc223f7e338/schema)