--- title: "List audit logs" method: GET path: "/organization/audit_logs" tags: ["Audit Logs"] --- # List audit logs `GET /organization/audit_logs` List user actions and configuration changes within this organization. ## Query parameters - `effective_at` object - `gt` integer — Return only events whose `effective_at` (Unix seconds) is greater than this value. - `gte` integer — Return only events whose `effective_at` (Unix seconds) is greater than or equal to this value. - `lt` integer — Return only events whose `effective_at` (Unix seconds) is less than this value. - `lte` integer — Return only events whose `effective_at` (Unix seconds) is less than or equal to this value. - `project_ids[]` string[] - `event_types[]` AuditLogEventType[] - `actor_ids[]` string[] - `actor_emails[]` string[] - `resource_ids[]` string[] - `tenant_only` boolean - `limit` integer - `after` string - `before` string ## Response `200` Audit logs listed successfully. - ListAuditLogsResponse - `object` 'list', required - `data` AuditLog[], required - `id` string, required — The ID of this log. - `type` 'api_key.created' | 'api_key.updated' | 'api_key.deleted' | 'certificate.created' | 'certificate.updated' | 'certificate.deleted' | 'certificates.activated' | 'certificates.deactivated' | 'checkpoint.permission.created' | 'checkpoint.permission.deleted' | 'external_key.registered' | 'external_key.removed' | 'group.created' | 'group.updated' | 'group.deleted' | 'invite.sent' | 'invite.accepted' | 'invite.deleted' | 'ip_allowlist.created' | 'ip_allowlist.updated' | 'ip_allowlist.deleted' | 'ip_allowlist.config.activated' | 'ip_allowlist.config.deactivated' | 'login.succeeded' | 'login.failed' | 'logout.succeeded' | 'logout.failed' | 'organization.updated' | 'project.created' | 'project.updated' | 'project.archived' | 'project.deleted' | 'rate_limit.updated' | 'rate_limit.deleted' | 'resource.deleted' | 'tunnel.created' | 'tunnel.updated' | 'tunnel.deleted' | 'workload_identity_provider.created' | 'workload_identity_provider.updated' | 'workload_identity_provider.deleted' | 'workload_identity_provider_mapping.created' | 'workload_identity_provider_mapping.updated' | 'workload_identity_provider_mapping.deleted' | 'role.created' | 'role.updated' | 'role.deleted' | 'role.assignment.created' | 'role.assignment.deleted' | 'role.bound_to_resource' | 'role.unbound_from_resource' | 'scim.enabled' | 'scim.disabled' | 'service_account.created' | 'service_account.updated' | 'service_account.deleted' | 'user.added' | 'user.updated' | 'user.deleted' | 'tenant.metadata.updated' | 'tenant.microsoft_entra_mapping.upserted' | 'tenant.microsoft_entra_mapping.deleted' | 'tenant.workload_identity.provider.created' | 'tenant.workload_identity.provider.updated' | 'tenant.workload_identity.provider.archived' | 'tenant.workload_identity.mapping.created' | 'tenant.workload_identity.mapping.updated' | 'tenant.workload_identity.mapping.archived' | 'tenant.workload_identity.binding.created' | 'tenant.workload_identity.principal.provisioned' | 'tenant.admin_api_key.created' | 'tenant.admin_api_key.updated' | 'tenant.admin_api_key.deleted' | 'tenant.project_api_key.created' | 'tenant.chatgpt_access_token.revoked' | 'tenant.migration.completed' | 'tenant.sso.migrated' | 'tenant.domains.migrated' | 'tenant.sso_connection.created' | 'tenant.sso_connection.updated' | 'tenant.sso_connection.deleted' | 'tenant.sso_connection.setup.started' | 'tenant.policy.created' | 'tenant.policy.updated' | 'tenant.policy.deleted' | 'tenant.policy.attached' | 'tenant.policy.detached' | 'tenant.principal_authentication_policy.resolved' | 'tenant.scim.setup.started' | 'tenant.scim.deletion.requested' | 'tenant.scim.directory.created' | 'tenant.product_access_policy.updated' | 'tenant.resource_share_grant.created' | 'tenant.resource_share_grant.updated' | 'tenant.resource_share_grant.accepted' | 'tenant.resource_share_grant.declined' | 'tenant.resource_share_grant.revoked' | 'tenant.resource_share_grant.deleted' | 'tenant.service_account.updated' | 'tenant.service_account.deleted' | 'tenant.service_account.token.revoked' | 'tenant.billing.overage_limit.updated' | 'tenant.billing.alerts.updated' | 'tenant.billing.info.updated' | 'tenant.usage_limit.workspace.updated' | 'tenant.usage_limit.group.updated' | 'tenant.usage_limit.user.updated' | 'tenant.usage_limit.increase_request.updated' | 'tenant.usage_limit.increase_request.resolved' | 'tenant.group.created' | 'tenant.group.updated' | 'tenant.group.deleted' | 'tenant.group.member.added' | 'tenant.group.member.removed' | 'tenant.migration_rollout.status.updated' | 'tenant.migration_rollout.tier.updated' | 'tenant.role.metadata.updated' | 'tenant.custom_role.created' | 'tenant.custom_role.updated' | 'tenant.custom_role.deleted' | 'tenant.role_assignment.created' | 'tenant.role_assignment.deleted' | 'tenant.resource_role_assignment.created' | 'tenant.resource_role_assignment.deleted' | 'tenant.resource_access.updated' | 'tenant.resource_access.deleted' | 'tenant.session_policy.created' | 'tenant.session_policy.updated' | 'tenant.session_policy.deleted' | 'tenant.session_revocation.started' | 'tenant.third_party_app_policy.updated' | 'tenant.user.added' | 'tenant.user.updated' | 'tenant.user.removed' | 'tenant.user.looked_up' | 'tenant.user.invited' | 'tenant.membership.revoked' | 'tenant.api_organization_invite.upserted' | 'tenant.api_organization_invite.deleted' | 'tenant.chatgpt_workspace_invite.upserted' | 'tenant.membership.accepted' | 'tenant.membership.declined' | 'tenant.workspace_invite_email_settings.updated', required — The event type. - `effective_at` integer, required — The Unix timestamp (in seconds) of the event. - `project` object — The project that the action was scoped to. Absent for actions not scoped to projects. Note that any admin actions taken via Admin API keys are associated with the default project. - `id` string — The project ID. - `name` string — The project title. - `actor` AuditLogActor — The actor who performed the audit logged action. - `type` 'session' | 'api_key' — The type of actor. Is either `session` or `api_key`. - `session` AuditLogActorSession — The session in which the audit logged action was performed. - `user` AuditLogActorUser — The user who performed the audit logged action. - `id` string — The user id. - `email` string — The user email. - `ip_address` string — The IP address from which the action was performed. - `api_key` AuditLogActorApiKey — The API Key used to perform the audit logged action. - `id` string — The tracking id of the API key. - `type` 'user' | 'service_account' — The type of API key. Can be either `user` or `service_account`. - `user` AuditLogActorUser — The user who performed the audit logged action. - `id` string — The user id. - `email` string — The user email. - `service_account` AuditLogActorServiceAccount — The service account that performed the audit logged action. - `id` string — The service account id. - `api_key.created` object — The details for events with this `type`. - `id` string — The tracking ID of the API key. - `data` object — The payload used to create the API key. - `scopes` string[] — A list of scopes allowed for the API key, e.g. `["api.model.request"]` - `api_key.updated` object — The details for events with this `type`. - `id` string — The tracking ID of the API key. - `changes_requested` object — The payload used to update the API key. - `scopes` string[] — A list of scopes allowed for the API key, e.g. `["api.model.request"]` - `api_key.deleted` object — The details for events with this `type`. - `id` string — The tracking ID of the API key. - `checkpoint.permission.created` object — The project and fine-tuned model checkpoint that the checkpoint permission was created for. - `id` string — The ID of the checkpoint permission. - `data` object — The payload used to create the checkpoint permission. - `project_id` string — The ID of the project that the checkpoint permission was created for. - `fine_tuned_model_checkpoint` string — The ID of the fine-tuned model checkpoint. - `checkpoint.permission.deleted` object — The details for events with this `type`. - `id` string — The ID of the checkpoint permission. - `external_key.registered` object — The details for events with this `type`. - `id` string — The ID of the external key configuration. - `data` object — The configuration for the external key. - `external_key.removed` object — The details for events with this `type`. - `id` string — The ID of the external key configuration. - `group.created` object — The details for events with this `type`. - `id` string — The ID of the group. - `data` object — Information about the created group. - `group_name` string — The group name. - `group.updated` object — The details for events with this `type`. - `id` string — The ID of the group. - `changes_requested` object — The payload used to update the group. - `group_name` string — The updated group name. - `group.deleted` object — The details for events with this `type`. - `id` string — The ID of the group. - `scim.enabled` object — The details for events with this `type`. - `id` string — The ID of the SCIM was enabled for. - `scim.disabled` object — The details for events with this `type`. - `id` string — The ID of the SCIM was disabled for. - `invite.sent` object — The details for events with this `type`. - `id` string — The ID of the invite. - `data` object — The payload used to create the invite. - `email` string — The email invited to the organization. - `role` string — The role the email was invited to be. Is either `owner` or `member`. - `invite.accepted` object — The details for events with this `type`. - `id` string — The ID of the invite. - `invite.deleted` object — The details for events with this `type`. - `id` string — The ID of the invite. - `ip_allowlist.created` object — The details for events with this `type`. - `id` string — The ID of the IP allowlist configuration. - `name` string — The name of the IP allowlist configuration. - `allowed_ips` string[] — The IP addresses or CIDR ranges included in the configuration. - `ip_allowlist.updated` object — The details for events with this `type`. - `id` string — The ID of the IP allowlist configuration. - `allowed_ips` string[] — The updated set of IP addresses or CIDR ranges in the configuration. - `ip_allowlist.deleted` object — The details for events with this `type`. - `id` string — The ID of the IP allowlist configuration. - `name` string — The name of the IP allowlist configuration. - `allowed_ips` string[] — The IP addresses or CIDR ranges that were in the configuration. - `ip_allowlist.config.activated` object — The details for events with this `type`. - `configs` object[] — The configurations that were activated. - `id` string — The ID of the IP allowlist configuration. - `name` string — The name of the IP allowlist configuration. - `ip_allowlist.config.deactivated` object — The details for events with this `type`. - `configs` object[] — The configurations that were deactivated. - `id` string — The ID of the IP allowlist configuration. - `name` string — The name of the IP allowlist configuration. - `login.succeeded` object — This event has no additional fields beyond the standard audit log attributes. - `login.failed` object — The details for events with this `type`. - `error_code` string — The error code of the failure. - `error_message` string — The error message of the failure. - `logout.succeeded` object — This event has no additional fields beyond the standard audit log attributes. - `logout.failed` object — The details for events with this `type`. - `error_code` string — The error code of the failure. - `error_message` string — The error message of the failure. - `organization.updated` object — The details for events with this `type`. - `id` string — The organization ID. - `changes_requested` object — The payload used to update the organization settings. - `title` string — The organization title. - `description` string — The organization description. - `name` string — The organization name. - `threads_ui_visibility` string — Visibility of the threads page which shows messages created with the Assistants API and Playground. One of `ANY_ROLE`, `OWNERS`, or `NONE`. - `usage_dashboard_visibility` string — Visibility of the usage dashboard which shows activity and costs for your organization. One of `ANY_ROLE` or `OWNERS`. - `api_call_logging` string — How your organization logs data from supported API calls. One of `disabled`, `enabled_per_call`, `enabled_for_all_projects`, or `enabled_for_selected_projects` - `api_call_logging_project_ids` string — The list of project ids if api_call_logging is set to `enabled_for_selected_projects` - `project.created` object — The details for events with this `type`. - `id` string — The project ID. - `data` object — The payload used to create the project. - `name` string — The project name. - `title` string — The title of the project as seen on the dashboard. - `project.updated` object — The details for events with this `type`. - `id` string — The project ID. - `changes_requested` object — The payload used to update the project. - `title` string — The title of the project as seen on the dashboard. - `project.archived` object — The details for events with this `type`. - `id` string — The project ID. - `project.deleted` object — The details for events with this `type`. - `id` string — The project ID. - `rate_limit.updated` object — The details for events with this `type`. - `id` string — The rate limit ID - `changes_requested` object — The payload used to update the rate limits. - `max_requests_per_1_minute` integer — The maximum requests per minute. - `max_tokens_per_1_minute` integer — The maximum tokens per minute. - `max_images_per_1_minute` integer — The maximum images per minute. Only relevant for certain models. - `max_audio_megabytes_per_1_minute` integer — The maximum audio megabytes per minute. Only relevant for certain models. - `max_requests_per_1_day` integer — The maximum requests per day. Only relevant for certain models. - `batch_1_day_max_input_tokens` integer — The maximum batch input tokens per day. Only relevant for certain models. - `rate_limit.deleted` object — The details for events with this `type`. - `id` string — The rate limit ID - `role.created` object — The details for events with this `type`. - `id` string — The role ID. - `role_name` string — The name of the role. - `permissions` string[] — The permissions granted by the role. - `resource_type` string — The type of resource the role belongs to. - `resource_id` string — The resource the role is scoped to. - `role.updated` object — The details for events with this `type`. - `id` string — The role ID. - `changes_requested` object — The payload used to update the role. - `role_name` string — The updated role name, when provided. - `resource_id` string — The resource the role is scoped to. - `resource_type` string — The type of resource the role belongs to. - `permissions_added` string[] — The permissions added to the role. - `permissions_removed` string[] — The permissions removed from the role. - `description` string — The updated role description, when provided. - `metadata` object — Additional metadata stored on the role. - `role.deleted` object — The details for events with this `type`. - `id` string — The role ID. - `role.assignment.created` object — The details for events with this `type`. - `id` string — The identifier of the role assignment. - `principal_id` string — The principal (user or group) that received the role. - `principal_type` string — The type of principal (user or group) that received the role. - `resource_id` string — The resource the role assignment is scoped to. - `resource_type` string — The type of resource the role assignment is scoped to. - `role.assignment.deleted` object — The details for events with this `type`. - `id` string — The identifier of the role assignment. - `principal_id` string — The principal (user or group) that had the role removed. - `principal_type` string — The type of principal (user or group) that had the role removed. - `resource_id` string — The resource the role assignment was scoped to. - `resource_type` string — The type of resource the role assignment was scoped to. - `role.bound_to_resource` object — The details for events with this `type`. - `id` string — The ID of the resource the role was bound to. ChatGPT workspace connector resources use `__`. - `role_id` string — The ID of the role that was bound to the resource. - `resource_id` string — The ID of the resource the role was bound to. - `resource_type` string — The type of resource the role was bound to. - `permissions` string[] — The permissions granted to the role for the resource. - `workspace_id` string — The workspace ID for a ChatGPT workspace connector resource. - `connector_id` string — The connector ID for a ChatGPT workspace connector resource. - `connector_name` string — The connector display name for a ChatGPT workspace connector resource, or the connector ID when the display name could not be resolved. - `enabled` boolean — Whether the connector is enabled for the role. - `source` 'role_toggle' | 'role_connector_update' | 'role_delete' | 'workspace_permissions' | 'connector_publish' — The connector role mutation path that produced the event. - `role.unbound_from_resource` object — The details for events with this `type`. - `id` string — The ID of the resource the role was unbound from. ChatGPT workspace connector resources use `__`. - `role_id` string — The ID of the role that was unbound from the resource. - `resource_id` string — The ID of the resource the role was unbound from. - `resource_type` string — The type of resource the role was unbound from. - `permissions` string[] — The permissions remaining for the role after the change. - `workspace_id` string — The workspace ID for a ChatGPT workspace connector resource. - `connector_id` string — The connector ID for a ChatGPT workspace connector resource. - `connector_name` string — The connector display name for a ChatGPT workspace connector resource, or the connector ID when the display name could not be resolved. - `enabled` boolean — Whether the connector is enabled for the role. - `source` 'role_toggle' | 'role_connector_update' | 'role_delete' | 'workspace_permissions' | 'connector_publish' — The connector role mutation path that produced the event. - `service_account.created` object — The details for events with this `type`. - `id` string — The service account ID. - `data` object — The payload used to create the service account. - `role` string — The role of the service account. Is either `owner` or `member`. - `service_account.updated` object — The details for events with this `type`. - `id` string — The service account ID. - `changes_requested` object — The payload used to updated the service account. - `role` string — The role of the service account. Is either `owner` or `member`. - `service_account.deleted` object — The details for events with this `type`. - `id` string — The service account ID. - `workload_identity_provider.created` object — The details for events with this `type`. - `id` string — The workload identity provider ID. - `data` object — The payload used to create the workload identity provider. - `workload_identity_provider.updated` object — The details for events with this `type`. - `id` string — The workload identity provider ID. - `changes_requested` object — The payload used to update the workload identity provider. - `workload_identity_provider.deleted` object — The details for events with this `type`. - `id` string — The workload identity provider ID. - `name` string — The workload identity provider name. - `workload_identity_provider_mapping.created` object — The details for events with this `type`. - `id` string — The workload identity provider mapping ID. - `identity_provider_id` string — The workload identity provider ID. - `data` object — The payload used to create the workload identity provider mapping. - `workload_identity_provider_mapping.updated` object — The details for events with this `type`. - `id` string — The workload identity provider mapping ID. - `identity_provider_id` string — The workload identity provider ID. - `changes_requested` object — The payload used to update the workload identity provider mapping. - `workload_identity_provider_mapping.deleted` object — The details for events with this `type`. - `id` string — The workload identity provider mapping ID. - `identity_provider_id` string — The workload identity provider ID. - `project_id` string — The project ID. - `service_account_id` string — The mapped service account ID. - `user.added` object — The details for events with this `type`. - `id` string — The user ID. - `data` object — The payload used to add the user to the project. - `role` string — The role of the user. Is either `owner` or `member`. - `user.updated` object — The details for events with this `type`. - `id` string — The project ID. - `changes_requested` object — The payload used to update the user. - `role` string — The role of the user. Is either `owner` or `member`. - `user.deleted` object — The details for events with this `type`. - `id` string — The user ID. - `certificate.created` object — The details for events with this `type`. - `id` string — The certificate ID. - `name` string — The name of the certificate. - `certificate.updated` object — The details for events with this `type`. - `id` string — The certificate ID. - `name` string — The name of the certificate. - `certificate.deleted` object — The details for events with this `type`. - `id` string — The certificate ID. - `name` string — The name of the certificate. - `certificate` string — The certificate content in PEM format. - `certificates.activated` object — The details for events with this `type`. - `certificates` object[] - `id` string — The certificate ID. - `name` string — The name of the certificate. - `certificates.deactivated` object — The details for events with this `type`. - `certificates` object[] - `id` string — The certificate ID. - `name` string — The name of the certificate. - `first_id` string, nullable - `last_id` string, nullable - `has_more` boolean, required --- [API](https://skmtc.net/openai/apis/openai-api.md) · [All operations](https://skmtc.net/openai/apis/openai-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/openai/openai-api/revisions/dcd35773a322/schema)