---
title: "List audit records"
method: GET
path: "/audit/records"
tags: ["Audit"]
---

# List audit records

`GET /audit/records`

List audit trail records matching provided query params or default criteria.

The returned records are sorted by the `execution_time` from newest to oldest.

See [`Cursor-based pagination`](https://developer.pagerduty.com/docs/rest-api-v2/pagination/) for instructions on how to paginate through the result set.

Only admins, account owners, or global API tokens on PagerDuty account [pricing plans](https://www.pagerduty.com/pricing) with the "Audit Trail" feature can access this endpoint.

For other role based access to audit records by resource ID, see the resource's API documentation.

For more information see the [Audit API Document](https://developer.pagerduty.com/docs/rest-api-v2/audit-records-api/).

Scoped OAuth requires: `audit_records.read`

## Query parameters

- `limit` integer
- `cursor` string
- `since` string, date-time
- `until` string, date-time
- `root_resource_types[]` 'users' | 'teams' | 'schedules' | 'escalation_policies' | 'services' | 'ip_allow_lists'
- `actor_type` 'user_reference' | 'api_key_reference' | 'app_reference'
- `actor_id` string
- `method_type` 'browser' | 'oauth' | 'api_token' | 'identity_provider' | 'other' — Describes the method used to perform the action: `browser` -- authenticated user session. Session value is not returned in the `truncated_token` field. `oauth` -- access token obtained via the OAuth flow. Truncated token value is returned in the `truncated_token` field. `api_token` -- Pagerduty API token. Truncated token value is returned in the `truncated_token` field. `identity_provider` -- action performed by an Identity provider on behalf of a user. No value is returned in the `truncated_token` field. `other` -- Method that does not fall in the predefined categories. Truncated token value MAY be returned in the `truncated_token` field.
- `method_truncated_token` string
- `actions[]` 'create' | 'update' | 'delete' — The action executed on the aggregate

## Headers

- `Accept` string, required
- `Content-Type` 'application/json', required

## Response `200`

Records matching the query criteria.

- AuditRecordResponseSchema
  - `records` AuditRecord[], required — unresolved $ref
  - `response_metadata` AuditMetadata
    - `messages` string[], nullable
  - `limit` integer, required — The minimum of the `limit` parameter used in the request or the maximum request size of the API.
  - `next_cursor` string, nullable, required — An opaque string than will deliver the next set of results when provided as the `cursor` parameter in a subsequent request. A `null` value for this field indicates that there are no additional results.

## Other responses

- `400` — Caller provided invalid arguments. Please review the response for error details. Retrying with the same arguments will *not* work.
- `401` — Caller did not supply credentials or did not provide the correct credentials. If you are using an API key, it may be invalid or your Authorization header may be malformed.
- `402` — Account does not have the abilities to perform the action. Please review the response for the required abilities. You can also use the [Abilities API](#resource_Abilities) to determine what features are available to your account.
- `403` — Caller is not authorized to view the requested resource. While your authentication is valid, the authenticated user or token does not have permission to perform this action.
- `404` — The requested resource was not found.
- `429` — Too many requests have been made, the rate limit has been reached.
- `500` — Internal Server Error the PagerDuty server experienced an error.

---

[API](https://skmtc.net/pagerduty/apis/rest-api.md) · [All operations](https://skmtc.net/pagerduty/apis/rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pagerduty/rest-api/revisions/b679a8f3f02c/schema)