---
title: "List events in audit log"
method: GET
path: "/v0/audit-log/events"
tags: ["Events in the audit log"]
---

# List events in audit log

`GET /v0/audit-log/events`

List events in audit log

## Query parameters

- `created_at[gte]` string, date-time, nullable — Inclusive start datetime filter for time of event creation, in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z'). Only events at or after this time will be returned.
- `created_at[lt]` string, date-time, nullable — Exclusive end datetime filter for time of event creation, in UTC using the ISO 8601 format (e.g., '2021-03-14T15:09:26Z'). Only events before this time will be returned.
- `limit` integer, nullable — The maximum number of entries to return. If the value exceeds the maximum, then the maximum value will be used
- `offset` integer, nullable — The (zero-based) offset of the first rules to return
- `type` string, nullable — Event type
- `user_ids` string[] — Filter by user IDs

## Response `200`

OK

- HandlersListEventsInAuditLogResponse
  - `count` integer, required — Count of results for this page
  - `events` HandlerTypesEventV0[], required — Events. Platform deployments have 7 day event retention, while Enterprise and Cloud have unlimited retention.
    - `additional_data` integer[] — Additional event data
    - `created_at` string, date-time, required — Event creation time
    - `created_by` HandlerTypesUser — User that created the event. Nil if system originated
      - `access_restricted` boolean — For inactive users only. Indicates the user cannot actually access due to permissions in parent org
      - `active` boolean — Whether or not the user is active/enabled (generally managed through SCIM)
      - `created_at` string, date-time, required — User creation time
      - `deleted_at` string, date-time, nullable — User deletion time
      - `email_address` string, email, required — Email address
      - `first_name` string, string, required — First name
      - `google_oauth_user_id` string — The user's Google user ID, if it exists'
      - `id` string, uuid, required — User ID
      - `is_enrolled` boolean — Whether the user has begun using the system (e.g. accepted an invitation or logged in at least once)
      - `last_name` string, string, required — Last name
      - `microsoft_oauth_user_id` string — The user's Microsoft user ID, if it exists'
      - `phone_number` string, nullable — Phone number
      - `role` string — Role assumed by the user
      - `service_account` string, nullable — The service account type (e.g., 'ade') if this is a service account
      - `updated_at` string, date-time, required — User last updated time
    - `data` HandlerTypesEventData, required — Event data
      - `message` TypesEventMessage — API request data, if originated from an API request
        - `id` string, uuid, required — Message ID
      - `message_group` TypesEventMessageGroup — Message group data, if originated from an API request taking an action on a message group
        - `id` string, uuid, required — Message Group ID
      - `request` TypesAPIRequest — API request data, if originated from an API request
        - `api_key_name` string, nullable — Name of API key if an API key was used
        - `authentication_method` string, nullable — Description of how request was authenticated
        - `body` string — Request body
        - `id` string, uuid, required — API request ID
        - `ip` string, nullable — IP address of requester, if available
        - `method` string, required — HTTP method
        - `path` string, required — URL path
        - `query` object — Query parameters
        - `user_agent` string — User agent of requester, if available
    - `id` string, uuid, required — Event ID
    - `type` string, required — Event type
  - `total` integer, required — Total number of results available

---

[API](https://skmtc.net/sublime/apis/sublime-platform-api.md) · [All operations](https://skmtc.net/sublime/apis/sublime-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sublime/sublime-platform-api/revisions/d5df82850357/schema)