---
title: "Search audit log events (Advanced)"
method: POST
path: "/v2/auditLogs/events/search"
tags: ["Audit Logs"]
---

# Search audit log events (Advanced)

`POST /v2/auditLogs/events/search`

Advanced search endpoint for audit log events with complex filter criteria.

**For most use cases, use GET /v2/auditLogs/events instead.**

Use this endpoint when:
- Filtering by 50+ actions or actors
- Complex query logic (future enhancement)
- Programmatic access requiring JSON request bodies

Exactly one of workspaceId or organizationId must be provided.
Supports filtering by date range (Unix timestamps), multiple actions, multiple actor IDs, and target ID.
Any combination of filters can be applied together.

Example request body for January 2024 user login events:
{
  "workspaceId": "12345678-1234-1234-1234-123456789abc",
  "actions": ["user.authentication.login"],
  "startDate": 1704067200,
  "endDate": 1706745599
}

This endpoint is rate-limited and usage is tracked against your API quota.

## Request body

- AuditLogsQueryRequest
  - `workspaceId` string, uuid, nullable
  - `organizationId` string, uuid, nullable
  - `startDate` integer, nullable
  - `endDate` integer, nullable
  - `actions` string[], nullable
  - `actorIds` string[], nullable
  - `targetId` string, nullable
  - `cursor` string, nullable
  - `limit` integer

## Response `200`

Paginated list of audit events

- AuditLogsPageResponse — Paginated response for audit logs listing. Used for both INTERNAL and PUBLIC APIs INTERNAL API: POST /auditLogs/events PUBLIC API: POST /v2/auditLogs/events
  - `events` AuditLogEvent[], required — List of audit log events
    - `id` string, required
    - `action` string, required
    - `status` string, required
    - `actor` Actor, required — Actor (who performed the action) information.
      - `type` 'user' | 'system' | 'service', required — Types of actors that can perform actions. USER: A human user (authenticated via username/password, social login, or SAML SSO) SYSTEM: An automated system process (e.g., "billing_system", "moderation_system") SERVICE: An internal service (e.g., "rendering_service", "dubbing_service")
      - `id` string, required
      - `name` string, nullable
      - `email` string, nullable
    - `target` Target, required — Target (what was acted upon) information.
      - `type` 'workspace' | 'video' | 'user' | 'organization' | 'asset', required — Types of entities that can be acted upon. WORKSPACE: A workspace entity VIDEO: A video entity USER: A user entity (can be same as Actor in self-service actions like login/profile updates) ORGANIZATION: An organization entity ASSET: An asset entity (avatars, images, etc.)
      - `id` string, required
      - `name` string, nullable
    - `context` Context, required — Event context (workspace, organization, IP address).
      - `workspaceId` string, nullable
      - `organizationId` string, nullable
      - `ipAddress` string, nullable
    - `details` object, required
    - `metadata` Metadata, required — Event metadata (timestamps).
      - `createdAt` string, date-time, required
      - `processedAt` string, date-time, nullable
  - `nextCursor` string, nullable — Opaque cursor for fetching the next page. Pass as cursor parameter.
  - `hasMore` boolean, required — Whether there are more events to fetch

## Other responses

- `400` — Invalid query parameters
- `403` — Forbidden - Wrong API key or Public API access disabled
- `404` — Workspace or organization not found
- `429` — Rate limit exceeded
- `default` — Unexpected Server error

---

[API](https://skmtc.net/synthesia/apis/synthesia-api.md) · [All operations](https://skmtc.net/synthesia/apis/synthesia-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/synthesia/synthesia-api/revisions/f0f34ae0591d/schema)