---
title: "Query audit log events"
method: GET
path: "/v2/auditLogs/events"
tags: ["Audit Logs"]
---

# Query audit log events

`GET /v2/auditLogs/events`

Retrieve paginated audit log events for a workspace or an organization.
Exactly one of workspaceId or organizationId must be provided.

Supports filtering by date range (Unix timestamps), multiple actions, multiple actor IDs, and target ID.
Any combination of filters can be applied together.

**Array parameters use comma-separated values:**
- Multiple actions: `?actions=billing.credits.consumed,dubbing.project.created`
- Multiple actors: `?actorIds=user-123,user-456`

Example queries:
- Latest events: `GET /v2/auditLogs/events?workspaceId=12345678-1234-1234-1234-123456789abc&limit=50`
- Filtered by action and date:
  `GET /v2/auditLogs/events?workspaceId=12345678-1234-1234-1234-123456789abc`
  `&actions=billing.credits.consumed&startDate=1704067200&endDate=1706745599`
- Multiple filters:
  `GET /v2/auditLogs/events?workspaceId=12345678-1234-1234-1234-123456789abc`
  `&actions=billing.credits.consumed,dubbing.project.created&actorIds=user-123,user-456`

This endpoint is rate-limited and usage is tracked against your API quota.

## Query parameters

- `workspaceId` string, uuid
- `organizationId` string, uuid
- `actions` string
- `actorIds` string
- `targetId` string
- `startDate` integer
- `endDate` integer
- `cursor` string
- `limit` integer

## Response `200`

Paginated list of audit events

- AuditLogsPageResponse — Paginated response for audit logs listing. Used for both INTERNAL and PUBLIC APIs INTERNAL API: POST /auditLogs/events PUBLIC API: POST /v2/auditLogs/events
  - `events` AuditLogEvent[], required — List of audit log events
    - `id` string, required
    - `action` string, required
    - `status` string, required
    - `actor` Actor, required — Actor (who performed the action) information.
      - `type` 'user' | 'system' | 'service', required — Types of actors that can perform actions. USER: A human user (authenticated via username/password, social login, or SAML SSO) SYSTEM: An automated system process (e.g., "billing_system", "moderation_system") SERVICE: An internal service (e.g., "rendering_service", "dubbing_service")
      - `id` string, required
      - `name` string, nullable
      - `email` string, nullable
    - `target` Target, required — Target (what was acted upon) information.
      - `type` 'workspace' | 'video' | 'user' | 'organization' | 'asset', required — Types of entities that can be acted upon. WORKSPACE: A workspace entity VIDEO: A video entity USER: A user entity (can be same as Actor in self-service actions like login/profile updates) ORGANIZATION: An organization entity ASSET: An asset entity (avatars, images, etc.)
      - `id` string, required
      - `name` string, nullable
    - `context` Context, required — Event context (workspace, organization, IP address).
      - `workspaceId` string, nullable
      - `organizationId` string, nullable
      - `ipAddress` string, nullable
    - `details` object, required
    - `metadata` Metadata, required — Event metadata (timestamps).
      - `createdAt` string, date-time, required
      - `processedAt` string, date-time, nullable
  - `nextCursor` string, nullable — Opaque cursor for fetching the next page. Pass as cursor parameter.
  - `hasMore` boolean, required — Whether there are more events to fetch

## Other responses

- `400` — Invalid query parameters
- `403` — Forbidden - Wrong API key or Public API access disabled
- `404` — Workspace or organization not found
- `429` — Rate limit exceeded
- `default` — Unexpected Server error

---

[API](https://skmtc.net/synthesia/apis/synthesia-api.md) · [All operations](https://skmtc.net/synthesia/apis/synthesia-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/synthesia/synthesia-api/versions/f0f34ae0591d/schema)