---
title: "Search"
method: GET
path: "/changes-logs"
tags: ["changes-logs"]
---

# Search

`GET /changes-logs`

Search the audit log.

Permission rules:
- If organization_id is provided: caller must be an org admin in that org, or a platform admin.
- If user_id is provided (without organization_id): caller must be a platform admin.
- If neither is provided: scoped to the caller's own org; caller must be an org admin.

Results are ordered by id descending. Use last_id for cursor-based pagination.

## Query parameters

- `organization_id` string, nullable
- `user_id` string, nullable
- `change_type` 'integrations' | 'unknown' | 'api_keys' | 'users' | 'auth' | 'slack_channel_enrollments' | 'sessions' | 'user_agent_instructions' | 'resident_agent_templates' | 'webhook_connections'
- `change_action` 'create' | 'update' | 'delete' | 'unknown' | 'login' | 'logout' | 'invite_sent' | 'invite_accepted' | 'role_granted' | 'role_revoked' | 'archive'
- `object_id` string, nullable
- `last_id` integer, nullable
- `limit` integer

## Response `200`

Successful Response

- SearchChangesResponse — Paginated audit log results for the authenticated organization.
  - `changes` ChangeResponse[], required — List of change records ordered by id descending (newest first).
    - `id` integer, required — Auto-incrementing ID. Use as the cursor value for last_id on the next page.
    - `change_type` 'integrations' | 'unknown' | 'api_keys' | 'users' | 'auth' | 'slack_channel_enrollments' | 'sessions' | 'user_agent_instructions' | 'resident_agent_templates' | 'webhook_connections', required
    - `change_action` 'create' | 'update' | 'delete' | 'unknown' | 'login' | 'logout' | 'invite_sent' | 'invite_accepted' | 'role_granted' | 'role_revoked' | 'archive', required
    - `organization_id` string, nullable, required — UUID of the organization the changed object belongs to.
    - `user_id` string, nullable, required — UUID of the user who triggered the change, if known.
    - `object_id` string, nullable, required — UUID of the specific object that was changed.
    - `change` object, required — Structured payload describing what changed. For creates and deletes this is a full snapshot of the object. For updates this is a map of field names to {old, new} diffs.
    - `time` string, date-time, required — Timestamp of when the change was recorded (timezone-aware).
    - `user_name` string, required — Email of the user who made the change, or 'DELETED OR UNKNOWN USER' if the user no longer exists or was not set.
    - `organization_name` string, required — Display name of the organization, or 'DELETED OR UNKNOWN ORGANIZATION' if it no longer exists or was not set.

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/traversal/apis/fastapi.md) · [All operations](https://skmtc.net/traversal/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/traversal/fastapi/revisions/2134ebffd1ef/schema)