---
title: "Search Change Logs"
method: GET
path: "/users/change-logs"
---

# Search Change Logs

`GET /users/change-logs`

Search the user-management change log (audit trail).

Covers ``invite_sent``, ``invite_accepted``, ``role_granted``,
``role_revoked``, and ``archive`` events.

**Query parameters** (all optional):

| Parameter | Description |
|-----------|-------------|
| ``user_uuid`` | Filter by the user (or invite) UUID that was changed. |
| ``organization_id`` | Scope to this org. Defaults to the caller's org. Cross-org queries require platform-admin. |
| ``actor_user_id`` | Filter by the user who made the change. Cross-org user filters require platform-admin. |
| ``last_id`` | Cursor for pagination — only return records with id less than this. |
| ``limit`` | Maximum records to return (default 100, max 100). |

Results are ordered by ``id`` descending (newest first).

**Permissions**: org admin (own org) or platform admin (any org).

## Query parameters

- `user_uuid` string, nullable
- `organization_id` string, nullable
- `actor_user_id` string, nullable
- `last_id` integer, nullable
- `limit` integer

## Response `200`

Successful Response

- SearchChangesResponse — Paginated audit log results for the authenticated organization.
  - `changes` ChangeResponse[], required — List of change records ordered by id descending (newest first).
    - `id` integer, required — Auto-incrementing ID. Use as the cursor value for last_id on the next page.
    - `change_type` 'integrations' | 'unknown' | 'api_keys' | 'users' | 'auth' | 'slack_channel_enrollments' | 'sessions' | 'user_agent_instructions' | 'resident_agent_templates' | 'webhook_connections', required
    - `change_action` 'create' | 'update' | 'delete' | 'unknown' | 'login' | 'logout' | 'invite_sent' | 'invite_accepted' | 'role_granted' | 'role_revoked' | 'archive', required
    - `organization_id` string, nullable, required — UUID of the organization the changed object belongs to.
    - `user_id` string, nullable, required — UUID of the user who triggered the change, if known.
    - `object_id` string, nullable, required — UUID of the specific object that was changed.
    - `change` object, required — Structured payload describing what changed. For creates and deletes this is a full snapshot of the object. For updates this is a map of field names to {old, new} diffs.
    - `time` string, date-time, required — Timestamp of when the change was recorded (timezone-aware).
    - `user_name` string, required — Email of the user who made the change, or 'DELETED OR UNKNOWN USER' if the user no longer exists or was not set.
    - `organization_name` string, required — Display name of the organization, or 'DELETED OR UNKNOWN ORGANIZATION' if it no longer exists or was not set.

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/traversal/apis/fastapi.md) · [All operations](https://skmtc.net/traversal/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/traversal/fastapi/revisions/2134ebffd1ef/schema)