---
title: "Search audit logs with filters"
method: POST
path: "/audit-logs/search"
tags: ["audit_logs"]
---

# Search audit logs with filters

`POST /audit-logs/search`

Returns a filtered, paginated list of audit log entries for the organization.
Filterable fields and their allowed operators:

 Field | Allowed operators |
 --- | --- |
 `action` | `equals`, `in`, `not_in`, `string_contains`, `string_does_not_contain` |
 `action_happened_at` | `time_is_after`, `time_is_before`, `time_range` |

Timestamp values use RFC3339 format.

**Rate limit:** 10 requests per minute

## Request body

- SearchAuditLogsRequest
  - `cursor` string — The cursor to use for pagination.
  - `filter` Filter
    - `field` string, required — The field for this filter. For allowed fields, see the documentation for the specific endpoint you are using. For non-compound filters (any operators other than "and" or "or"), Field must be set, along with either Value or Values, depending on the operator.
    - `operator` 'equals' | 'not_equals' | 'contains' | 'does_not_contain' | 'in' | 'not_in' | 'and' | 'or' | 'time_is_after' | 'time_is_before' | 'time_range' | 'string_contains' | 'string_does_not_contain' | 'is_set' | 'is_unset' | 'greater_than' | 'less_than' | 'greater_than_or_equals' | 'less_than_or_equals', required — The operator for this filter.
    - `subfilters` Filter[] — Sub-filters for this filter. Valid only when operator is "and" or "or". The maximum allowed depth for a tree of filters is 3.
    - `value` string — The value for this filter. Only used for single-valued operators ("equals", "not_equals", "contains", "does_not_contain")
    - `values` string[] — The values for this filter. Only used for multi-valued operators ("in", "not_in").
  - `limit` integer — The number of audit logs to fetch. Defaults to 100. Must be greater than 0 and less than 1000.

## Response `200`

- GetAuditLogsResponseBody
  - `data` AuditLog[] — The data payload of the response.
    - `action` string — The action that was performed.
    - `action_happened_at` string — The time at which the action happened.
    - `actor_contact_id` string — The ID of the contact who performed the action, if applicable.
    - `actor_user_id` string — The ID of the user who performed the action, if applicable.
    - `attributes` object — Key-value attributes associated with the audit log.
    - `created_at` string — The time at which the audit log was created.
    - `id` string — The ID of the audit log.
    - `link` string — The link associated with the audit log, if applicable.
    - `metadata` object — Additional metadata associated with the audit log. The structure varies based on the action type.
    - `object_id` string — The ID of the object that the audit log is for.
    - `object_type` string — The type of object that the audit log is for.
    - `source` string — The source of the audit log.
  - `pagination` Pagination
    - `cursor` string, required — The cursor for the next page of results.
    - `has_next_page` boolean, required — Indicates if there is a next page of results.
  - `request_id` string — The request ID for tracking.

## Other responses

- `400` — The request was invalid or could not be completed.
- `403` — The authenticated caller or organization is not allowed to access this endpoint or operation.
- `500` — An unexpected internal error occurred.

---

[API](https://skmtc.net/usepylon/apis/pylon-api.md) · [All operations](https://skmtc.net/usepylon/apis/pylon-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/usepylon/pylon-api/revisions/cfd9e65e79bb/schema)