---
title: "Search audit logs with filters"
method: POST
path: "/audit-logs/search"
tags: ["audit_logs"]
---

# Search audit logs with filters

`POST /audit-logs/search`

Returns a filtered, paginated list of audit log entries for the organization.

Currently, the following fields are filterable for audit logs:

* action. Allowed operators: `equals`, `in`, `not_in`, `string_contains`, `string_does_not_contain`

* action_happened_at (in RFC3339 format). Allowed operators: `time_is_after`, `time_is_before`, `time_range`

**Rate limit:** 10 requests per minute

## Request body

- SearchAuditLogsRequest
  - `cursor` string — The cursor to use for pagination.
  - `filter` Filter
    - `field` string, required — The field for this filter. For allowed fields, see the documentation for the specific endpoint you are using. For non-compound filters (any operators other than "and" or "or"), Field must be set, along with either Value or Values, depending on the operator.
    - `operator` 'equals' | 'not_equals' | 'contains' | 'does_not_contain' | 'in' | 'not_in' | 'and' | 'or' | 'time_is_after' | 'time_is_before' | 'time_range' | 'string_contains' | 'string_does_not_contain' | 'is_set' | 'is_unset' | 'greater_than' | 'less_than' | 'greater_than_or_equals' | 'less_than_or_equals', required — The operator for this filter. `equals`: Matches objects that are exactly equal to the value in the field. `not_equals`: Matches objects that are not exactly equal to the value in the field. `contains`: For a multi-valued field, such as tags, this operator will match objects that contain any of the values in the field. `does_not_contain`: For a multi-valued field, such as tags, this operator will match objects that do not contain any of the values in the field. `in`: Matches objects if the field is one of several possible values, as specified in the values array. `not_in`: Matches objects if the field is none of several possible values, as specified in the values array. `and`: Matches objects only if all subfilters match. `or`: Matches objects if any subfilter matches. `time_is_after`: Matches objects if the field is after the given time. `time_is_before`: Matches objects if the field is before the given time. `time_range`: Matches objects if the field is between the given times. `string_contains`: Matches objects if the field contains the given string. `string_does_not_contain`: Matches objects if the field does not contain the given string. `is_set`: Matches objects if the field is set. `is_unset`: Matches objects if the field is unset. `greater_than`: Matches objects if the numeric field is greater than the given value. `less_than`: Matches objects if the numeric field is less than the given value. `greater_than_or_equals`: Matches objects if the numeric field is greater than or equal to the given value. `less_than_or_equals`: Matches objects if the numeric field is less than or equal to the given value.
    - `subfilters` Filter[] — Sub-filters for this filter. Valid only when operator is "and" or "or". The maximum allowed depth for a tree of filters is 3.
    - `value` string — The value for this filter. Only used for single-valued operators ("equals", "not_equals", "contains", "does_not_contain")
    - `values` string[] — The values for this filter. Only used for multi-valued operators ("in", "not_in").
  - `limit` integer — The number of audit logs to fetch. Defaults to 100. Must be greater than 0 and less than 1000.

## Response `200`

- GetAuditLogsResponseBody
  - `data` AuditLog[] — The data payload of the response.
    - `action` string — The action that was performed.
    - `action_happened_at` string — The time at which the action happened.
    - `actor_contact_id` string — The ID of the contact who performed the action, if applicable.
    - `actor_user_id` string — The ID of the user who performed the action, if applicable.
    - `attributes` object — Key-value attributes associated with the audit log.
    - `created_at` string — The time at which the audit log was created.
    - `id` string — The ID of the audit log.
    - `link` string — The link associated with the audit log, if applicable.
    - `metadata` object — Additional metadata associated with the audit log. The structure varies based on the action type.
    - `object_id` string — The ID of the object that the audit log is for.
    - `object_type` string — The type of object that the audit log is for.
    - `source` string — The source of the audit log.
  - `pagination` Pagination
    - `cursor` string, required — The cursor for the next page of results.
    - `has_next_page` boolean, required — Indicates if there is a next page of results.
  - `request_id` string — The request ID for tracking.

## Other responses

- `400` — The request was invalid or could not be completed.
- `403` — The authenticated caller or organization is not allowed to access this endpoint or operation.
- `500` — An unexpected internal error occurred.

---

[API](https://skmtc.net/usepylon/apis/pylon-api.md) · [All operations](https://skmtc.net/usepylon/apis/pylon-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/usepylon/pylon-api/versions/484a11d5ddb2/schema)