---
title: "Get Audit Logs"
method: GET
path: "/core/v1/audit_log"
tags: ["Audit Log"]
---

# Get Audit Logs

`GET /core/v1/audit_log`

Returns audit logs for an organization within a specified time range.

All audit logs include a timestamp in ISO 8601 date time format, user info, IP address, event info and device inf.

## Query parameters

- `start_time` integer — The start of time range for requested audit logs. Formatted as a Unix timestamp in seconds. Defaults to an hour from the current time.
- `end_time` integer — The end of time range for requested audit logs. Formatted as a Unix timestamp in seconds. Defaults to the current time.
- `use_processed_timestamp` boolean — Whether to return audit logs where `processed_timestamp` is between `start_time` and `end_time` instead of `timestamp`. Useful when polling for new audit logs on a regular cadence to ensure logs that had not finished processing during an earlier polling window are still eventually captured. Note that audit logs where `timestamp` is before 2025-08-12 do not support this feature.
- `page_token` string — The pagination token used to fetch the next page of results.
- `page_size` integer — The number of items returned in a single response. Default is 100. Max is 200.

## Response `200`

OK

- AuditLogResponseV1
  - `audit_logs` AuditLogResponseItem[] — A list of audit logs.
    - `details` object — The details of the audit log entry.
    - `devices` AuditLogDeviceDetails[] — The list of devices associated with the audit log entry.
      - `details` object — The device details for the audit log item.
      - `device_id` string — The unique identifier of a device.
      - `device_name` string — The name of the device.
      - `device_site_name` string — The site name of the device.
      - `device_type` string — The type of the device type, e.g., camera.
    - `event_description` string — The description of the event.
    - `event_name` string — The name of the event.
    - `ip_address` string — The IP address of the user.
    - `organization_id` string, uuid — The unique identifier of the organization.
    - `processed_timestamp` string — The timestamp when the audit log entry had finished processing and became available to retrieve via API. Formatted in ISO 8601 date time format.
    - `timestamp` string — The timestamp when the action identified by the audit log entry occurred. Formatted in ISO 8601 date time format.
    - `user_email` string — The email of the user.
    - `user_id` string, uuid — The unique identifier of the user for the audit log entry.
    - `user_name` string — The user name for the audit log entry.
    - `verkada_support_id` string — The unique identifier used by Verkada support.
  - `next_page_token` string — The pagination token used to fetch the next page of results.

---

[API](https://skmtc.net/verkada/apis/api-tokens.md) · [All operations](https://skmtc.net/verkada/apis/api-tokens/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/verkada/api-tokens/revisions/4a79d2d949a6/schema)