---
title: "Get Audit Logs"
method: GET
path: "/api/audit/logs"
tags: ["Unified API"]
---

# Get Audit Logs

`GET /api/audit/logs`

## Request

- Base URL: `https://api.agentstack.tech` (the document declares no server; this is the origin it was published from)
- URL: `https://api.agentstack.tech/api/audit/logs`
- Auth: one of:
  - API key in header `X-API-Key`
  - HTTP bearer

Get audit logs - permission-based access with full filtering support.

Policy: Access is governed by permission_service.check_project_access (read).
Ecosystem owners may filter by any project they have read access to.
Non-ecosystem users may only see audit logs for their own project;
project_id query parameter is ignored for them and replaced with their context project.

## Query parameters

- `page` integer: Page number
- `limit` integer: Limit results
- `offset` integer, nullable: Offset for pagination (alternative to page)
- `project_id` integer, nullable: Filter by project ID
- `user_id` integer, nullable: Filter by user ID
- `start_date` string, nullable: Start date (ISO format)
- `end_date` string, nullable: End date (ISO format)
- `action` string, nullable: Filter by action
- `resource_type` string, nullable: Filter by resource type
- `status` string, nullable: Filter by status (success/failure/warning)
- `search` string, nullable: Search in logs
- `sort_by` string, nullable: Sort field
- `sort_order` string, nullable: Sort order (asc/desc)

## Response `200`

Successful Response

- unknown

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `409`: Conflict
- `422`: Validation Error
- `429`: Too Many Requests
- `500`: Internal Server Error

---

[API](https://skmtc.dev/agentstack/apis/agentstack-core-api.md) · [All operations](https://skmtc.dev/agentstack/apis/agentstack-core-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentstack/apis/agentstack-core-api/revisions/79f4a4dd8813?raw)