---
title: "List audit logs with filters"
method: POST
path: "/api/v1/audit-logs/list"
tags: ["auditLogs"]
---

# List audit logs with filters

`POST /api/v1/audit-logs/list`

List audit logs with structured filters for actor, module, and event type
### Filtering

Use the `filters` field to narrow results. Pass an empty array or omit the field to retrieve all records.

Each filter object has the following fields:

| Field | Type | Description |
|---|---|---|
| `attribute` | string | The field to filter on (see Supported attributes below) |
| `operator` | string | Comparison operator (see Available operators below) |
| `values` | array | One or more `{ "value": <scalar> }` objects |

**Supported attributes**

| Attribute | Typical operator | Description |
|---|---|---|
| `event_at` | `IS_BETWEEN` | Event timestamp. Requires exactly **two** values: `[start, end]` (both inclusive). Accepts ISO 8601 (`2024-01-01T00:00:00Z`) or date-only (`2024-01-01` — end date is automatically extended to `T23:59:59Z`). On export, defaults to the last 6 months if omitted. |
| `actor_id` | `IS_ANY_OF` | Numeric user ID of the person who performed the action (the `id` field from `GET /api/v1/users`). |
| `module` | `IS_ANY_OF` | Module **integer ID** (not the name). See the Module IDs reference table below. |
| `event_type` | `IS_ANY_OF` | Event type **integer ID** (not the name). See the Event Type IDs reference table below. Not every event type is valid for every module — unsupported combinations return zero results. |

**Available operators**

| Operator | Meaning |
|---|---|
| `EQUALS` | Exact match |
| `NOT_EQUALS` | Exclude exact match |
| `IN` / `IS_ANY_OF` | Match any value in the list |
| `IS_NOT_ANY_OF` | Exclude all listed values |
| `IS_BETWEEN` | Inclusive range — pass exactly two values: `[start, end]` |
| `IS_ON_OR_BEFORE` / `IS_ON_OR_AFTER` | Date/time boundary comparisons |
| `CONTAINS` / `TEXT_CONTAINS` | Substring or set membership |
| `IS_NULL` / `IS_NOT_NULL` | Null checks — `values` array can be empty |
| `STARTS_WITH` / `ENDS_WITH` | String prefix/suffix match |


**Module IDs** (use with `attribute: "module"`)

| ID | Module | What it covers |
|---|---|---|
| `0` | APPS | Third-party app connections (connect / disconnect / update) |
| `1` | USERS | User creation and profile updates |
| `2` | WORKFLOWS | Automation workflow changes |
| `3` | SERVICE_CATALOG | Service catalog items |
| `4` | SECURITY | Login, logout, API key creation / deletion |
| `5` | SKILL | AI skill changes |
| `6` | WORKSPACES | Workspace settings changes |
| `7` | TENANT_MIGRATION | Sandbox import / export |
| `8` | AGENT_GROUPS | Agent group changes |
| `9` | ACCESS_MANAGEMENT | Role and access control changes |
| `10` | AI_AGENTS | AI agent changes |
| `11` | AGENT_AVAILABILITY | Agent availability updates |
| `12` | CUSTOM_OBJECTS | Custom object type changes |

**Event Type IDs** (use with `attribute: "event_type"`)

| ID | Event Type |
|---|---|
| `0` | CONNECTED |
| `1` | DISCONNECTED |
| `2` | CREATED |
| `3` | UPDATED |
| `4` | ENABLED |
| `5` | DISABLED |
| `6` | DELETED |
| `7` | IMPORT |
| `8` | EXPORT |
| `9` | RESTORED |
| `10` | LOGIN |
| `12` | LOGOUT |

**Module → valid event types**

| Module | Valid event type IDs |
|---|---|
| APPS (0) | 0 (CONNECTED), 1 (DISCONNECTED), 3 (UPDATED) |
| USERS (1) | 2 (CREATED), 3 (UPDATED) |
| WORKFLOWS (2) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |
| SERVICE_CATALOG (3) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |
| SECURITY (4) | 2 (CREATED), 6 (DELETED), 10 (LOGIN), 12 (LOGOUT) |
| SKILL (5) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |
| WORKSPACES (6) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |
| TENANT_MIGRATION (7) | 7 (IMPORT), 8 (EXPORT) |
| AGENT_GROUPS (8) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |
| ACCESS_MANAGEMENT (9) | 2 (CREATED), 3 (UPDATED), 6 (DELETED), 9 (RESTORED) |
| AI_AGENTS (10) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |
| AGENT_AVAILABILITY (11) | 3 (UPDATED) |
| CUSTOM_OBJECTS (12) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) |


**Example**

```json
[
  {
    "attribute": "event_at",
    "operator": "IS_BETWEEN",
    "values": [
      {
        "value": "2024-01-01T00:00:00Z"
      },
      {
        "value": "2024-12-31T23:59:59Z"
      }
    ]
  },
  {
    "attribute": "module",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 1
      },
      {
        "value": 9
      }
    ]
  },
  {
    "attribute": "event_type",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 2
      },
      {
        "value": 3
      }
    ]
  },
  {
    "attribute": "actor_id",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 123
      }
    ]
  }
]
```

## Headers

- `X-Api-Key` string, required
- `X-Workspace-Id` string

## Request body

- object
  - `search_key` string
  - `page` integer
  - `per_page` integer
  - `next_page_token` string
  - `filters` ApiV1AuditLogsListPostRequestBodyContentApplicationJsonSchemaFiltersItems[]
    - `attribute` string
    - `operator` 'LIKE' | 'EQUALS' | 'IN' | 'NOT_EQUALS' | 'IS_BETWEEN' | 'IS_ANY_OF' | 'IS_NOT_ANY_OF'
    - `values` ApiV1AuditLogsListPostRequestBodyContentApplicationJsonSchemaFiltersItemsValuesItems[]
      - `value` ApiV1AuditLogsListPostRequestBodyContentApplicationJsonSchemaFiltersItemsValuesItemsValue
      - `nested_filter` unknown
  - `sort_order` 'EVENT_AT_DESC' | 'EVENT_AT_ASC'

## Response `200`

Successful response

- AuditLogsPostapiV1AuditLogsListResponse200 — Empty response body

## Changes

- **2026-08-22** `6223f7496274` — 3 warning
  - the `per_page` request property's max was set to `100.00`
  - the `page` request property's min was set to `1.00`
  - the `per_page` request property's min was set to `10.00`
- **2026-08-12** `2ab1cf36239b` — 1 info
  - api operation id `postapi-v-1-audit-logs-list` removed and replaced with `postapi_v1_audit_logs_list`

[Change history](https://skmtc.dev/atomicwork/apis/atomicwork-public-api/changes/api/v1/audit-logs/list/post.md)

---

[API](https://skmtc.dev/atomicwork/apis/atomicwork-public-api.md) · [All operations](https://skmtc.dev/atomicwork/apis/atomicwork-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/atomicwork/atomicwork-public-api/revisions/6223f7496274/schema)