---
title: "Get Audit Logs"
method: GET
path: "/api/audit/entries"
tags: ["Audit Logs"]
---

# Get Audit Logs

`GET /api/audit/entries`

Retrieve audit logs as a cursor-paginated list. Results can be filtered by time range, event type,
and organization.

## Query parameters

- `after` string, date-time
- `before` string, date-time
- `types` string[]
- `organizationId` integer
- `limit` integer
- `cursor` string

## Response `200`

A page of audit log entries matching the query.

- AuditEntriesGetResponse
  - `entries` AuditLogEntry[] — The audit log entries on this page, in reverse chronological order. Entries sharing the same timestamp are never split across pages, so a page may contain more than `limit` entries.
    - `event` string — The audit event type (e.g. service.create, security.login).
    - `status` 'completed' | 'failed' — Whether the action completed successfully or failed.
    - `timestamp` string, date-time, nullable — When the event occurred (ISO 8601). May be null for entries without a recorded timestamp; such entries are only returned on the first page of results.
    - `cluster` string — The cluster or region where the event occurred.
    - `path` string — The API path that triggered the event.
    - `remoteAddr` string — The IP address of the client that performed the action.
    - `userAgent` string — The user agent of the client.
    - `user` string — The user or token that performed the action.
    - `details` object — Additional event-specific metadata.
  - `nextCursor` string, nullable — An opaque cursor pointing at the next page. Pass this value as the `cursor` parameter of the next request to fetch the following page. Absent or `null` on the last page.
  - `limit` integer — The effective page size limit applied to this response. May differ from the requested `limit` if the requested value was outside the allowed range.

## Other responses

- `400`
- `401`
- `403`
- `500`

## Changes

- **2026-08-03** `7ad74ab64749` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/authlete/apis/authlete-api/changes/api/audit/entries/get.md)

---

[API](https://skmtc.dev/authlete/apis/authlete-api.md) · [All operations](https://skmtc.dev/authlete/apis/authlete-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authlete/authlete-api/revisions/7ad74ab64749/schema)