---
title: "Query the token API audit log"
method: GET
path: "/api/admin/audit"
tags: ["Token (Admin)"]
---

# Query the token API audit log

`GET /api/admin/audit`

Returns paginated audit log entries for scoped token API usage. Supports
filtering by user, token_id, path, method, status, and time range.
Requires admin (sudo) privileges.

## Query parameters

- `user` string
- `token_id` integer
- `path` string
- `method` 'GET' | 'POST' | 'PUT' | 'DELETE'
- `status` 'success' | 'denied' | 'error'
- `from` string, date-time
- `to` string, date-time
- `limit` integer
- `offset` integer

## Headers

- `X-EDH-USER` string, required
- `X-EDH-TOKEN` string, required

## Response `200`

Audit log entries retrieved successfully

- object
  - `success` boolean
  - `message` object
    - `total` integer — Total number of matching entries
    - `entries` object[]
      - `id` integer
      - `timestamp` string, date-time
      - `user` string
      - `token_id` integer, nullable
      - `token_name` string, nullable
      - `token_type` string
      - `method` string
      - `path` string
      - `status_code` integer
      - `ip` string
      - `user_agent` string, nullable
      - `duration_ms` integer, nullable
      - `denied_reason` string, nullable

## Other responses

- `401` — Not authorized (requires admin privileges)

---

[API](https://skmtc.dev/aws-samples/apis/engineering-development-hub-edh-api.md) · [All operations](https://skmtc.dev/aws-samples/apis/engineering-development-hub-edh-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/aws-samples/engineering-development-hub-edh-api/revisions/058396b8f0f1/schema)