---
title: "List audit log events"
method: GET
path: "/api/public/organizations/{orgId}/audit-logs"
tags: ["Organizations"]
---

# List audit log events

`GET /api/public/organizations/{orgId}/audit-logs`

## Request

- Base URL: `https://charts.basedash.com`
- URL: `https://charts.basedash.com/api/public/organizations/{orgId}/audit-logs`
- Auth: HTTP bearer

Returns immutable organization audit events in reverse chronological order for SIEM ingestion. Requires an Enterprise organization and an administrator API key.

## Path parameters

- `orgId` string, required: Organization ID

## Query parameters

- `limit` integer: Maximum number of items to return (1-100, default 50)
- `cursor` string: Cursor for pagination (ID of the last item from previous page)
- `action` 'user.login' | 'user.logout' | 'member.joined' | 'member.invited' | 'member.invite_revoked' | 'member.role_changed' | 'member.deactivated' | 'member.reactivated' | 'group.created' | 'group.updated' | 'group.deleted' | 'group.member_added' | 'group.member_removed' | 'group.login_token_synced' | 'grant.created' | 'grant.updated' | 'grant.deleted' | 'data_source.created' | 'data_source.updated' | 'data_source.deleted' | 'data_source.sync_requested' | 'data_source.schema_synced' | 'data_source.credentials_viewed' | 'catalog.description_updated' | 'api_key.created' | 'api_key.renamed' | 'api_key.revoked' | 'scim_token.created' | 'scim_token.deleted' | 'organization.created' | 'organization.updated' | 'organization.jwt_secret_viewed' | 'organization.jwt_secret_copied' | 'organization.billing_account_attached' | 'organization.billing_account_detached' | 'domain.created' | 'domain.updated' | 'domain.deleted' | 'dashboard.created' | 'dashboard.deleted' | 'dashboard.archived' | 'dashboard.restored' | 'dashboard.public_sharing_enabled' | 'dashboard.public_sharing_disabled' | 'dashboard.public_sharing_link_reset' | 'dashboard.verified' | 'dashboard.unverified' | 'automation.created' | 'automation.deleted' | 'automation.archived' | 'automation.restored' | 'automation.updated' | 'chart.query_saved' | 'chart.settings_saved' | 'subscription.created' | 'subscription.updated' | 'subscription.archived' | 'mcp_connector.created' | 'mcp_connector.updated' | 'mcp_connector.deleted' | 'mcp_connector.tool_access_updated' | 'public_api.request' | 'scim.user_created' | 'scim.user_updated' | 'scim.user_deactivated' | 'scim.group_created' | 'scim.group_updated' | 'scim.group_deleted' | 'query.executed' | 'query.mutating_executed' | 'query.staff_explained' | 'data.exported' | 'ai.tool_executed' | 'ai_context.global_updated' | 'ai_skill.created' | 'ai_skill.updated' | 'ai_skill.deleted' | 'model.created' | 'model.updated' | 'model.archived' | 'model.restored' | 'org_permission.updated' | 'org_permission.reset': Exact dot-namespaced action
- `actorId` string: Actor user ID
- `category` 'AUTHENTICATION' | 'MEMBERS' | 'ACCESS_CONTROL' | 'DATA_SOURCES' | 'QUERIES' | 'EXPORTS' | 'AI' | 'ORGANIZATION' | 'CONTENT' | 'INTEGRATIONS'
- `from` union: Inclusive lower timestamp or date boundary
  - string, date-time
  - string, date
- `search` string: Case-insensitive actor, action, target name, or target ID search
- `source` 'WEB' | 'PUBLIC_API' | 'SCIM' | 'SLACK' | 'MCP' | 'SYSTEM' | 'PUBLIC_DASHBOARD'
- `targetType` string: Exact target resource type
- `to` union: Inclusive upper timestamp or date boundary
  - string, date-time
  - string, date

## Response `200`

Audit events retrieved successfully

- PublicAuditLogListResponse
  - `data` PublicAuditLogEvent[], required
    - `id` string, required: Audit event ID
    - `createdAt` string, date-time, required: Event timestamp
    - `organizationId` string, required: Organization ID
    - `action` string, required: Stable dot-namespaced action name
    - `category` 'AUTHENTICATION' | 'MEMBERS' | 'ACCESS_CONTROL' | 'DATA_SOURCES' | 'QUERIES' | 'EXPORTS' | 'AI' | 'ORGANIZATION' | 'CONTENT' | 'INTEGRATIONS', required
    - `actorType` 'USER' | 'API_KEY' | 'SCIM' | 'SYSTEM' | 'ANONYMOUS', required
    - `actorUserId` string, nullable, required
    - `actorEmail` string, nullable, required
    - `apiKeyId` string, nullable, required
    - `scimTokenId` string, nullable, required
    - `targetType` string, nullable, required
    - `targetId` string, nullable, required
    - `targetDisplay` string, nullable, required
    - `source` 'WEB' | 'PUBLIC_API' | 'SCIM' | 'SLACK' | 'MCP' | 'SYSTEM' | 'PUBLIC_DASHBOARD', required
    - `ipAddress` string, nullable, required
    - `userAgent` string, nullable, required
    - `metadata` unknown
  - `pagination` PaginationMeta, required
    - `nextCursor` string, nullable, required: Cursor for the next page (null if no more pages)
    - `hasMore` boolean, required: Whether there are more items after this page

## Other responses

- `400`: Bad request - Invalid filters
- `401`: Unauthorized - Missing or invalid API key
- `403`: Forbidden - Enterprise plan required
- `404`: Not found - Organization not found or no administrator access
- `429`: Rate limit exceeded - Too many requests
- `500`: Internal server error

---

[API](https://skmtc.dev/basedash/apis/basedash-public-api.md) - [All operations](https://skmtc.dev/basedash/apis/basedash-public-api/llms.txt) - [OpenAPI document](https://skmtc.dev/basedash/apis/basedash-public-api/revisions/efb9d40bc6f7?raw)