Audit log

List user audit logs

Changed on

Lists audit logs for the authenticated user within an enterprise or organization. Enterprise results are based on the user's role, while organization-scoped results require organization admin access. Results are paginated and sorted by timestamp in descending order. Provide exactly one of filter[enterpriseId] or filter[organizationId]; the parameters are mutually exclusive.

Requires access token scopes: auditlogs_view_all or user_manage

get/api/audit-log-service/v3/audit-logs

Request

  • Base URL
    https://developers.bitgo.com
  • URL
    https://developers.bitgo.com/api/audit-log-service/v3/audit-logs
  • Auth
    HTTP bearer

Query parameters

filter[enterpriseId]string
Example:59cd72485007a239fb00282ed480da1f

Enterprise ID to scope the query. Mutually exclusive with filter[organizationId].

filter[organizationId]string
Example:59cd72485007a239fb00282ed480da1f

Organization ID to scope organization audit logs. Mutually exclusive with filter[enterpriseId]. Exactly one scope filter is required.

filter[targetId]string
Example:59cd72485007a239fb00282ed480da1f

Filter by target ID. Common values include walletId, userId, enterpriseId and organizationId.

filter[targetType]'user' | 'wallet' | 'enterprise' | 'organization'

Type of entity that was the target of the action

Filter by target type. Common values include wallet, enterprise, user, and organization.

filter[type]AuditLogEventType[]

Filter by audit log type. Accepts a single value or a comma-separated list for multiple values.

filter[actorId]string
Example:59cd72485007a239fb00282ed480da1f

Filter by actor ID

filter[actorType]'admin' | 'user' | 'bitgo'

Filter by actor type.

filter[bucket]'enterprise' | 'login' | 'organization' | 'policy' | 'safe' | 'transaction' | 'unknown' | 'user' | 'wallet'

Filter by audit log category

filter[correlationId]string

Filter by correlation ID to correlate related audit events.

filter[createdAt][gte]string date-time

Filter for audit logs on or after this date (ISO 8601 format)

filter[createdAt][lt]string date-time

Filter for audit logs before this date (ISO 8601 format)

page[after]string

Opaque pagination cursor returned in the previous page's links.next

page[size]integer

Maximum number of results to return per page

Response

Successfully retrieved audit logs

Changes

  • 1ab77cd2aa34Revision changes
    • warning

      added the new organization.autoAddWalletToRoleScope enum value to the /// response property for the response status

    • warning

      added the new wallet.cancelStake enum value to the /// response property for the response status

    • warning

      added the new wallet.claimRewards enum value to the /// response property for the response status

    • warning

      added the new wallet.resetLightningUserAuthKey enum value to the /// response property for the response status

    • warning

      added the new wallet.retryStake enum value to the /// response property for the response status

    • warning

      added the new wallet.switchValidator enum value to the /// response property for the response status

    • warning

      added the new wallet.unstake enum value to the /// response property for the response status

    • info

      added the enum value organization.autoAddWalletToRoleScope to the property items/ of the query request parameter filter[type]

    • info

      added the enum value wallet.cancelStake to the property items/ of the query request parameter filter[type]

    • info

      added the enum value wallet.claimRewards to the property items/ of the query request parameter filter[type]

    • info

      added the enum value wallet.resetLightningUserAuthKey to the property items/ of the query request parameter filter[type]

    • info

      added the enum value wallet.retryStake to the property items/ of the query request parameter filter[type]

    • info

      added the enum value wallet.switchValidator to the property items/ of the query request parameter filter[type]

    • info

      added the enum value wallet.unstake to the property items/ of the query request parameter filter[type]

  • df6644551827Revision changes
    • warning

      added the new key.upgradeEncryption enum value to the /// response property for the response status

    • info

      added the enum value key.upgradeEncryption to the property items/ of the query request parameter filter[type]