---
title: "Search Audit Logs"
method: POST
path: "/v0/platform/audit-logs/search"
tags: ["Audit Logs"]
---

# Search Audit Logs

`POST /v0/platform/audit-logs/search`

Returns audit events for the organization. Dates are interpreted in UTC. Request/response enums are aligned so values returned can be reused as filters.

## Request body

- AuditLogSearchRequest — Request body for searching audit logs. Dates are interpreted in UTC.
  - `start_date` string, date-time, required — Start of the date range (UTC, inclusive).
  - `end_date` string, date-time, required — End of the date range (UTC, inclusive).
  - `sort` 'asc' | 'desc' — Sort order for results by timestamp.
  - `actor_types` AuditActorType[] — Filter results to events performed by these actor types.
  - `actor_names` string[] — Filter results to events performed by these actor names.
  - `actions` AuditActionType[] — Filter results to these action types.
  - `entity_types` AuditEntityType[] — Filter results to events affecting these entity types.
  - `entity_ids` string[] — Filter results to events affecting these entity IDs.
  - `chains` string[] — Filter results to events associated with these chain names.
  - `search_text` string — Free-text search across audit log fields.
  - `page` integer — Page number to return (1-indexed).
  - `page_size` integer — Number of results per page.

## Response `200`

- AuditLogSearchResponse — Paginated list of audit log events matching the search criteria.
  - `items` AuditLogItem[], required — Audit log events returned for this page.
    - `id` string, required — Unique identifier of the audit log entry.
    - `actor` string — Identifier of the actor that performed the action (e.g. email address or API key ID).
    - `entity_id` string — Identifier of the entity affected by the action.
    - `chain` string — Blockchain network associated with the event, if applicable.
    - `summary` string — Human-readable description of the event.
    - `timestamp` string, date-time, required — UTC timestamp of when the event occurred.
    - `actor_type` 'user' | 'system' | 'API', required — The type of actor that performed the audited action.
    - `action` 'create' | 'edit' | 'delete' | 'info', required — The type of action recorded in the audit log.
    - `entity_type` 'cosigner' | 'cosigner_policy' | 'cosigner_transaction' | 'cosigner_manual_action' | 'label' | 'asset' | 'monitor' | 'api_key' | 'user_session' | 'audit_export' | 'metric' | 'response_wallet' | 'rpc_gateway_rule' | 'settings' | 'endpoint' | 'feature' | 'backoffice_api_key' | 'organization' | 'organization_extended', required — The type of entity affected by the audited action.
  - `total` integer, required — Total number of matching audit log events.
  - `page` integer, required — Current page number.
  - `pages` integer, required — Total number of pages available.
  - `size` integer, required — Number of events returned in this page.

## Changes

> 95 revisions in range; 1 not diffed.

- **2026-06-16** `187d6a5259c6` — 1 info
  - the endpoint scheme security `JWT` was added to the API
- **2026-04-16** `3debd2bfcd43` — 1 breaking, 1 warning, 2 info
  - removed the enum value `api` of the request property `actor_types/items/`
  - added the new `API` enum value to the `items/items/actor_type` response property for the response status `200`
  - added the new `API` enum value to the request property `actor_types/items/`
  - removed the `api` enum value from the `items/items/actor_type` response property for the response status `200`
- **2026-03-30** `4b1a9b2bf47d` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/blockaid-official/apis/blockaid-api/changes/v0/platform/audit-logs/search/post.md)

---

[API](https://skmtc.dev/blockaid-official/apis/blockaid-api.md) · [All operations](https://skmtc.dev/blockaid-official/apis/blockaid-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/blockaid-official/blockaid-api/revisions/e15b4bf2b25b/schema)