---
title: "List audit log events"
method: GET
path: "/organizations/{organizationId}/audit-log"
tags: ["Audit log"]
---

# List audit log events

`GET /organizations/{organizationId}/audit-log`

## Request

- Base URL: `https://api.cactal.ai/v1`
- URL: `https://api.cactal.ai/v1/organizations/{organizationId}/audit-log`
- Auth: HTTP bearer

Returns the organization’s immutable audit trail newest first as a paginated set, recording mutations performed by users and API keys across organizations, members, invitations, websites, and billing. Filter with the `eventType`, `resourceType`, `actorKind`, `actorPrincipalId`, and `websiteId` query parameters; `websiteId` narrows the trail to one website, including events recorded against its nested resources. Page size defaults to 20 (maximum 100). Requires a role with audit log access (owner or admin).

## Path parameters

- `organizationId` string, required

## Query parameters

- `eventType` string
- `resourceType` string
- `actorKind` 'user' | 'api_key' | 'system' | 'agent'
- `actorPrincipalId` string
- `websiteId` string: Return only events about this website — either the website itself or a resource belonging to it.
- `cursor` string
- `limit` integer

## Response `200`

One page of audit events, newest first.

- object
  - `items` object[], required
    - `id` string, required: Unique event ID.
    - `occurredAt` string, date-time, required: When the action happened.
    - `eventType` string, required: Stable event identifier, e.g. `organizations.members.remove`. Also usable as the `eventType` filter.
    - `summary` string, nullable, required: Human-readable one-line summary of the action.
    - `actorKind` 'user' | 'api_key' | 'system' | 'agent', required: What kind of principal performed the action.
    - `actorPrincipalId` string, nullable, required: Principal ID of the actor, when known. Usable as the `actorPrincipalId` filter to follow one actor.
    - `actorDisplay` object, nullable, required: Resolved display info for the actor; `null` when the actor cannot be resolved (for example `system` actors or an API key that no longer exists).
      - `label` string, required: Display name of the actor: the user’s name, the API key’s name, or `Deleted user` for a person who deleted their account.
      - `email` string, nullable, required: Email of user actors; `null` for API key actors and deleted users.
    - `resourceType` string, nullable, required: Type of the affected resource, e.g. `organization_member`.
    - `resourceId` string, nullable, required: ID of the affected resource.
    - `metadata` object, nullable, required: Event-specific structured details.
    - `durationMs` integer, required: How long the recorded operation took, in milliseconds.
  - `nextCursor` string, nullable, required: Opaque cursor for the next page. Pass it as the `cursor` parameter on the next request. `null` when this is the last page.

## Other responses

- `400`: Validation failed. The response `message` names the first invalid field.
- `401`: Missing, invalid, expired, or revoked API key.
- `403`: The authenticated principal lacks the required capability.
- `404`: The resource does not exist or is outside the principal’s access scope.
- `429`: Rate limit exceeded. Retry after the number of seconds in the `Retry-After` header.

---

[API](https://skmtc.dev/cactal/apis/cactal-api.md) · [All operations](https://skmtc.dev/cactal/apis/cactal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cactal/apis/cactal-api/revisions/9cd0fb5eacdd?raw)