CEcensys
Account Management

List audit log events

Changed on

Retrieve audit log events for an organization. Use query parameters to filter events by time range, user, and event type.<br><br>This endpoint does not cost any credits to execute.

get/v3/accounts/organizations/{organization_id}/audit-log-events

Request

  • Base URL
    https://api.platform.censys.io
  • URL
    https://api.platform.censys.io/v3/accounts/organizations/{organization_id}/audit-log-events
  • Auth
    HTTP bearer

Path parameters

organization_idstring uuid required

The ID of a Censys organization. See the Getting Started docs for more information.

Example:11111111-2222-3333-4444-555555555555

Query parameters

page_sizeinteger

Amount of events to return per page.

Example:1
page_tokenstring

Page token for the requested page of audit log events.

start_timestring date-time

Only return events that occurred after this time. This value must be on or after 2026-01-01T00:00:00Z. If not provided, will default to the earliest possible date.

Example:2026-01-01T00:00:00Z
end_timestring date-time

Only return events that occurred before this time. This value must not be in the future. If not provided, it defaults to the current time.

Example:2026-02-01T00:00:00Z
event_type'user_created' | 'user_login' | 'user_login_failed' | 'user_password_changed' | 'user_password_reset' | 'user_mfa_changed' | 'user_settings_changed' | 'user_enabled' | 'user_disabled' | 'invitation_created' | 'invitation_resent' | 'invitation_accepted' | 'invitation_deleted' | 'membership_created' | 'membership_updated' | 'membership_removed' | 'org_created' | 'org_updated' | 'org_deleted' | 'saml_config_created' | 'saml_config_updated' | 'saml_config_deleted' | 'saml_config_domain_verified' | 'pat_created' | 'pat_deleted' | 'global_data_search_executed' | 'global_data_lookup_executed' | 'global_data_aggregation_executed' | 'asm_seed_created' | 'asm_seed_deleted' | 'asm_exclude_created' | 'asm_exclude_deleted' | 'asm_risk_instance_severity_changed' | 'asm_risk_instance_accepted' | 'asm_risk_instance_unaccepted' | 'asm_risk_type_severity_changed' | 'asm_risk_type_enabled' | 'asm_risk_type_disabled' | 'asm_risk_type_default_enabled' | 'tag_created' | 'tag_updated' | 'tag_deleted' | 'tag_assigned' | 'tag_unassigned' | 'tag_bulk_operation_started' | 'tag_bulk_operation_completed' | 'tag_bulk_operation_cancelled' | 'comment_created' | 'comment_updated' | 'comment_deleted' | 'scim_token_generated' | 'scim_token_revoked' | 'scim_user_provisioned' | 'scim_user_updated' | 'scim_user_deprovisioned' | 'module_assignment_granted' | 'module_assignment_revoked' | 'module_assignment_updated' | 'service_account_created' | 'service_account_secret_rotated' | 'service_account_deleted' | 'service_account_updated'

Only return events of this type. This field is deprecated and will be removed in a future version. Use event_types instead.

event_typesstring[] nullable

Only return events of these types.

[
  "user_login",
  "pat_created"
]
exclude_event_typesstring[] nullable

Exclude events of these types.

[
  "user_login",
  "pat_created"
]
user_emailstring

Only return events performed by this user.

Example:user@example.com
order_by'timestamp_desc' | 'timestamp_asc'

Order events by this field.

Response

OK

Changes

  • ec1686b0a36aRevision changes
    • warning

      added the new module_assignment enum value to the //// response property for the response status

    • warning

      added the new module_assignment_granted enum value to the /// response property for the response status

    • warning

      added the new module_assignment_revoked enum value to the /// response property for the response status

    • warning

      added the new module_assignment_updated enum value to the /// response property for the response status

    • warning

      added the new service_account enum value to the //// response property for the response status

    • warning

      added the new service_account enum value to the //// response property for the response status

    • warning

      added the new service_account_created enum value to the /// response property for the response status

    • warning

      added the new service_account_deleted enum value to the /// response property for the response status

    • warning

      added the new service_account_secret_rotated enum value to the /// response property for the response status

    • warning

      added the new service_account_updated enum value to the /// response property for the response status

    • info

      added the new enum value module_assignment_granted to the query request parameter event_type

    • info

      added the new enum value module_assignment_revoked to the query request parameter event_type

    • info

      added the new enum value module_assignment_updated to the query request parameter event_type

    • info

      added the new enum value service_account_created to the query request parameter event_type

    • info

      added the new enum value service_account_deleted to the query request parameter event_type

    • info

      added the new enum value service_account_secret_rotated to the query request parameter event_type

    • info

      added the new enum value service_account_updated to the query request parameter event_type

    • info

      added the enum value module_assignment_granted to the property items/ of the query request parameter event_types

    • info

      added the enum value module_assignment_granted to the property items/ of the query request parameter exclude_event_types

    • info

      added the enum value module_assignment_revoked to the property items/ of the query request parameter event_types

    • info

      added the enum value module_assignment_revoked to the property items/ of the query request parameter exclude_event_types

    • info

      added the enum value module_assignment_updated to the property items/ of the query request parameter event_types

    • info

      added the enum value module_assignment_updated to the property items/ of the query request parameter exclude_event_types

    • info

      added the enum value service_account_created to the property items/ of the query request parameter event_types

    • info

      added the enum value service_account_created to the property items/ of the query request parameter exclude_event_types

    • info

      added the enum value service_account_deleted to the property items/ of the query request parameter event_types

    • info

      added the enum value service_account_deleted to the property items/ of the query request parameter exclude_event_types

    • info

      added the enum value service_account_secret_rotated to the property items/ of the query request parameter event_types

    • info

      added the enum value service_account_secret_rotated to the property items/ of the query request parameter exclude_event_types

    • info

      added the enum value service_account_updated to the property items/ of the query request parameter event_types

    • info

      added the enum value service_account_updated to the property items/ of the query request parameter exclude_event_types

    • info

      added the optional property //// to the response with the status