---
title: "List audit log events"
method: GET
path: "/v3/accounts/organizations/{organization_id}/audit-log-events"
tags: ["Account Management"]
---

# List audit log events

`GET /v3/accounts/organizations/{organization_id}/audit-log-events`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v3/accounts/organizations/{organization_id}/audit-log-events`
- Auth: HTTP bearer

Retrieve audit log events for an organization. Use query parameters to filter events by time range, user, and event type.<br><br>This endpoint does not cost any credits to execute.

## Path parameters

- `organization_id` string, uuid, required: The ID of a Censys organization. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.

## Query parameters

- `page_size` integer: Amount of events to return per page.
- `page_token` string: Page token for the requested page of audit log events.
- `start_time` string, date-time: Only return events that occurred after this time. This value must be on or after 2026-01-01T00:00:00Z. If not provided, will default to the earliest possible date.
- `end_time` string, date-time: Only return events that occurred before this time. This value must not be in the future. If not provided, it defaults to the current time.
- `event_type` 'user_created' | 'user_login' | 'user_login_failed' | 'user_password_changed' | 'user_password_reset' | 'user_mfa_changed' | 'user_settings_changed' | 'user_enabled' | 'user_disabled' | 'invitation_created' | 'invitation_resent' | 'invitation_accepted' | 'invitation_deleted' | 'membership_created' | 'membership_updated' | 'membership_removed' | 'org_created' | 'org_updated' | 'org_deleted' | 'saml_config_created' | 'saml_config_updated' | 'saml_config_deleted' | 'saml_config_domain_verified' | 'pat_created' | 'pat_deleted' | 'global_data_search_executed' | 'global_data_lookup_executed' | 'global_data_aggregation_executed' | 'asm_seed_created' | 'asm_seed_deleted' | 'asm_exclude_created' | 'asm_exclude_deleted' | 'asm_risk_instance_severity_changed' | 'asm_risk_instance_accepted' | 'asm_risk_instance_unaccepted' | 'asm_risk_type_severity_changed' | 'asm_risk_type_enabled' | 'asm_risk_type_disabled' | 'asm_risk_type_default_enabled' | 'tag_created' | 'tag_updated' | 'tag_deleted' | 'tag_assigned' | 'tag_unassigned' | 'tag_bulk_operation_started' | 'tag_bulk_operation_completed' | 'tag_bulk_operation_cancelled' | 'comment_created' | 'comment_updated' | 'comment_deleted' | 'scim_token_generated' | 'scim_token_revoked' | 'scim_user_provisioned' | 'scim_user_updated' | 'scim_user_deprovisioned' | 'module_assignment_granted' | 'module_assignment_revoked' | 'module_assignment_updated' | 'service_account_created' | 'service_account_secret_rotated' | 'service_account_deleted' | 'service_account_updated': Only return events of this type. This field is deprecated and will be removed in a future version. Use event_types instead.
- `event_types` string[], nullable: Only return events of these types.
- `exclude_event_types` string[], nullable: Exclude events of these types.
- `user_email` string: Only return events performed by this user.
- `order_by` 'timestamp_desc' | 'timestamp_asc': Order events by this field.

## Response `200`

OK

- ResponseEnvelopeAuditLogEventsResponse
  - `result` AuditLogEventsResponse
    - `events` AuditLogEvent[], nullable, required: The page of audit log events for the requested filters and pagination parameters.
      - `actor` ActorInfo, required
        - `display_name` string: The human-readable name of a non-human actor, as of the time of the action. Set for service accounts, which have no email.
        - `email` string: The email of the entity that performed the action. Only human actors have an email.
        - `id` string: The ID of the entity that performed the action. This will depend on the type of entity, as it could be a Censys user ID, a service account ID, or an ASM workspace ID.
        - `type` 'unknown' | 'user' | 'system' | 'customer_support' | 'asm_workspace' | 'service_account', required: The type of entity that performed the action.
      - `authentication_method` string: The method used by the actor to authenticate before performing the action.
      - `event_type` 'user_created' | 'user_login' | 'user_login_failed' | 'user_password_changed' | 'user_password_reset' | 'user_mfa_changed' | 'user_settings_changed' | 'user_enabled' | 'user_disabled' | 'invitation_created' | 'invitation_resent' | 'invitation_accepted' | 'invitation_deleted' | 'membership_created' | 'membership_updated' | 'membership_removed' | 'org_created' | 'org_updated' | 'org_deleted' | 'saml_config_created' | 'saml_config_updated' | 'saml_config_deleted' | 'saml_config_domain_verified' | 'pat_created' | 'pat_deleted' | 'global_data_search_executed' | 'global_data_lookup_executed' | 'global_data_aggregation_executed' | 'asm_seed_created' | 'asm_seed_deleted' | 'asm_exclude_created' | 'asm_exclude_deleted' | 'asm_risk_instance_severity_changed' | 'asm_risk_instance_accepted' | 'asm_risk_instance_unaccepted' | 'asm_risk_type_severity_changed' | 'asm_risk_type_enabled' | 'asm_risk_type_disabled' | 'asm_risk_type_default_enabled' | 'tag_created' | 'tag_updated' | 'tag_deleted' | 'tag_assigned' | 'tag_unassigned' | 'tag_bulk_operation_started' | 'tag_bulk_operation_completed' | 'tag_bulk_operation_cancelled' | 'comment_created' | 'comment_updated' | 'comment_deleted' | 'scim_token_generated' | 'scim_token_revoked' | 'scim_user_provisioned' | 'scim_user_updated' | 'scim_user_deprovisioned' | 'module_assignment_granted' | 'module_assignment_revoked' | 'module_assignment_updated' | 'service_account_created' | 'service_account_secret_rotated' | 'service_account_deleted' | 'service_account_updated', required: The type of action that was audited.
      - `metadata` object: Event-specific metadata. Contents vary by event type.
      - `source` string: Where the audited action originated from.
      - `source_ip` string: The IP address of the source of the audited action.
      - `subject` SubjectInfo, required
        - `display_name` string: A human-readable name for the subject resource, if available. The value and format depend on the subject type and may be omitted if not applicable.
        - `id` string: The unique identifier of the subject resource. The identifier format depends on the subject type (for example, a Censys user ID or ASM workspace ID). Not all events will have a subject ID.
        - `type` 'organization' | 'user' | 'saml_config' | 'pat' | 'collection' | 'organization_membership' | 'organization_invitation' | 'asm_workspace' | 'asm_seed' | 'asm_exclude' | 'asm_risk_type' | 'asm_risk_instance' | 'global_data' | 'tag' | 'comment' | 'module_assignment' | 'service_account', required: The type of resource that was affected by the audited action.
      - `timestamp` string, date-time, required: The timestamp of the audit log event.
      - `user_agent` string: The user agent of the source of the audited action.
    - `pagination` PaginationInfo, required
      - `next_page_token` string: The token to use to retrieve the next page of results.
      - `page_size` integer, required: The number of results requested per page.
    - `total_results` integer, required

## Other responses

- `400`: Bad request
- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `404`: User not found
- `422`: Invalid request parameters
- `500`: Internal server error

## Changes

- **2026-11-03** `ec1686b0a36a`: 10 warning, 22 info
  - added the new `module_assignment` enum value to the `result/events/items/subject/type` response property for the response status `200`
  - added the new `module_assignment_granted` enum value to the `result/events/items/event_type` response property for the response status `200`
  - added the new `module_assignment_revoked` enum value to the `result/events/items/event_type` response property for the response status `200`
  - added the new `module_assignment_updated` enum value to the `result/events/items/event_type` response property for the response status `200`
  - …28 more

[Operation history](https://skmtc.dev/censys/apis/censys-platform-api/changes/v3/accounts/organizations/:organization_id/audit-log-events/get.md)

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)