List all logs

Applies a limit to the number of results returned. Can be used for paginating the results together with starting_after or ending_before. At most 100 in the grouped view (the default), and up to 500 with view=flat.

A cursor for pagination. Provide the starting_after cursor from a previous response to fetch the next page.

A cursor for pagination. Provide the ending_before cursor from a previous response to fetch the previous page. Only with view=flat, since the grouped view only pages forward.

Filter logs by subject.

Filter logs by actor

Filter logs to events involving one user, as either the actor or the subject. Takes the user's ID.

Returns a 422 if the value is not a user ID (use identifier to filter by email address, phone number, username, or web3 wallet) or if actor, subject, or identifier is also set.

Filter logs to events where the user is the actor or the subject. Takes an identifier associated with a user: an email address, phone number, username, or web3 wallet.

The value must exactly match an identifier stored on a user; it is not a partial or fuzzy match. Verification status is not considered, so an identifier associated with several users matches events for all of them. If it is associated with no user in the instance, the response is an empty page, not an error.

Returns a 422 if the value is a user ID (use user_id instead) or if actor, subject, or user_id is also set.

Filter logs by trace ID (32 hex characters).

Filter logs by event type (e.g., sign_in.completed). A trailing * matches an event-type family by prefix (e.g. sign_in.* matches sign_in.created, sign_in.completed, ...); the wildcard is only allowed as the last character.

Filter logs by client ID.

Filter logs to events produced by one session: the session that was authenticated on the request behind the event.

This is the acting session, not the session an event is about. A sign-in creates a session on a request that had none, so session.created carries no session_id and names the new session in its payload instead. Use payload_filter[session_id] with a type to filter on that.

Events with no authenticated session behind them, such as sign-in, sign-up and verification requests, or anything originating from the Backend API or a background job, carry no session_id and never match.

Filter logs by impersonator user ID.

Filter logs by the client IP address recorded on the event.

Exact-match filters on event payload fields, keyed by the field's dot-path: payload_filter[user_id]=user_123 or payload_filter[captcha_attempt_payload.provider]=turnstile.

Requires type. Fields are validated against the payload schema of that event type (discoverable via GET /logs/schemas); for a trailing-* type the valid fields are those common to every matching event type. An unknown field returns a 422 listing the allowed fields.

One value per field — repeating a field is a 422. Values must parse as the field's type (a non-numeric value against an integer field is a 422) and match exactly; an event whose payload lacks the field never matches. At most 10 filters per request, paths at most 4 segments deep, values at most 256 characters.

Payload filters join the same filter_match group as the string filters above.

Comma-separated payload field dot-paths to include per returned log: payload_fields=user_id,strategy. Requires type, and the fields are validated against that event type's payload schema the same way as payload_filter (with the same caps).

Each returned log gains a payload object containing only the requested fields, keyed by their dot-paths, with fields absent from an event's payload omitted. Without this parameter, list responses carry no payload key.

Not allowed together with filter_match=any: the fields are validated against type's schema, and with any the type filter no longer constrains every returned row.

Controls how subject, type, actor, user_id, identifier, trace_id, client_id, session_id, impersonator_user_id, ip_address, and payload_filter entries are combined: all (default) requires every supplied filter to match; any returns events that match at least one of the supplied filters. event_time_after, event_time_before, and end_user_facing_only are always ANDed with the (possibly OR-ed) string filter group.

Sets a lower time boundary for the query (Unix timestamp in milliseconds). Only events on or after this timestamp are eligible to be returned.

This parameter constrains the search range but does not guarantee that every matching event within the range is returned in a single response. The server may use an internal time window smaller than the requested range to keep query latency predictable. When this happens, next_page_status will be "unknown" and a continuation cursor is provided so the caller can paginate through the full range. The window that was actually read is reported as searched_from and searched_to.

Sets an upper time boundary for the query (Unix timestamp in milliseconds). Only events on or before this timestamp are eligible to be returned.

This parameter constrains the search range but does not guarantee that every matching event within the range is returned in a single response. The server may use an internal time window smaller than the requested range to keep query latency predictable. When this happens, next_page_status will be "unknown" and a continuation cursor is provided so the caller can paginate through the full range.

When set to true, only returns events that are marked as end-user facing. When set to false or omitted, returns all events.

grouped, the default, lists each event group (a flow such as a sign-in) as a single item, next to the logs that belong to no group, newest first: a group sorts by when it started, a log by when it happened. Groups and logs are told apart by object. flat lists every log on its own.

Parameters that only work in one view are rejected with a 422 rather than ignored:

• The grouped view only pages forward: ending_before is not allowed, and starting_after takes only a cursor from a grouped page.
• The flat list takes only flat cursors.
• group_type and status aren't allowed with view=flat.
• The grouped view takes a limit of at most 100, since each group brings its first logs along.

In the grouped view, event filters keep the groups with at least one matching log, each group lists only its matching logs, and time filters pick groups by when they started.

Not allowed with view=flat. Group types to keep, e.g. sign_in, repeated for several (group_type=sign_in&group_type=sign_up). Drops the logs outside any group.

Not allowed with view=flat. Group statuses to keep, e.g. failed, repeated for several (status=failed&status=completed). Keeps only groups that concluded that way and drops the logs outside any group. A status is a conclusion (completed, failed), so groups that haven't concluded never match.