---
title: "Create Workspace-level audit logs"
method: POST
path: "/api/v3/workspaces/{workspace_id}/auditlogs"
tags: ["Auditlogs", "Audit Logs"]
---

# Create Workspace-level audit logs

`POST /api/v3/workspaces/{workspace_id}/auditlogs`

Create Workspace-level audit logs. Only the Workspace owner can create audit logs. \
 \
***Note:** This endpoint is only available to Workspaces on our [Enterprise Plan](https://clickup.com/pricing).*

## Path parameters

- `workspace_id` number, required — The ID of the Workspace.

## Request body

- AutoAuditlogAuditLogQueryRequest
  - `filter` AutoAuditlogAuditEventFilterRequest
    - `workspaceId` object — The ID of the Workspace.
    - `userId` string[] — The user ID. This can be a single user or multiple.
    - `userEmail` string[] — User emails. This can be a single email or multiple.
    - `eventType` 'USER_LOGIN' | 'USER_LOGOUT' | 'CHANGE_2FA' | 'CHANGE_EMAIL' | 'CHANGE_PASSWORD' | 'JOIN_WORKSPACE' | 'LEAVE_WORKSPACE' | 'RESET_PASSWORD' | 'ROLE_CHANGE' | 'SCIM_DEPROVISION' | 'SCIM_PROVISION' | 'SCIM_UPDATE' | 'SECURE_LOGIN_EMAIL_SENT' | 'ADVANCED_SETTINGS_UPDATED' | 'CHANGE_2FA_POLICY' | 'CHANGE_ROLE_PERMISSIONS' | 'CHANGE_SSO_POLICY' | 'CHANGE_USER_ROLE' | 'CUSTOM_ROLE_CREATED' | 'CUSTOM_ROLE_DELETED' | 'CUSTOM_ROLE_UPDATED' | 'TEAM_CREATED' | 'TEAM_DELETED' | 'TEAM_EDITED' | 'TEAM_MEMBER_ADDED' | 'TEAM_MEMBER_REMOVED' | 'INVITE_TO_WORKSPACE' | 'REMOVE_FROM_WORKSPACE' | 'SCIM_GROUP_CREATED' | 'SCIM_GROUP_DELETED' | 'SCIM_GROUP_UPDATED' | 'SSO_CONFIG_UPDATED' | 'TASK_ARCHIVED' | 'TASK_ASSIGNEES_CHANGED' | 'TASK_CREATED' | 'TASK_CUSTOM_FIELD_VALUES_CHANGED' | 'TASK_DELETED' | 'TASK_PRIORITY_CHANGED' | 'TASK_RESTORED' | 'TASK_STATUS_CHANGED' | 'TASK_UNARCHIVED' | 'FIELD_CONVERTED' | 'FIELD_CREATED' | 'FIELD_DROPDOWN_OPTIONS_CREATED' | 'FIELD_DROPDOWN_OPTIONS_REMOVED' | 'FIELD_DROPDOWN_OPTIONS_UPDATED' | 'FIELD_DUPLICATED' | 'FIELD_GROUP_MEMBER_PERMISSION_REMOVED' | 'FIELD_GROUP_MEMBER_PERMISSION_SET' | 'FIELD_LABEL_OPTIONS_CREATED' | 'FIELD_LABEL_OPTIONS_REMOVED' | 'FIELD_LABEL_OPTIONS_UPDATED' | 'FIELD_LOCATION_ADDED' | 'FIELD_LOCATION_REMOVED' | 'FIELD_LOCATION_UPDATED' | 'FIELD_MEMBER_PERMISSION_REMOVED' | 'FIELD_MEMBER_PERMISSION_SET' | 'FIELD_MERGED' | 'FIELD_PERMANENTLY_REMOVED' | 'FIELD_REMOVED' | 'FIELD_RESTORED' | 'FIELD_UPDATED' — Types of events to filter by. Options include `USER_LOGIN`, `USER_LOGOUT`, `CHANGE_2FA`, `CHANGE_PASSWORD`, `CHANGE_EMAIL`, `JOIN_WORKSPACE`, `LEAVE_WORKSPACE`, `REMOVE_FROM_WORKSPACE`, `RESET_PASSWORD`, `ROLE_CHANGE`, `SCIM_PROVISION`, `SCIM_DEPROVISION`, `SCIM_UPDATE`, `ADVANCED_SETTINGS_UPDATED`, `CHANGE_ROLE_PERMISSIONS`, `INVITE_TO_WORKSPACE`, `CHANGE_USER_ROLE`, `CHANGE_SSO_POLICY`, `CHANGE_2FA_POLICY`, `CUSTOM_ROLE_CREATED`, `CUSTOM_ROLE_UPDATED`, `CUSTOM_ROLE_DELETED`, `SCIM_GROUP_CREATED`, `SCIM_GROUP_UPDATED`, `SCIM_GROUP_DELETED`, `TEAM_CREATED`, `TEAM_DELETED`, `TEAM_EDITED`, `TEAM_MEMBER_ADDED`, `TEAM_MEMBER_REMOVED`, `SSO_CONFIG_UPDATED`, `TASK_CREATED`, `TASK_ARCHIVED`, `TASK_DELETED`, `TASK_RESTORED`, `TASK_UNARCHIVED`, `TASK_STATUS_CHANGED`, `TASK_PRIORITY_CHANGED`, `TASK_ASSIGNEES_CHANGED`, and `TASK_CUSTOM_FIELD_VALUES_CHANGED`.
    - `eventStatus` 'success' | 'failed' | 'warn' | 'skipped' | 'started' | 'completed' | 'error' | 'system_error' — Status of events you're filtering by. Options include `success`, `failed`, `started`, `completed`, `error`, `system_error`.
    - `startTime` number — The start time to begin paginating your logs.
    - `endTime` number — The end time to begin paginating your logs.
  - `applicability` 'agent-settings-activity' | 'auth-and-security' | 'custom-fields' | 'hierarchy-activity' | 'user-activity' | 'other-activity' — Type of logs to filter by. Options include `auth-and-security`, `custom-fields`, `hierarchy-activity` and `user-activity`. Most use cases will use `auth-and-security`.
  - `pagination` AutoAuditlogAuditLogPaginationRequest
    - `pageRows` number — The number of rows to return.
    - `pageTimestamp` number — The timestamp to index on. This should be the timestamp of the last row on the previous page. If you are requesting the first page, this should be the current timestamp.
    - `pageDirection` unknown

## Response `200`

---

[API](https://skmtc.dev/clickup/apis/clickup-api-v2-reference.md) · [All operations](https://skmtc.dev/clickup/apis/clickup-api-v2-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/clickup/clickup-api-v2-reference/revisions/72216f55b952/schema)