audit-log

List audit log entries

Changed on

List what Cogram removed from the organization in a time window.

Each entry is one email or meeting that was deleted, or whose content was redacted, with the reason and the user who triggered it. Entries never carry content: an email is identified by its internet_message_id.

The window is half-open, [occurred_from, occurred_to), so consecutive windows neither overlap nor leave a gap. It may span at most 366 days; a longer window returns 400. Entries are ordered by occurred_at, then id.

An entry's occurred_at is when it was written; it becomes visible when its deleting transaction commits, which can be later. Query windows that ended at least 1 hour ago: then consecutive windows read every entry once.

get/audit-log

Request

  • Base URL: https://api.cogram.com/v1
  • URL: https://api.cogram.com/v1/audit-log
  • Auth: HTTP bearer

Query parameters

occurred_fromstring date-time required

Inclusive lower bound on occurred_at. Must include a UTC offset (e.g. 2026-10-20T00:00:00Z). The window may span at most 366 days.

occurred_tostring date-time required

Exclusive upper bound on occurred_at. Must include a UTC offset. The window may span at most 366 days.

entity_type'EMAIL' | 'MEETING'

The kind of record an audit row is about.

action'DELETED' | 'CONTENT_REDACTED'

What happened to the record.

reason'USER_DELETE' | 'BULK_UNFILE' | 'DUPLICATE_REMOVED' | 'PROJECT_DELETED' | 'MANUAL_PURGE' | 'RETENTION_EXPIRY' | 'USER_OFFBOARDED' | 'OTHER'

Why the record or its content was removed.

pageinteger

Page number (1-indexed).

page_sizeinteger

Response

Successful Response

totalinteger required

Total matches across all pages, not just this page.

pageinteger required
page_sizeinteger required

Changes