---
title: "List audit log entries"
method: GET
path: "/audit-log"
tags: ["audit-log"]
---

# List audit log entries

`GET /audit-log`

## Request

- Base URL: `https://api.cogram.com/v1`
- URL: `https://api.cogram.com/v1/audit-log`
- Auth: HTTP bearer

List what Cogram removed from the organization in a time window.

Each entry is one email or meeting that was deleted, or whose content was
redacted, with the reason and the user who triggered it. Entries never
carry content: an email is identified by its `internet_message_id`.

The window is half-open, `[occurred_from, occurred_to)`, so consecutive
windows neither overlap nor leave a gap. It may span at most 366 days; a
longer window returns 400. Entries are ordered by `occurred_at`, then `id`.

An entry's `occurred_at` is when it was written; it becomes visible when
its deleting transaction commits, which can be later. Query windows that
ended at least 1 hour ago: then consecutive windows read every entry once.

## Query parameters

- `occurred_from` string, date-time, required: Inclusive lower bound on `occurred_at`. Must include a UTC offset (e.g. 2026-10-20T00:00:00Z). The window may span at most 366 days.
- `occurred_to` string, date-time, required: Exclusive upper bound on `occurred_at`. Must include a UTC offset. The window may span at most 366 days.
- `entity_type` 'EMAIL' | 'MEETING': The kind of record an audit row is about.
- `action` 'DELETED' | 'CONTENT_REDACTED': What happened to the record.
- `reason` 'USER_DELETE' | 'BULK_UNFILE' | 'DUPLICATE_REMOVED' | 'PROJECT_DELETED' | 'MANUAL_PURGE' | 'RETENTION_EXPIRY' | 'USER_OFFBOARDED' | 'OTHER': Why the record or its content was removed.
- `page` integer: Page number (1-indexed).
- `page_size` integer

## Response `200`

Successful Response

- AuditLogListV1: Paginated audit log response.
  - `data` AuditLogEntryV1[], required
    - `id` integer, required: Unique, increasing in the order the entries were written. Breaks ties between entries with the same `occurred_at`.
    - `organization_id` string, required
    - `entity_type` 'EMAIL' | 'MEETING', required: The kind of record an audit row is about.
    - `entity_id` string, required: The record's Cogram id. A deleted email no longer exists; a meeting whose content was redacted still does.
    - `action` 'DELETED' | 'CONTENT_REDACTED', required: What happened to the record.
    - `reason` 'USER_DELETE' | 'BULK_UNFILE' | 'DUPLICATE_REMOVED' | 'PROJECT_DELETED' | 'MANUAL_PURGE' | 'RETENTION_EXPIRY' | 'USER_OFFBOARDED' | 'OTHER', required: Why the record or its content was removed.
    - `project_id` string, nullable, required: The project the record was in when it was removed.
    - `actor_user_id` string, uuid, nullable, required: The user who triggered the removal; null for a system event.
    - `occurred_at` string, date-time, required
    - `context` union, required: Email rows: the email's identifiers and retention facts. Meeting rows: the raw deletion reason for reason `OTHER`, otherwise null.
      - EmailAuditContextV1: What identifies a removed email outside Cogram. Never any content.
        - `internet_message_id` string, required: The email's RFC 5322 Message-ID. Match it against your mail server or archive.
        - `sent_at` string, date-time, required
        - `retention_class` 'SHORT' | 'ARCHIVE', required: The retention class an email retention ruleset gives an email. The ruleset maps each class to a duration; an email without a class (NULL) never expires.
        - `ruleset` string, nullable, required: The email retention ruleset the organization used when the email was removed, or null.
      - MeetingAuditContextV1: Why the system deleted a meeting. Set only for reason `OTHER`.
        - `meeting_deletion_reason` string, required: The meeting's raw deletion reason, e.g. `CALENDAR_CANCELLATION`.
  - `total` integer, required: Total matches across all pages, not just this page.
  - `page` integer, required
  - `page_size` integer, required

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `422`: Validation error
- `429`: Rate limit exceeded
- `500`: Internal server error

## Changes

- **2026-10-19** `5a3c9c40fca5`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/cogram/apis/cogram-api/changes/audit-log/get.md)

---

[API](https://skmtc.dev/cogram/apis/cogram-api.md) · [All operations](https://skmtc.dev/cogram/apis/cogram-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cogram/apis/cogram-api/revisions/5a3c9c40fca5?raw)