---
title: "List audit log"
method: GET
path: "/v1/projects/{project_id}/audit-logs"
tags: ["audit-logs"]
---

# List audit log

`GET /v1/projects/{project_id}/audit-logs`

## Request

- Base URL: `https://api.connic.co`
- URL: `https://api.connic.co/v1/projects/{project_id}/audit-logs`
- Auth: HTTP bearer

Immutable activity feed for the project, newest first: who did what, on which resource, with before/after snapshots where captured. Default window is seven days; override with `time_range` or explicit `start_date` and `end_date`. Combine `action_filter`, `user_filter`, `resource_type`, and `search` to narrow results. Pagination uses `limit` and `offset`.

Required permission: `audit.view`.

## Path parameters

- `project_id` string, uuid, required

## Query parameters

- `time_range` '1h' | '6h' | '24h' | '7d' | '30d' | '90d': Preset window ending now. Ignored when both `start_date` and `end_date` are set.
- `action_filter` string, nullable: Action key prefix, e.g. deployment or member
- `user_filter` string, nullable: Actor user id
- `resource_type` string, nullable: Resource type slug
- `search` string, nullable: Case-insensitive match on action, resource type, or resource id
- `start_date` string, date-time, nullable: Custom range start (ISO 8601); applies only together with `end_date`
- `end_date` string, date-time, nullable: Custom range end (ISO 8601); applies only together with `start_date`
- `limit` integer: Page size, 1 to 200
- `offset` integer: Number of events to skip

## Response `200`

Successful Response

- PublicAuditLogsResponse
  - `logs` PublicAuditLogItemResponse[], required: Audit events on this page, newest first.
    - `id` string, uuid, required
    - `project_id` string, uuid, required: Project the event belongs to.
    - `user_id` string, nullable, required: User who performed the action. Null for system events.
    - `user_email` string, required: Email of the user, or `System` for system events.
    - `user_picture` string, nullable, required: Avatar URL of the user. Null when unavailable.
    - `action` string, required: Action key, such as `deployment.create` or `run.cancel`.
    - `resource_type` string, required: Type of the affected resource, such as `deployment` or `run`.
    - `resource_id` string, nullable, required: ID of the affected resource. Null when the action has no single target.
    - `changes` string, nullable, required: JSON string with the captured `before` and `after` state, with sensitive values masked. Null when nothing was captured.
    - `ip_address` string, nullable, required: IP address the request came from. Null for system events.
    - `user_agent` string, nullable, required: User agent of the request. Null for system events.
    - `created_at` string, date-time, nullable, required
  - `total` integer, required: Events matching the filters across all pages.
  - `limit` integer, required: Page size used.
  - `offset` integer, required: Number of events skipped.

## Other responses

- `401`: Missing or invalid API key.
- `403`: The API key lacks the required permission or access to the environment.
- `422`: Validation Error
- `429`: Rate limit exceeded.

---

[API](https://skmtc.dev/connic/apis/connic-api.md) · [All operations](https://skmtc.dev/connic/apis/connic-api/llms.txt) · [OpenAPI document](https://skmtc.dev/connic/apis/connic-api/revisions/482932da5fbe?raw)