---
title: "Retrieve audit logs"
method: GET
path: "/api/v1/audit-logs"
tags: ["Audit Logs"]
---

# Retrieve audit logs

`GET /api/v1/audit-logs`

Note: To see the complete list of possible values, please reference the available filter options for [audit logs under Settings in the app](https://app.getcortexapp.com/admin/settings/audit-logs).  API key must have the `View audit logs` permission.

## Query parameters

- `startTime` string, date-time
- `endTime` string, date-time
- `page` integer, required
- `pageSize` integer, required
- `actions` string[]
- `objectIdentifiers` string[]
- `objectTypes` 'ACCOUNT_FLAG' | 'ACTIVE_DIRECTORY_CONFIGURATION' | 'ALLOW_LIST_ENTRY' | 'API_KEY' | 'APIIRO_CONFIGURATION' | 'ARGOCD_CONFIGURATION' | 'ATLASSIAN_CONFIGURATION' | 'AWS_CLOUD_CONTROL_TYPE_CONFIGURATION' | 'AWS_CONFIGURATION' | 'AZURE_DEVOPS_CONFIGURATION' | 'AZURE_RESOURCES_CONFIGURATION' | 'BAMBOO_HR_CONFIGURATION' | 'BITBUCKET_CONFIGURATION' | 'BITBUCKET_OAUTH_CONFIGURATION' | 'BITBUCKET_OAUTH_REGISTRATION' | 'BITBUCKET_ONPREM_CONFIGURATION' | 'BITBUCKET_ONPREM_WEBHOOK_SECRET' | 'BITBUCKET_PERSONAL_CONFIGURATION' | 'BITBUCKET_WORKSPACE_ACCESS_TOKEN_CONFIGURATION' | 'BUGSNAG_CONFIGURATION' | 'BUILDKITE_CONFIGURATION' | 'CATALOG' | 'CATALOG_FILTER' | 'CHECKMARX_SAST_CONFIGURATION' | 'CIRCLE_CI_CONFIGURATION' | 'CLICKUP_CONFIGURATION' | 'CODECOV_CONFIGURATION' | 'CORALOGIX_CONFIGURATION' | 'CORTEX_TEAM_ROLES' | 'CORTEX_USER' | 'CORTEX_USER_ROLES' | 'CUSTOM_DATA' | 'CUSTOM_EVENT' | 'CUSTOM_METRICS_CONFIGURATION' | 'CUSTOM_METRICS_DATA' | 'CUSTOM_ROLE' | 'CUSTOM_ROLE_PERMISSIONS' | 'DATADOG_CONFIGURATION' | 'DEPENDENCY' | 'DOMAIN' | 'DYNATRACE_CONFIGURATION' | 'ENGINTEL_SAVED_MODULE' | 'ENTITY_SIDEBAR_CONFIGURATION' | 'ENTITY_TYPE_DEFINITION' | 'ENTITY_VERIFICATION' | 'FIREHYDRANT_CONFIGURATION' | 'GITHUB_APP_CONFIGURATION' | 'GITHUB_APP_INSTALLATION' | 'GITHUB_PERSONAL_TOKEN' | 'GITHUB_WEBHOOK_SECRET' | 'GITLAB_CONFIGURATION' | 'GOOGLE_CONFIGURATION' | 'IDENTITY_MAPPING' | 'INCIDENT_IO_CONFIGURATION' | 'INITIATIVE' | 'INSTANA_CONFIGURATION' | 'INTEGRATION_INSTANCE' | 'JENKINS_CONFIGURATION' | 'JIRA_BASIC_CONFIGURATION' | 'JIRA_CLOUD_SCOPED_CONFIGURATION' | 'JIRA_CONFIGURATION' | 'JIRA_OAUTH_CONFIGURATION' | 'JIRA_OAUTH_REGISTRATION' | 'JIRA_ONPREM_CONFIGURATION' | 'LAUNCHDARKLY_CONFIGURATION' | 'LIGHTSTEP_CONFIGURATION' | 'MEND_SAST_CONFIGURATION' | 'MEND_SCA_CONFIGURATION' | 'MICROSOFT_TEAMS_CONFIGURATION' | 'NEWRELIC_CONFIGURATION' | 'OAUTH_CONFIGURATION' | 'OKTA_CONFIGURATION' | 'OPENAPI_DEFINITION' | 'OPSGENIE_CONFIGURATION' | 'PAGERDUTY_CONFIGURATION' | 'PERSONAL_API_KEY' | 'PLUGIN' | 'PROMETHEUS_CONFIGURATION' | 'RELATIONSHIP_TYPE' | 'RELAY_CONFIGURATION' | 'RESOURCE' | 'ROLLBAR_CONFIGURATION' | 'SCORECARD' | 'SCORECARD_FILTER' | 'SCORECARD_RULE' | 'SCORECARD_RULE_FILTER' | 'SECRET' | 'SECRET_GROUP' | 'SEMGREP_CONFIGURATION' | 'SENTRY_CONFIGURATION' | 'SERVICE' | 'SERVICENOW_CONFIGURATION' | 'SIGNALFX_CONFIGURATION' | 'SLACK_CONFIGURATION' | 'SNYK_CONFIGURATION' | 'SONARQUBE_CONFIGURATION' | 'SUMOLOGIC_CONFIGURATION' | 'TEAM' | 'USER_LABEL_KEY' | 'VERACODE_CONFIGURATION' | 'VERIFICATION_PERIOD' | 'VICTOROPS_CONFIGURATION' | 'WEBHOOK_CONFIGURATION' | 'WIZ_CONFIGURATION' | 'WORKDAY_CONFIGURATION' | 'WORKFLOW' | 'XMATTERS_CONFIGURATION'
- `actorTypes` string[]
- `actorApiKeyIdentifiers` string[]
- `actorEmails` string[]
- `actorIpAddresses` string[]
- `actorRequestTypes` 'API_KEY_ENTITY' | 'ATLASSIAN_WEBHOOK' | 'SCORECARD_BADGES' | 'SLACK_COMMAND'

## Response `200`

Successfully retrieved audit logs

- AuditLogsResponse
  - `logs` AuditLogResponse[], required
    - `action` 'CREATE' | 'UPDATE' | 'DELETE', required — Type of action performed
    - `actorIdentifier` string — Readable identifier of the authenticated actor. This could an be OAuth user email, API key identifier, attributed webhook, etc.
    - `ipAddress` string — IP address of the actor
    - `objectIdentifier` string, required — Readable identifier of the object acted upon
    - `objectType` string, required — Type of object acted upon
    - `timestamp` string, date-time, required
  - `page` integer, required — Current page number, 0-indexed
  - `total` integer, required — Total number of results
  - `totalPages` integer, required — Total number of pages

## Other responses

- `429` — The client has exceeded the rate limit by performing too many requests in a short period. Retry the request after a delay.

---

[API](https://skmtc.dev/cortex/apis/cortex-api.md) · [All operations](https://skmtc.dev/cortex/apis/cortex-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/cortex/cortex-api/revisions/141799a965b4/schema)