---
title: "List User Security Logs"
method: GET
path: "/users/{userId}/security-logs"
tags: ["Security Logs"]
---

# List User Security Logs

`GET /users/{userId}/security-logs`

## Request

- Base URL: `https://api.crowdin.com/api/v2`
- URL: `https://api.crowdin.com/api/v2/users/{userId}/security-logs`
- Auth: none declared
- TypeScript: <https://skmtc.dev/crowdin/apis/crowdin-enterprise-api-v2/docs/users/:userId/security-logs/get.ts> (a function with typed inputs; its response is checked against the schema)

**Required scopes:** `security-log` (Read only).

## Path parameters

- `userId` integer, required

## Query parameters

- `limit` integer
- `offset` integer
- `event` 'login' | 'password.set' | 'password.change' | 'email.change' | 'login.change' | 'personal_token.issued' | 'personal_token.revoked' | 'mfa.enabled' | 'mfa.disabled' | 'session.revoke' | 'session.revoke_all' | 'sso.connect' | 'sso.disconnect' | 'user.registered' | 'user.remove' | 'application.connected' | 'application.disconnected' | 'webauthn.created' | 'webauthn.deleted' | 'trusted_device.remove' | 'trusted_device.remove_all' | 'device_verification.enabled' | 'device_verification.disabled' | 'user.force_removed' | 'user.blocked' | 'user.unblocked' | 'team.member.added' | 'team.member.removed' | 'role.admin.granted' | 'role.admin.revoked' | 'role.group_manager.granted' | 'role.group_manager.revoked' | 'organization.settings.saml.changed' | 'organization.settings.invite_restrict.changed' | 'organization.settings.device_verification.changed' | 'organization.settings.mfa.changed' | 'organization.settings.remember_me.changed' | 'organization.settings.sign_up.changed' | 'organization.settings.token_creation.changed' | 'organization.settings.token_expiration.changed' | 'sso.custom_app.configured' | 'sso.custom_app.disabled' | 'organization.auth_method.disabled' | 'organization.auth_method.enabled'
- `createdAfter` string
- `createdBefore` string
- `ipAddress` string

## Response `200`

User Security Logs list

- SecurityLogCollectionResource: Base schema of resource container. Container is a wrapper object that contains payload in required `data` property and provides space for adding any other metadata.
  - `data` SecurityLogResource[], required
    - `data` SecurityLog, required
      - `id` integer
      - `event` string
      - `info` string
      - `userId` integer
      - `location` string
      - `ipAddress` string
      - `deviceName` string
      - `createdAt` string
  - `pagination` Pagination: Pagination Response Model
    - `offset` integer
    - `limit` integer

## Other responses

- `400`: Invalid Request Parameters
- `401`: Unauthorized
- `403`: Forbidden
- `404`: User not found
- `405`: Method Not Allowed
- `503`: Service Unavailable

---

[API](https://skmtc.dev/crowdin/apis/crowdin-enterprise-api-v2.md) - [All operations](https://skmtc.dev/crowdin/apis/crowdin-enterprise-api-v2/llms.txt) - [OpenAPI document](https://skmtc.dev/crowdin/apis/crowdin-enterprise-api-v2/revisions/dc68744c5384?raw)