---
title: "List audit log entries"
method: GET
path: "/audit"
tags: ["audit"]
---

# List audit log entries

`GET /audit`

Returns audit log entries matching the filter criteria. Manager or admin only.

## Query parameters

- `remoteNode` string
- `category` string
- `action` string
- `source` string
- `surface` string
- `result` string
- `correlationId` string
- `resourceType` string
- `resourceId` string
- `workspace` string
- `credentialId` string
- `credentialType` string
- `mcpTool` string
- `ipAddress` string
- `userId` string
- `startTime` string, date-time
- `endTime` string, date-time
- `limit` integer
- `offset` integer

## Response `200`

List of audit log entries

- AuditLogsResponse — Response containing audit log entries
  - `entries` AuditEntry[], required — List of audit log entries
    - `id` string, required — Unique identifier for this entry
    - `timestamp` string, date-time, required — When the event occurred
    - `category` string, required — Category of the audit event (e.g., terminal, user, dag)
    - `action` string, required — The action that was performed (e.g., session_start, command, login)
    - `source` string — Source surface that produced the event
    - `surface` string — Externally accepted credential surface
    - `result` string — Event result such as succeeded, failed, or denied
    - `correlationId` string — Correlation ID linking related audit events
    - `resourceType` string — Affected resource type
    - `resourceId` string — Affected resource ID
    - `workspace` string — Canonical workspace for filtering
    - `credentialId` string — Credential ID used for the request
    - `credentialType` string — Credential type used for the request
    - `mcpTool` string — MCP tool name when source is MCP
    - `userId` string, required — ID of the user who performed the action
    - `username` string, required — Username of the user who performed the action
    - `details` string — JSON-encoded action-specific details
    - `ipAddress` string — Client IP address if available
  - `total` integer, required — Total number of entries matching the filter (before pagination)

## Other responses

- `401` — Not authenticated
- `403` — Forbidden - requires manager or admin role
- `default` — Unexpected error

## Changes

- **2026-05-24** (v1) `8a2d5d3e9608` — 3 warning
  - added the new `rate_limited` enum value to the `code` response property for the response status `401`
  - added the new `rate_limited` enum value to the `code` response property for the response status `403`
  - added the new `rate_limited` enum value to the `code` response property for the response status `default`
- **2026-05-22** (v1) `4a44e3b2d12a` — 22 info
  - added the new optional `query` request parameter `action`
  - added the new optional `query` request parameter `correlationId`
  - added the new optional `query` request parameter `credentialId`
  - added the new optional `query` request parameter `credentialType`
  - …18 more
- **2026-04-30** (v1) `50e1d517afc1` — 22 warning, 3 info
  - deleted the `query` request parameter `action`
  - deleted the `query` request parameter `correlationId`
  - deleted the `query` request parameter `credentialId`
  - deleted the `query` request parameter `credentialType`
  - …21 more

[Change history](https://skmtc.dev/dagucloud/apis/dagu/changes/audit/get.md)

---

[API](https://skmtc.dev/dagucloud/apis/dagu.md) · [All operations](https://skmtc.dev/dagucloud/apis/dagu/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/dagucloud/dagu/revisions/8a2d5d3e9608/schema)