---
title: "Get audit logs"
method: GET
path: "/management/audit_logs"
tags: ["Audit Logs"]
---

# Get audit logs

`GET /management/audit_logs`

## Request

- Base URL: `https://api.fireblocks.io/v1`
- URL: `https://api.fireblocks.io/v1/management/audit_logs`
- Auth: none declared
- TypeScript: <https://skmtc.dev/fireblocks/apis/fireblocks-api/docs/management/audit_logs/get.ts> (a function with typed inputs; its response is checked against the schema)

Retrieve audit log events for the workspace with optional filtering, date range, sorting, and cursor-based pagination.

Filters within the same field are combined as OR (e.g. category=Administration&category=Security returns events in either category). Filters across different fields are combined as AND.

**Deprecated parameters:** `timePeriod` and `cursor` remain functional for backward compatibility but new integrations should use `startTime`/`endTime` and `pageCursor` instead.

Endpoint Permission: Admin, Non-Signing Admin, Auditor, Security Admin, Security Auditor.

## Query parameters

- `startTime` integer
- `endTime` integer
- `timePeriod` 'DAY' | 'WEEK'
- `category` string[]
- `subject` string[]
- `event` string[]
- `user` string[]
- `userId` string[]
- `order` 'ASC' | 'DESC'
- `pageSize` integer
- `pageCursor` string
- `cursor` string

## Response `200`

Audit log events matching the requested filters and date range

- GetAuditLogsResponse
  - `data` AuditLogData[]
    - `id` string: The unique identifier of the audit log
    - `timestamp` number: The timestamp of the audit log
    - `createdAt` number: The timestamp of the audit log creation
    - `user` string: The user who performed the action
    - `subject` string: The subject of the action
    - `event` string: The event that was performed
    - `category` string: The category of the audit event
    - `tenantId` string: The tenant ID of the audit log
    - `userId` string: The user ID of the audit log
  - `next` string, nullable: Cursor to pass as pageCursor in the next request. Null when no further pages exist.
  - `cursor` string, nullable: Deprecated. Use next instead.

## Other responses

- `400`: Error Response
- `403`: Error Response
- `default`: Error Response

---

[API](https://skmtc.dev/fireblocks/apis/fireblocks-api.md) - [All operations](https://skmtc.dev/fireblocks/apis/fireblocks-api/llms.txt) - [OpenAPI document](https://skmtc.dev/fireblocks/apis/fireblocks-api/revisions/4eba9965659a?raw)