---
title: "Pull Audit Logs"
method: GET
path: "/v2/audit-logs"
tags: ["audit-logs"]
---

# Pull Audit Logs

`GET /v2/audit-logs`

Pull your organization's audit events for ingestion into a SIEM or archive. Events are returned **oldest-first** as newline-delimited JSON (`application/x-ndjson`) by default, or as CSV with the same columns as the Settings → Organization → Audit Logs download.

Results are always scoped to the organization the credential belongs to. Pagination is cursor-based: when more events match, the response carries an `X-Next-Cursor` header — pass it as `cursor` on the next request and keep the same `since`/`until` window.

Reading the trail is itself an audited event: every pull records an `audit.pulled` event for the calling organization before the body is served, deduplicated to one event per credential per UTC day. If that event cannot be recorded the request fails with `500` and returns no events — retry the same request.

## Query parameters

- `since` string, date-time, nullable — Inclusive lower bound on the event timestamp (ISO-8601 UTC, e.g. `2026-07-01T00:00:00Z`). Omit to start from the oldest retained event.
- `until` string, date-time, nullable — Exclusive upper bound on the event timestamp (ISO-8601 UTC).
- `cursor` string, nullable — Opaque cursor from the `X-Next-Cursor` header of a prior response.
- `limit` integer — Page size (1–1000). Events are returned oldest-first.
- `format` 'jsonl' | 'csv' — Response body format. `jsonl` (default) is the SIEM primary; `csv` matches the Settings download columns.

## Response `200`

Successful Response

## Other responses

- `400` — Invalid `since`, `until`, or `cursor`
- `422` — Validation error for `limit` (outside 1–1000) or `format` (not `jsonl` or `csv`). Timestamp and cursor problems return `400` instead.
- `500` — The pull could not be recorded in the audit trail; no events were returned. Retry the same request.

---

[API](https://skmtc.dev/getauctor/apis/fastapi.md) · [All operations](https://skmtc.dev/getauctor/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/getauctor/fastapi/revisions/aeb6faa3b8f0/schema)