---
title: "Pull Audit Logs"
method: GET
path: "/v2/audit-logs"
tags: ["audit-logs"]
---

# Pull Audit Logs

`GET /v2/audit-logs`

## Request

- Base URL: `https://api.getauctor.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.getauctor.com/v2/audit-logs`
- Auth: none declared

Pull your organization's audit events for ingestion into a SIEM or archive. Events are returned **oldest-first** as newline-delimited JSON (`application/x-ndjson`) by default, or as CSV with the same columns as the Settings → Organization → Audit Logs download.

Results are always scoped to the organization the credential belongs to. Pagination is cursor-based: when more events match, the response carries an `X-Next-Cursor` header — pass it as `cursor` on the next request and keep the same `since`/`until` window.

Reading the trail is itself an audited event: every pull records an `audit.pulled` event for the calling organization before the body is served, deduplicated to one event per credential per UTC day. If that event cannot be recorded the request fails with `500` and returns no events — retry the same request.

## Query parameters

- `since` string, date-time, nullable: Inclusive lower bound on the event timestamp (ISO-8601 UTC, e.g. `2026-07-01T00:00:00Z`). Omit to start from the oldest retained event.
- `until` string, date-time, nullable: Exclusive upper bound on the event timestamp (ISO-8601 UTC).
- `cursor` string, nullable: Opaque cursor from the `X-Next-Cursor` header of a prior response.
- `limit` integer: Page size (1–1000). Events are returned oldest-first.
- `format` 'jsonl' | 'csv': Response body format. `jsonl` (default) is the SIEM primary; `csv` matches the Settings download columns.

## Response `200`

Successful Response

## Other responses

- `400`: Invalid `since`, `until`, or `cursor`
- `422`: Validation error for `limit` (outside 1–1000) or `format` (not `jsonl` or `csv`). Timestamp and cursor problems return `400` instead.
- `500`: The pull could not be recorded in the audit trail; no events were returned. Retry the same request.

## Changes

- **2026-09-01** `aeb6faa3b8f0`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/getauctor/apis/getauctor-api/changes/v2/audit-logs/get.md)

---

[API](https://skmtc.dev/getauctor/apis/getauctor-api.md) - [All operations](https://skmtc.dev/getauctor/apis/getauctor-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getauctor/apis/getauctor-api/revisions/be39c59c13f6?raw)