---
title: "Getting Audit Log Entries"
method: GET
path: "/v1/audits"
tags: ["Server Audit Logs"]
---

# Getting Audit Log Entries

`GET /v1/audits`

This resource allows access to those log entries, with some paging and filtering options. These are provided by querystring parameters: `action` allows filtering by the action types listed above, `start` and `end` allow filtering by log timestamp (see below), and `limit` and `offset` control paging. If no paging parameters are given, the server will attempt to return every audit log entry that it has.

The `start` and `end` parameters work based on exact timestamps, given in [ISO 8601](https://en.wikipedia.org/wiki/ISO_8601) format. It is possible to provide just a datestring (eg `2000-01-01`), in which case midnight will be inferred. But this value alone leaves the timezone unspecified. When no timezone is given, the server's local time will be used: the standard [Docker deployment](https://docs.getodk.org/central-install/) will always set server local time to UTC, but installations may have been customized, and there is no guarantee the UTC default hasn't been overridden.

For this reason, **we recommend always setting a timezone** when querying based on `start` and `end`: either by appending a `z` to indicate UTC (eg `2000-01-01z`) or by explicitly specifying a timezone per ISO 8601 (eg `2000-01-01+08`). The same applies for full timestamps (eg `2000-01-01T12:12:12z`, `2000-01-01T12:12:12+08`).

`start` may be given without `end`, and vice versa, in which case the timestamp filter will only be bounded on the specified side. `start` is inclusive, and `end` is exclusive (`>=` and `<`, respectively).

This endpoint supports retrieving extended metadata; provide a header `X-Extended-Metadata: true` to additionally expand the `actorId` into full `actor` details, and `acteeId` into full `actee` details. The `actor` will always be an Actor, but the `actee` may be an Actor, a Project, a Form, or some other type of object depending on the type of action.

## Query parameters

- `action` string
- `start` string
- `end` string
- `limit` number
- `offset` number

## Response `200`

OK

- Audit[]
  - `actorId` number — The ID of the actor, if any, that initiated the action.
  - `action` string, required — The action that was taken.
  - `acteeId` string — The ID of the permissioning object against which the action was taken.
  - `details` object — Additional details about the action that vary according to the type of action.
  - `loggedAt` string, required — ISO date format

## Other responses

- `400` — Bad Request

## Changes

- **2025-12-20** `022694254f0d` — 1 info
  - api operation id `Getting Audit Log Entries` removed and replaced with `getAuditLogEntries`
- **2025-10-27** `b11b54eea487` — 1 info
  - removed the non-success response with the status `403`
- **2025-03-13** `e8c2858fd4eb` — 2 info
  - api operation id `getAuditLogEntries` removed and replaced with `Getting Audit Log Entries`
  - added the non-success response with the status `403`

[Change history](https://skmtc.dev/getodk/apis/odk-central-api/changes/v1/audits/get.md)

---

[API](https://skmtc.dev/getodk/apis/odk-central-api.md) · [All operations](https://skmtc.dev/getodk/apis/odk-central-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/getodk/odk-central-api/revisions/d4f5ba77f644/schema)