---
title: "Get a list of audit logs"
method: GET
path: "/audit_logs"
tags: ["Audit Logs"]
---

# Get a list of audit logs

`GET /audit_logs`

## Query parameters

- `page` integer
- `per_page` integer
- `start_time` string
- `end_time` string
- `actor_user_id` string, uuid4
- `actor_email` string, email
- `meta_source_ip` union
  - string, ipv4
  - string, ipv6
- `q` string
- `type` AuditLogTypes[]

## Response `200`

Details about audit logs

- AuditLog[]
  - `id` string, uuid4, required
  - `type` 'user_logged_out' | 'password_set_succeeded' | 'password_set_failed' | 'password_login_succeeded' | 'password_login_failed' | 'passcode_login_init_succeeded' | 'passcode_login_init_failed' | 'passcode_login_final_succeeded' | 'passcode_login_final_failed' | 'webauthn_registration_init_succeeded' | 'webauthn_registration_init_failed' | 'webauthn_registration_final_succeeded' | 'webauthn_registration_final_failed' | 'webauthn_authentication_init_succeeded' | 'webauthn_authentication_init_failed' | 'webauthn_authentication_final_succeeded' | 'webauthn_authentication_final_failed' | 'webauthn_credential_updated' | 'webauthn_credential_deleted' | 'thirdparty_signup_succeeded' | 'thirdparty_signin_succeeded' | 'thirdparty_linking_succeeded' | 'thirdparty_signin_signup_failed' | 'token_exchange_succeeded' | 'token_exchange_failed' | 'user_created' | 'email_created' | 'email_verified' | 'email_deleted' | 'primary_email_changed' | 'user_deleted' | 'login_success' | 'login_failure' | 'otp_created' | 'passkey_created' | 'passkey_deleted' | 'security_key_created' | 'username_changed' | 'username_deleted' | 'password_changed' | 'password_deleted', required — The type of the audit log
  - `error` string — A more detailed message why something failed
  - `meta_http_request_id` string, required — The ID of the corresponding http request
  - `meta_source_ip` string, ip-address, required — The IP from where the http request came from
  - `meta_user_agent` string, required — The user agent from where the http request came from
  - `actor_user_id` string, uuid4
  - `actor_email` string, email — The email from the actor
  - `created_at` string, date-time, required — Time of creation of the audit log

## Other responses

- `500` — Internal server error

---

[API](https://skmtc.dev/hanko/apis/hanko-admin-api.md) · [All operations](https://skmtc.dev/hanko/apis/hanko-admin-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/hanko/hanko-admin-api/revisions/d22a127b0978/schema)