---
title: "Retrieve Earliest Audit Log"
method: GET
path: "/api/v1/logs/audit/earliest"
tags: ["Retrieve"]
---

# Retrieve Earliest Audit Log

`GET /api/v1/logs/audit/earliest`

Returns the earliest audit log for the workspace. Useful to begin pagination to get more logs.

For a complete list of all audit log types and their descriptions, see the [Audit Logs Guide](/guides/audit_logs#audit-log-types).

## Query parameters

- `log_type` string — Optional filter to return only logs of a specific type. For Microsoft add-in activity, use add-in-specific log types such as `user:word_add_in_docx_drafting` or `user:outlook_add_in_ask`. See the [Audit Logs Guide](/guides/audit_logs#audit-log-types) for a complete list of log types.

## Response `200`

Earliest audit log entry

- AuditLogResponse
  - `log` AuditLog, required
    - `data` object, required — Optional metadata for certain event types.
      - `begin_date` string, date-time — Start timestamp of system-level event window.
      - `end_date` string, date-time — End timestamp of system-level event window.
      - `num_events` integer — Number of events captured by the system-level log.
      - `event_id` integer — Optional identifier for the underlying user action.
    - `id` string, uuid, required — Unique identifier for the log entry.
    - `ip` string, required — IP address of the actor.
    - `timestamp` string, date-time, required — Date when the event occurred in ISO format.
    - `type` string, required — Type of audit log event. Microsoft add-in activity is returned through the same Audit Log API, with event types such as `user:word_add_in_docx_drafting` and `user:outlook_add_in_ask`. We may add more types at any time, so in developing and maintaining your code, you should not assume that only these types exist. For a complete list of all audit log types and their descriptions, see the [Audit Logs Guide](/guides/audit_logs#audit-log-types).
    - `user` string, required — Email of the user who triggered the event.
    - `user_agent` string, required — User agent of the actor who triggered the event.

## Other responses

- `400` — Bad request.
- `401` — Unauthorized.
- `429` — Rate limit exceeded.
- `500` — Internal server error.

---

[API](https://skmtc.dev/harvey/apis/harvey-client-matter-api.md) · [All operations](https://skmtc.dev/harvey/apis/harvey-client-matter-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/harvey/harvey-client-matter-api/revisions/4a9e0925d49e/schema)