---
title: "Query Audit Logs"
method: GET
path: "/api/v1/logs/audit"
tags: ["Query"]
---

# Query Audit Logs

`GET /api/v1/logs/audit`

Paginates forward in time from a given audit log ID. It takes a log ID parameter to begin fetching from and a take parameter for the number of log entries to fetch.

For a complete list of all audit log types and their descriptions, see the [Audit Logs Guide](/guides/audit_logs#audit-log-types).

## Query parameters

- `from` string, uuid, required — Audit log ID to begin fetching from.
- `take` integer, required — Number of audit log entries to fetch, max 1000
- `log_type` string — Optional filter to return only logs of a specific type. For Microsoft add-in activity, use add-in-specific log types such as `user:word_add_in_docx_drafting` or `user:outlook_add_in_ask`. See the [Audit Logs Guide](/guides/audit_logs#audit-log-types) for a complete list of log types.

## Response `200`

List of audit log entries

- AuditLog[]
  - `data` object, required — Optional metadata for certain event types.
    - `begin_date` string, date-time — Start timestamp of system-level event window.
    - `end_date` string, date-time — End timestamp of system-level event window.
    - `num_events` integer — Number of events captured by the system-level log.
    - `event_id` integer — Optional identifier for the underlying user action.
  - `id` string, uuid, required — Unique identifier for the log entry.
  - `ip` string, required — IP address of the actor.
  - `timestamp` string, date-time, required — Date when the event occurred in ISO format.
  - `type` string, required — Type of audit log event. Microsoft add-in activity is returned through the same Audit Log API, with event types such as `user:word_add_in_docx_drafting` and `user:outlook_add_in_ask`. We may add more types at any time, so in developing and maintaining your code, you should not assume that only these types exist. For a complete list of all audit log types and their descriptions, see the [Audit Logs Guide](/guides/audit_logs#audit-log-types).
  - `user` string, required — Email of the user who triggered the event.
  - `user_agent` string, required — User agent of the actor who triggered the event.

## Other responses

- `400` — Bad request.
- `401` — Unauthorized.
- `429` — Rate limit exceeded.
- `500` — Internal server error.

---

[API](https://skmtc.dev/harvey/apis/harvey-client-matter-api.md) · [All operations](https://skmtc.dev/harvey/apis/harvey-client-matter-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/harvey/harvey-client-matter-api/revisions/4a9e0925d49e/schema)