---
title: "Retrieve audit logs"
method: GET
path: "/account-info/2026-09/activity/audit-logs"
tags: ["Basic"]
---

# Retrieve audit logs

`GET /account-info/2026-09/activity/audit-logs`

## Request

- Base URL: `https://api.hubapi.com`
- URL: `https://api.hubapi.com/account-info/2026-09/activity/audit-logs`
- Auth: OAuth 2
  - Authorization code: `https://app.hubspot.com/oauth/authorize`
  - Token URL: `https://api.hubapi.com/oauth/v1/token` scopes: `account-info.security.read`

Retrieve activity history for user actions related to approvals, content updates, CRM object updates, security activity, and more (Enterprise only). Learn more about [activities included in audit log exports](https://knowledge.hubspot.com/account-management/view-and-export-account-activity-history-in-a-centralized-audit-log?hubs_content=knowledge.hubspot.com/account-management/view-and-export-account-activity-history&hubs_content-cta=centralized%20audit%20log#data-included-in-the-centralized-audit-log).

## Query parameters

- `actingUserId` integer[]
- `after` string
- `fillFinalTimestamp` boolean
- `limit` integer
- `occurredAfter` string, date-time
- `occurredBefore` string, date-time
- `sort` string[]

## Response `200`

successful operation

- CollectionResponsePublicApiUserActionEventForwardPaging
  - `paging` ForwardPaging: Paging information for forward-only pagination. Contains the next page reference when more results are available; omitted or empty on the last page.
    - `next` NextPage: Specifies the paging information needed to retrieve the next set of results in a paginated API response
      - `after` string, required: A string token used as a cursor to fetch the next set of results in a paged response.
      - `link` string: A URL string that provides a direct link to the next page of results.
  - `results` PublicApiUserActionEvent[], required: An array of user action events, each represented by a PublicApiUserActionEvent object.
    - `actingUser` ActingUser, required
      - `userEmail` string: The email address of the user who performed the action.
      - `userId` integer, required: The user's unique ID.
    - `action` string, required: The type of action taken.
    - `category` string, required: The category of the activity.
    - `id` string, required: The login activity's unique ID.
    - `occurredAt` string, date-time, required: The time that the action occurred at.
    - `subCategory` string: The subcategory of the activity.
    - `targetObjectId` string: The ID of the impacted object.

## Other responses

- `default`: An error occurred.

## Changes

- **2026-09-03** (2026-09) `fc8daf99a7ab`: 2 info
  - api operation id `get-/account-info/2026-09/activity/audit-logs_/account-info/2026-03/activity/audit-logs` removed and replaced with `get-/account-info/2026-09/activity/audit-logs`
  - the endpoint scheme security `private_apps` was removed from the API

[Operation history](https://skmtc.dev/hubspot/apis/account-audit-logs/changes/account-info/2026-09/activity/audit-logs/get.md)

---

[API](https://skmtc.dev/hubspot/apis/account-audit-logs.md) - [All operations](https://skmtc.dev/hubspot/apis/account-audit-logs/llms.txt) - [OpenAPI document](https://skmtc.dev/hubspot/apis/account-audit-logs/revisions/a72e651dd43b?raw)