---
title: "List audit logs"
method: GET
path: "/audit-logs"
tags: ["Audit Logs"]
---

# List audit logs

`GET /audit-logs`

API for searching audit logs. Limited to at most 30 day search, returns up to 100 records per page. Not recommended for bulk export.

## Query parameters

- `start` string, date-time, required
- `end` string, date-time, required
- `auth_strategy` string
- `service` string
- `method` string
- `exclude_method` string[]
- `search` string
- `search_user_id` string[]
- `limit` integer
- `page_token` string

## Response `200`

A list of audit log records.

- AuditLogEntry[]
  - `timestamp` string, date-time, required — UTC time when the request was received.
  - `auth_strategy` string, required — Authentication strategy used for the request.
  - `user_id` string, required — ID of the authenticated user, if any.
  - `email` string, required — Email of the authenticated user at request time, if any.
  - `status` integer, required — HTTP response status code.
  - `method` string, required — HTTP method.
  - `path` string, required — Request path.
  - `route` string, required — Matched API route pattern, if available.
  - `domain` string, required — Request host.
  - `duration_ms` integer, required — Request duration in milliseconds.
  - `client_ip` string, required — Client IP address.
  - `user_agent` string, required — User agent header.

## Other responses

- `400` — Bad Request – invalid input
- `401` — Unauthorized – missing or invalid authorization token
- `500` — Internal Server Error

## Changes

- **2026-07-13** `b1aad48700bb` — 1 breaking
  - for the `query` request parameter `exclude_method`, the type/format was changed from `string`/`` to `array`/``
- **2026-06-11** `a7f3b5261f94` — 1 warning
  - deleted the `query` request parameter `search_email`
- **2026-06-09** `2bcd3138d93d` — 2 info
  - added the new optional `query` request parameter `search_email`
  - added the required property `items/email` to the response with the `200` status
- **2026-05-29** `37e7523b38de` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/kernel/apis/kernel-api/changes/audit-logs/get.md)

---

[API](https://skmtc.dev/kernel/apis/kernel-api.md) · [All operations](https://skmtc.dev/kernel/apis/kernel-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/kernel/kernel-api/revisions/9e8ce9fcf5e1/schema)