---
title: "Get Audit Logs"
method: GET
path: "/api/v1/audit-logs"
tags: ["audit-logs"]
---

# Get Audit Logs

`GET /api/v1/audit-logs`

Retrieve audit log records for the authenticated user's organization in OCSF format.

Requires both start_time and end_time parameters to filter logs within a date range.
Supports cursor-based pagination.

Returns results in OCSF API Activity (Class UID: 6003) format,
which is compatible with security monitoring and SIEM tools.
Reference: https://schema.ocsf.io/1.7.0/classes/api_activity

## Query parameters

- `limit` integer — Number of items to return
- `cursor` string, nullable — Cursor for pagination (base64-encoded JSON string)
- `workspace_id` string, uuid, nullable — Filter by workspace ID
- `start_time` string, date-time, required — Start datetime (inclusive) in ISO 8601 format
- `end_time` string, date-time, required — End datetime (inclusive) in ISO 8601 format

## Response `200`

Successful Response

- ListAuditLogsOCSFResponse — Response model for listing audit logs in OCSF format with pagination.
  - `cursor` string, nullable, required
  - `items` OCSFApiActivity[], required
    - `class_uid` 6003, required — OCSF class UIDs.
    - `class_name` 'API Activity', required — OCSF class names.
    - `category_uid` 6, required — OCSF category UIDs.
    - `category_name` 'Application Activity', required — OCSF category names.
    - `severity_id` 99, required — Severity levels for OCSF events.
    - `type_uid` 600300 | 600301 | 600302 | 600303 | 600304 | 600399, required — OCSF type UIDs for API Activity (class_uid * 100 + activity_id).
    - `activity_id` 0 | 1 | 2 | 3 | 4 | 99, required — Activity types for API Activity class.
    - `activity_name` string, required
    - `status_id` 0 | 1 | 2 | 99, required — Status values for OCSF events.
    - `status` string, required
    - `time` integer, required
    - `metadata` OCSFMetadata, required — OCSF event metadata.
      - `uid` string, uuid, required
      - `product` OCSFProduct, required — OCSF product object.
        - `name` string, required
        - `vendor_name` string, required
    - `api` OCSFApi, required — OCSF API details object.
      - `operation` 'create_api_key' | 'delete_api_key' | 'create_personal_access_token' | 'delete_personal_access_token' | 'create_service_key' | 'delete_service_key' | 'create_role' | 'update_role' | 'delete_role' | 'invite_user_to_org' | 'invite_users_to_org_batch' | 'add_basic_auth_users_to_org' | 'update_basic_auth_user' | 'delete_org_pending_member' | 'delete_org_member' | 'update_org_member' | 'create_sso_settings' | 'update_sso_settings' | 'delete_sso_settings' | 'update_default_sso_provision_organization' | 'update_login_methods' | 'update_organization_info' | 'update_business_info' | 'update_payment_plan' | 'update_payment_method' | 'create_payment_setup_intent' | 'create_payment_checkout_session' | 'confirm_payment_checkout_session' | 'create_payment_account_link' | 'create_workspace' | 'update_workspace' | 'delete_workspace' | 'add_member_to_workspace' | 'add_members_to_workspace_batch' | 'delete_workspace_member' | 'update_workspace_member' | 'delete_workspace_pending_member' | 'update_workspace_secrets' | 'unshare_entities' | 'set_tenant_handle' | 'create_tag_key' | 'update_tag_key' | 'delete_tag_key' | 'create_tag_value' | 'update_tag_value' | 'delete_tag_value' | 'create_tagging' | 'delete_tagging' | 'create_bulk_export' | 'cancel_bulk_export' | 'create_bulk_export_destination' | 'update_bulk_export_destination' | 'update_ttl_settings' | 'update_usage_limit' | 'delete_usage_limit' | 'create_model_price_map' | 'update_model_price_map' | 'delete_model_price_map' | 'create_chart' | 'update_chart' | 'delete_chart' | 'create_chart_section' | 'update_chart_section' | 'delete_chart_section' | 'clone_chart_section' | 'create_org_chart' | 'update_org_chart' | 'delete_org_chart' | 'create_org_chart_section' | 'update_org_chart_section' | 'delete_org_chart_section' | 'create_deployment' | 'update_deployment' | 'delete_deployment', required — Operations that can be logged in audit_logs database table. NOTE: not all of @audit_log_operation(<log name>) names are currently used here. NOTE: OCSF mapping: endpoints with POST method and operation prefixed with "update_" map to OCSF UPDATE activity type.
    - `http_request` OCSFHttpRequest, required — OCSF HTTP request object.
      - `http_method` string, required
      - `url` OCSFUrl, required — OCSF URL object.
        - `path` string, required
    - `http_response` OCSFHttpResponse, required — OCSF HTTP response object.
      - `code` integer, nullable, required
    - `actor` OCSFActor, required — OCSF actor object.
      - `user` OCSFUser, required — OCSF user object within actor.
        - `uid` string, uuid, nullable, required
        - `credential_uid` string, uuid, nullable, required
    - `src_endpoint` OCSFEndpoint, required — OCSF network endpoint object.
      - `ip` string, nullable, required
      - `port` integer, nullable, required
      - `intermediate_ips` string[], nullable, required
    - `resources` OCSFResourceDetails[], required
      - `uid` string, uuid, required
    - `unmapped` OCSFUnmapped, required — OCSF unmapped attribute for source-specific data. Reference: https://schema.ocsf.io/1.7.0/classes/base_event
      - `original_audit_log` AuditLogMessage, required — Represents an audit log message.
        - `id` string, uuid, required
        - `operation_name` string, required
        - `resource_ids` string[], nullable, required
        - `operation_succeeded` boolean, nullable, required
        - `request_time` string, date-time, required
        - `request_method` string, required
        - `request_path` string, required
        - `client_host` string, nullable, required
        - `client_port` integer, nullable, required
        - `x_forwarded_for` string, nullable, required
        - `api_key_id` string, uuid, nullable, required
        - `user_id` string, uuid, nullable, required
        - `ls_user_id` string, uuid, nullable, required
        - `organization_id` string, uuid, nullable, required
        - `workspace_id` string, uuid, nullable, required
        - `response_status_code` integer, nullable, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/langchain-ai/apis/langsmith.md) · [All operations](https://skmtc.dev/langchain-ai/apis/langsmith/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/langchain-ai/langsmith/revisions/7bbcecd856b2/schema)