---
title: "Search audit log entries"
method: POST
path: "/api/v2/auditlog"
tags: ["Audit log"]
---

# Search audit log entries

`POST /api/v2/auditlog`

Search your audit log entries. The query parameters let you restrict the results that return by date ranges, or a full-text search query. The request body lets you restrict the results that return by resource specifiers.

LaunchDarkly uses a resource specifier syntax to name resources or collections of resources. To learn more, read [About the resource specifier syntax](https://launchdarkly.com/docs/home/account/role-resources#about-the-resource-specifier-syntax).

## Query parameters

- `before` integer — A timestamp filter, expressed as a Unix epoch time in milliseconds. All entries returned occurred before the timestamp.
- `after` integer — A timestamp filter, expressed as a Unix epoch time in milliseconds. All entries returned occurred after the timestamp.
- `q` string, string — Text to search for. You can search for the full or partial name of the resource.
- `limit` integer — A limit on the number of audit log entries that return. Set between 1 and 20. The default is 10.

## Request body

- StatementPost[]
  - `resources` string[] — Resource specifier strings
  - `notResources` string[] — Targeted resources are the resources NOT in this list. The <code>resources</code> field must be empty to use this field.
  - `actions` ActionSpecifier[] — Actions to perform on a resource
  - `notActions` ActionSpecifier[] — Targeted actions are the actions NOT in this list. The <code>actions</code> field must be empty to use this field.
  - `effect` 'allow' | 'deny', required — Whether this statement should allow or deny actions on the resources.

## Response `200`

Audit log entries response

- AuditLogEntryListingRepCollection
  - `items` AuditLogEntryListingRep[], required — An array of audit log entries
    - `_links` object, required — The location and content type of related resources
    - `_id` string, required — The ID of the audit log entry
    - `_accountId` string, required — The ID of the account to which this audit log entry belongs
    - `date` integer, required
    - `accesses` ResourceAccess[], required — Details on the actions performed and resources acted on in this audit log entry
      - `action` string
      - `resource` string
    - `kind` string, required
    - `name` string, required — The name of the resource this audit log entry refers to
    - `description` string, required — Description of the change recorded in the audit log entry
    - `shortDescription` string, required — Shorter version of the change recorded in the audit log entry
    - `comment` string — Optional comment for the audit log entry
    - `subject` SubjectDataRep
      - `_links` object
      - `name` string — The subject's name
      - `avatarUrl` string — The subject's avatar
    - `member` MemberDataRep
      - `_links` object
      - `_id` string — The member ID
      - `email` string — The member email
      - `firstName` string — The member first name
      - `lastName` string — The member last name
    - `token` TokenSummary
      - `_links` object
      - `_id` string
      - `name` string — The name of the token
      - `ending` string — The last few characters of the token
      - `serviceToken` boolean — Whether this is a service token
    - `app` AuthorizedAppDataRep
      - `_links` object
      - `_id` string — The ID of the authorized application
      - `isScim` boolean — Whether the application is authorized through SCIM
      - `name` string — The authorized application name
      - `maintainerName` string — The name of the maintainer for this authorized application
    - `titleVerb` string — The action and resource recorded in this audit log entry
    - `title` string — A description of what occurred, in the format <code>member</code> <code>titleVerb</code> <code>target</code>
    - `target` TargetResourceRep
      - `_links` object
      - `name` string — The name of the resource
      - `resources` string[] — The resource specifier
    - `parent` ParentResourceRep
      - `_links` object
      - `name` string — The name of the parent resource
      - `resource` string — The parent's resource specifier
  - `_links` object, required — The location and content type of related resources

## Other responses

- `400` — Invalid request
- `401` — Invalid access token
- `403` — Forbidden
- `429` — Rate limited

---

[API](https://skmtc.dev/launchdarkly/apis/launchdarkly-rest-api.md) · [All operations](https://skmtc.dev/launchdarkly/apis/launchdarkly-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/launchdarkly/launchdarkly-rest-api/revisions/69c5c9aafe78/schema)