---
title: "List Protection Audit Events"
method: GET
path: "/v1/organizations/{organization_id}/protection/audit"
tags: ["Protection API"]
---

# List Protection Audit Events

`GET /v1/organizations/{organization_id}/protection/audit`

## Request

- Base URL: `https://identity.sandbox.lerian.net`
- URL: `https://identity.sandbox.lerian.net/v1/organizations/{organization_id}/protection/audit`
- Auth: none required
- TypeScript: <https://skmtc.dev/lerian/apis/identity-plugin/docs/v1/organizations/:organization_id/protection/audit/get.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `organization_id` string, uuid, required

## Query parameters

- `limit` string: Maximum number of events to return (default 20)
- `cursor` string: Opaque pagination cursor
- `sort_order` string: Sort order: asc or desc (default desc)
- `action` string: Filter by action
- `actor` string: Filter by actor
- `outcome` string: Filter by outcome: success, failure, or already_exists
- `start_date` string: Inclusive lower time bound (yyyy-mm-dd or RFC3339)
- `end_date` string: Inclusive upper time bound (yyyy-mm-dd or RFC3339)

## Headers

- `X-Request-Id` string, uuid
- `Authorization` string

## Response `200`

OK

- AuditEventsEnvelope
  - `items` AuditEventResponse[], nullable, required
    - `action` string, required
    - `actor` string, required
    - `from_status` string, required
    - `id` string, required
    - `outcome` string, required
    - `reason` string, required
    - `request_id` string, required
    - `timestamp` string, required
    - `to_status` string, required
  - `limit` integer, required
  - `next_cursor` string
  - `organization_id` string, required
  - `prev_cursor` string

## Other responses

- `default`: Error

---

[API](https://skmtc.dev/lerian/apis/identity-plugin.md) - [All operations](https://skmtc.dev/lerian/apis/identity-plugin/llms.txt) - [OpenAPI document](https://skmtc.dev/lerian/apis/identity-plugin/revisions/25daba385532?raw)