---
title: "Search enterprise audit-log events"
method: GET
path: "/v1/analytics/audit-logs/events"
tags: ["Analytics"]
---

# Search enterprise audit-log events

`GET /v1/analytics/audit-logs/events`

## Request

- Base URL: `https://api.magnific.com`
- URL: `https://api.magnific.com/v1/analytics/audit-logs/events`
- Auth: API key in header `x-magnific-api-key`

Returns the audit-log events of the caller's enterprise team: who did what,
to which resource, and how access changed.

Authenticates via API key (`X-Magnific-API-Key` header). The caller's enterprise
team and identity are resolved automatically from the API key.

Available exclusively for Enterprise plans with audit logs enabled, and only to team
**admins/owners**. Rate limit: 500 RPD.

Retention & paging:
- The audit index retains at most **30 days**; the query window cannot exceed 30
  days and defaults to the last 30 days when no dates are given.
- `per_page` is capped at **100**. In page mode, `page * per_page` cannot exceed
  **10000** (`400` otherwise) — use `cursor` for deep iteration.
- When `cursor` is provided, `page` is ignored and there is no depth limit. Follow
  `meta.next_cursor` until it is `null` to walk the whole history.

Reading your own audit trail costs no credits.

## Query parameters

- `page` integer
- `per_page` integer
- `date_from` string, date
- `date_to` string, date
- `member_id` integer[]
- `group_id` integer[]
- `folder_id` string[]
- `event_type` string[]
- `request_id` string
- `cursor` string

## Response `200`

OK

- V1AnalyticsAuditLogsEventsGet200Response
  - `data` AuditLogEvent[]
    - `event_id` string: Unique identifier of the event.
    - `date` string, date-time: When the event occurred (UTC, ISO-8601).
    - `action` AuditLogEventAction
      - `event_type` string: Canonical event type.
      - `verb` string: The action performed.
      - `status` string: Outcome status of the action.
      - `resource_id` string, nullable: Identifier of the resource the action happened to.
      - `request_id` string, nullable: Request identifier. Use the `request_id` filter to fetch all events of one request.
      - `correlation_id` string, nullable: Correlation identifier linking related events.
      - `old_state` object, nullable: Vetted subset of the resource state before the action.
      - `new_state` object, nullable: Vetted subset of the resource state after the action.
      - `duration_ms` integer, nullable: Action duration in milliseconds, when measured.
      - `data` object: Free-form event payload, narrowed to the public allow-list. Keys vary by `event_type` (e.g. `target_user_id`, `role`, `group_id`, `operation`, `project_reference`, `permission`, `outcome`).
      - `context` object, nullable: Additional contextual metadata for the event.
      - `project_name` string, nullable: Human-readable project name, resolved server-side from the event's project reference.
      - `folder_name` string, nullable: Human-readable folder name, resolved server-side from the event's folder reference.
    - `member` AuditLogEventMember: The actor that performed the action.
      - `type` string: Actor type.
      - `user_id` integer, nullable: Actor user ID.
      - `email` string, nullable: Actor email address.
    - `category` string, nullable: Resource category the event belongs to.
    - `source` AuditLogEventSource: Where the action originated.
      - `project` string, nullable: Originating product/project.
      - `platform` string, nullable: Originating platform.
      - `referer` string, nullable: Referer, when available.
  - `meta` V1AnalyticsAuditLogsEventsGet200ResponseMeta
    - `pagination` Pagination: Metainformation about pagination
      - `current_page` integer: The current page.
      - `per_page` integer: The limit of resources per page.
      - `last_page` integer: The total number of pages.
      - `total` integer: The total number of resources.
    - `next_cursor` string, nullable: Cursor for the next page, or `null` when there are no more pages.

## Other responses

- `400`: Bad Request - The server could not understand the request due to invalid syntax.
- `403`: Forbidden - The client does not have permission to access the requested resource.
- `404`: Not Found - The server can not find the requested resource.
- `429`: Too Many Requests - The client has sent too many requests in a given amount of time.
- `500`: Internal Server Error - The server has encountered a situation it doesn't know how to handle.
- `503`: Service Unavailable

---

[API](https://skmtc.dev/magnific/apis/magnific-api.md) · [All operations](https://skmtc.dev/magnific/apis/magnific-api/llms.txt) · [OpenAPI document](https://skmtc.dev/magnific/apis/magnific-api/revisions/60711fb082c7?raw)