--- title: "List Audit Logs" method: GET path: "/v1/organizations/audit/logs" tags: ["Organization Audit"] --- # List Audit Logs `GET /v1/organizations/audit/logs` ## Request - Base URL: `https://api.mixpeek.com` - URL: `https://api.mixpeek.com/v1/organizations/audit/logs` - Auth: HTTP bearer List organization audit logs with filtering and pagination. Returns audit events for the organization, sorted by timestamp descending. Requires ADMIN permission. ## Query parameters - `resource_type` 'organization' | 'user' | 'api_key' | 'namespace' | 'collection' | 'document' | 'bucket' | 'retriever' | 'cluster' | 'taxonomy' | 'storage_connection' | 'alert' | 'annotation' | 'secret' | 'webhook': Resource surfaces supported by scoped API keys and audit events. These resource types can be used in: - API key scopes to restrict access to specific resources - Audit logs to identify what type of resource was affected - Permission systems to grant/deny access to resource categories Resource hierarchy: ORGANIZATION -> USER, API_KEY, STORAGE_CONNECTION NAMESPACE -> COLLECTION, BUCKET, RETRIEVER, CLUSTER, TAXONOMY Resource types: - ORGANIZATION: Top-level tenant entity - USER: Organization member with authentication credentials - API_KEY: Authentication token for programmatic access - NAMESPACE: Isolated environment for data and compute resources - COLLECTION: Vector database collection for searchable documents - DOCUMENT: A single searchable document within a collection - BUCKET: Object storage container for raw files - RETRIEVER: Configured search/retrieval pipeline - CLUSTER: Ray compute cluster for distributed processing - TAXONOMY: Hierarchical classification system for documents - STORAGE_CONNECTION: External storage provider integration - `resource_id` string, nullable: Filter by resource ID - `actor_id` string, nullable: Filter by actor ID - `action` 'user_created' | 'user_updated' | 'user_deleted' | 'api_key_created' | 'api_key_rotated' | 'api_key_revoked' | 'api_key_scope_updated' | 'api_key_internal_flagged' | 'permission_updated' | 'storage_connection_created' | 'storage_connection_updated' | 'storage_connection_deleted' | 'storage_connection_tested' | 'storage_connection_failed' | 'namespace_created' | 'namespace_updated' | 'namespace_deleted' | 'namespace_accessed' | 'collection_created' | 'collection_updated' | 'collection_deleted' | 'collection_accessed' | 'document_deleted' | 'document_bulk_soft_deleted' | 'bucket_created' | 'bucket_updated' | 'bucket_deleted' | 'bucket_accessed' | 'retriever_created' | 'retriever_updated' | 'retriever_deleted' | 'retriever_accessed' | 'retriever_queried' | 'cluster_created' | 'cluster_updated' | 'cluster_deleted' | 'cluster_executed' | 'cluster_accessed' | 'taxonomy_created' | 'taxonomy_updated' | 'taxonomy_deleted' | 'taxonomy_accessed' | 'alert_created' | 'alert_updated' | 'alert_deleted' | 'alert_accessed' | 'alert_triggered' | 'annotation_created' | 'annotation_updated' | 'annotation_deleted' | 'secret_created' | 'secret_updated' | 'secret_deleted' | 'secret_accessed' | 'webhook_created' | 'webhook_updated' | 'webhook_deleted': Canonical audit log actions captured for organization events. These events are written to the audit trail for compliance, security monitoring, and debugging. Each action includes actor, resource, timestamp, and change details. User lifecycle actions: - USER_CREATED: New user added to organization - USER_UPDATED: User role, status, or metadata modified - USER_DELETED: User removed from organization API key lifecycle actions: - API_KEY_CREATED: New API key generated - API_KEY_ROTATED: Key regenerated (old key revoked, new key issued) - API_KEY_REVOKED: Key manually revoked - API_KEY_SCOPE_UPDATED: Key permissions or scopes modified Permission actions: - PERMISSION_UPDATED: User or key permissions modified Storage connection actions: - STORAGE_CONNECTION_CREATED: New external storage connection configured - STORAGE_CONNECTION_UPDATED: Connection settings or credentials updated - STORAGE_CONNECTION_DELETED: Connection permanently removed - STORAGE_CONNECTION_TESTED: Connection health check performed - STORAGE_CONNECTION_FAILED: Connection health check or sync failed Namespace actions: - NAMESPACE_CREATED: New namespace created - NAMESPACE_UPDATED: Namespace configuration modified - NAMESPACE_DELETED: Namespace permanently removed - NAMESPACE_ACCESSED: Namespace read (when read auditing enabled) Collection actions: - COLLECTION_CREATED: New collection created - COLLECTION_UPDATED: Collection configuration modified - COLLECTION_DELETED: Collection permanently removed - COLLECTION_ACCESSED: Collection read (when read auditing enabled) Document actions: - DOCUMENT_DELETED: Single document removed by ID - DOCUMENT_BULK_SOFT_DELETED: A bulk/batch document delete operation ran (explicit IDs or filter mode). ONE event per operation, not one per document — carries the count, the collection_id(s), an optional caller-supplied reason, and the actor from request context. Before this action existed, a document-level wipe (bulk-soft-delete or any other document delete path) was invisible to the audit trail entirely. Bucket actions: - BUCKET_CREATED: New bucket created - BUCKET_UPDATED: Bucket configuration modified - BUCKET_DELETED: Bucket permanently removed - BUCKET_ACCESSED: Bucket read (when read auditing enabled) Retriever actions: - RETRIEVER_CREATED: New retriever pipeline created - RETRIEVER_UPDATED: Retriever configuration modified - RETRIEVER_DELETED: Retriever permanently removed - RETRIEVER_ACCESSED: Retriever read (when read auditing enabled) - RETRIEVER_QUERIED: Retriever query executed (when read auditing enabled) Cluster actions: - CLUSTER_CREATED: New cluster created - CLUSTER_UPDATED: Cluster configuration modified - CLUSTER_DELETED: Cluster permanently removed - CLUSTER_EXECUTED: Cluster job executed - CLUSTER_ACCESSED: Cluster read (when read auditing enabled) Taxonomy actions: - TAXONOMY_CREATED: New taxonomy created - TAXONOMY_UPDATED: Taxonomy configuration modified - TAXONOMY_DELETED: Taxonomy permanently removed - TAXONOMY_ACCESSED: Taxonomy read (when read auditing enabled) - `start` string, nullable: ISO8601 start timestamp - `end` string, nullable: ISO8601 end timestamp - `skip` integer: Number of results to skip - `limit` integer: Number of results to return ## Response `200` Successful Response - AuditEventListResponse: Response for listing audit events. - `results` AuditEventResponse[], required: Audit events - `audit_id` string, required: Unique audit event identifier - `timestamp` unknown, required - `resource_type` string, required: Type of resource affected - `resource_id` string, required: ID of the affected resource - `action` string, required: Action performed - `actor_id` string, required: Who performed the action - `actor_type` string: Type of actor - `status` string: Status of the action - `changes` unknown - `reason` string, nullable: Caller-supplied reason for the change (the WHY), captured from the X-Change-Reason request header when present. - `ip_address` string, nullable: Request IP address - `user_agent` string, nullable: Request user agent - `actor_name` string, nullable: Resolved actor display name - `actor_email` string, nullable: Resolved actor email - `actor_key_name` string, nullable: API key name used - `total` integer, required: Total count matching filters - `skip` integer, required: Number of results skipped - `limit` integer, required: Number of results returned ## Other responses - `400`: Bad Request - `401`: Unauthorized - `403`: Forbidden - `404`: Not Found - `422`: Unprocessable Entity - `429`: Too Many Requests - `500`: Internal Server Error - `503`: Service Unavailable ## Changes - **2026-10-09** `61a175e8eb9a`: 1 warning, 5 info - removed the optional property `detail` from the response with the `422` status - added the non-success response with the status `429` - added the non-success response with the status `503` - added the optional property `success` to the response with the `422` status - …2 more - **2026-09-11** `67333a479215`: 1 info - added the enum value `secret_accessed` to the property `anyOf[subschema #1: AuditAction]/` of the `query` request parameter `action` - **2026-08-24** `b40f559d564a`: 1 info - added the optional property `results/items/reason` to the response with the `200` status - **2026-08-09** `5d4c905106b4`: 1 info - the endpoint scheme security `BearerAuth` was added to the API - **2026-08-05** `fdb4bdd01a64`: 3 info - added the enum value `document` to the property `anyOf[subschema #1: ResourceType]/` of the `query` request parameter `resource_type` - added the enum value `document_bulk_soft_deleted` to the property `anyOf[subschema #1: AuditAction]/` of the `query` request parameter `action` - added the enum value `document_deleted` to the property `anyOf[subschema #1: AuditAction]/` of the `query` request parameter `action` [Operation history](https://skmtc.dev/mixpeek/apis/mixpeek-api/changes/v1/organizations/audit/logs/get.md) --- [API](https://skmtc.dev/mixpeek/apis/mixpeek-api.md) - [All operations](https://skmtc.dev/mixpeek/apis/mixpeek-api/llms.txt) - [OpenAPI document](https://skmtc.dev/mixpeek/apis/mixpeek-api/revisions/790bc16455f6?raw)