---
title: "List audit logs"
method: GET
path: "/audit/logs"
---

# List audit logs

`GET /audit/logs`

Retrieve your organisation’s audit log events as a paginated, cursor-based stream. This endpoint is intended for SIEM ingestion, such as a Splunk REST or modular input. Poll with `since=<next_cursor>` from the previous response to fetch only new events.

Audit logging must be enabled for your organisation. If audit logging is not enabled, the endpoint returns `403`. The organisation is derived from the API key which can be created in your organisations account.

Set the `Accept` header to `application/x-ndjson` to receive newline-delimited JSON instead of a single JSON object. In this mode, the next cursor is returned in the `X-Next-Cursor` response header rather than in a response field.

## Query parameters

- `since` string
- `limit` integer
- `event_type` string
- `from` string, date-time
- `to` string, date-time
- `actor` string

## Response `200`

Successful response

- object
  - `logs` AuditLogEntry[] — Audit events, ordered oldest to newest.
    - `seq` string — Monotonic ordering key (`created_at` + a doc-id tiebreak). Use this as the `since` cursor.
    - `timestamp` string, date-time — When the audited event occurred (defaults to `created_at` if not supplied by the producer).
    - `created_at` string, date-time — When the audit record was written; the field `from`/`to` filter against.
    - `org_id` string — Your organisation ID (always matches the API key's organisation).
    - `event_type` string — Dotted event taxonomy, e.g. `test.updated`, `login.succeeded`, `member.role_changed`, `api_key.created`.
    - `action` string — One of `create`, `update`, `delete`, `login`.
    - `actor` object — Who performed the action. System-originated writes use a `uid` like `api:uploadBuild` or `webhook:githubApp`.
      - `uid` string
      - `email` string, nullable
      - `ip` string, nullable
      - `user_agent` string, nullable
    - `target` object — What was acted on.
      - `type` string
      - `id` string
      - `name` string, nullable
    - `changes` object[] — Field-level diffs for update events (empty for pure events like logins). Sensitive fields are recorded as a salted hash (`{"masked": true, "hash": "..."}`) instead of plaintext.
      - `field` string
      - `old` unknown
      - `new` unknown
    - `source` string — Producer of the event: `cloud_function`, `backend`, or `client_reported`.
    - `metadata` object — Additional event-specific context.
  - `next_cursor` string, nullable — Pass as `since` to fetch the next page. `null` when the current page wasn't full (no more events yet).

## Other responses

- `403` — Audit logging is not enabled for this organisation, or the API key's scope isn't permitted to call this endpoint.

---

[API](https://skmtc.dev/mobileboost/apis/mobileboost-api.md) · [All operations](https://skmtc.dev/mobileboost/apis/mobileboost-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/mobileboost/mobileboost-api/revisions/005e59399710/schema)