---
title: "Fetch a list of events from your Okta organization system log."
method: GET
path: "/api/v1/logs"
tags: ["Log"]
---

# Fetch a list of events from your Okta organization system log.

`GET /api/v1/logs`

## Request

- Base URL: `https://your-subdomain.okta.com`
- URL: `https://your-subdomain.okta.com/api/v1/logs`
- Auth: API key in header `Authorization`

The Okta System Log API provides read access to your organization’s system log. This API provides more functionality than the Events API

## Query parameters

- `since` string, date-time
- `until` string, date-time
- `filter` string
- `q` string
- `limit` integer
- `sortOrder` string
- `after` string

## Response `200`

Success

- LogEvent[]
  - `actor` LogActor
    - `alternateId` string
    - `detail` object
    - `displayName` string
    - `id` string
    - `type` string
  - `authenticationContext` LogAuthenticationContext
    - `authenticationProvider` 'OKTA_AUTHENTICATION_PROVIDER' | 'ACTIVE_DIRECTORY' | 'LDAP' | 'FEDERATION' | 'SOCIAL' | 'FACTOR_PROVIDER'
    - `authenticationStep` integer
    - `credentialProvider` 'OKTA_AUTHENTICATION_PROVIDER' | 'OKTA_CREDENTIAL_PROVIDER' | 'RSA' | 'SYMANTEC' | 'GOOGLE' | 'DUO' | 'YUBIKEY' | 'APPLE'
    - `credentialType` 'OTP' | 'SMS' | 'PASSWORD' | 'ASSERTION' | 'IWA' | 'EMAIL' | 'OAUTH2' | 'JWT'
    - `externalSessionId` string
    - `interface` string
    - `issuer` LogIssuer
      - `id` string
      - `type` string
  - `client` LogClient
    - `device` string
    - `geographicalContext` LogGeographicalContext
      - `city` string
      - `country` string
      - `geolocation` LogGeolocation
        - `lat` number, double
        - `lon` number, double
      - `postalCode` string
      - `state` string
    - `id` string
    - `ipAddress` string
    - `userAgent` LogUserAgent
      - `browser` string
      - `os` string
      - `rawUserAgent` string
    - `zone` string
  - `debugContext` LogDebugContext
    - `debugData` object
  - `displayMessage` string
  - `eventType` string
  - `legacyEventType` string
  - `outcome` LogOutcome
    - `reason` string
    - `result` string
  - `published` string, date-time
  - `request` LogRequest
    - `ipChain` LogIpAddress[]
      - `geographicalContext` LogGeographicalContext
        - `city` string
        - `country` string
        - `geolocation` LogGeolocation
          - `lat` number, double
          - `lon` number, double
        - `postalCode` string
        - `state` string
      - `ip` string
      - `source` string
      - `version` string
  - `securityContext` LogSecurityContext
    - `asNumber` integer
    - `asOrg` string
    - `domain` string
    - `isProxy` boolean
    - `isp` string
  - `severity` 'DEBUG' | 'INFO' | 'WARN' | 'ERROR'
  - `target` LogTarget[]
    - `alternateId` string
    - `detailEntry` object
    - `displayName` string
    - `id` string
    - `type` string
  - `transaction` LogTransaction
    - `detail` object
    - `id` string
    - `type` string
  - `uuid` string
  - `version` string

---

[API](https://skmtc.dev/okta/apis/okta-api.md) - [All operations](https://skmtc.dev/okta/apis/okta-api/llms.txt) - [OpenAPI document](https://skmtc.dev/okta/apis/okta-api/revisions/7e5249c30571?raw)