---
title: "One page of the fleet audit trail, newest first, from the last 30 days or a period"
method: GET
path: "/api/{org_id}/fleet/audit"
tags: ["Fleet"]
---

# One page of the fleet audit trail, newest first, from the last 30 days or a period

`GET /api/{org_id}/fleet/audit`

## Request

- Base URL: `https://api.openobserve.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.openobserve.ai/api/{org_id}/fleet/audit`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/openobserve/apis/openobserve-api-http/docs/api/:org_id/fleet/audit/get.ts> (a function with typed inputs; its response is checked against the schema)

## Path parameters

- `org_id` string, required

## Query parameters

- `from` integer
- `to` integer
- `offset` integer
- `limit` integer
- `fleet` string
- `module` 'collectors' | 'tokens' | 'fleets' | 'rollouts' | 'configs' | 'settings': The part of the fleet API an event was made through; `settings` is the org's fleet settings.
- `q` string

## Response `200`

Success

- AuditList
  - `audit_disabled` boolean: The trail is the audit stream, so it is empty while `O2_AUDIT_ENABLED` is off.
  - `items` AuditEvent[], required
    - `action` string, required
    - `actor` string, required
    - `at` integer, required
    - `id` string, required
    - `outcome` string, required
    - `target` string, required
  - `total` integer, required

## Other responses

- `400`: Invalid period or filter
- `403`: Forbidden

---

[API](https://skmtc.dev/openobserve/apis/openobserve-api-http.md) - [All operations](https://skmtc.dev/openobserve/apis/openobserve-api-http/llms.txt) - [OpenAPI document](https://skmtc.dev/openobserve/apis/openobserve-api-http/revisions/0529b8a10252?raw)