Returns a flat list of login events for your organization over a date range — one row per successful credentials / Google / SAML / OIDC sign-in recorded server-side. This is the authentication audit log.

It is the flat counterpart of the logins array on GET /v2/usage/: use this endpoint when you want to iterate every login event in a range without paginating through users first. It is distinct from GET /v2/usage/sessions/ — a login is an auth event, whereas a session is a window of actual product engagement; the two do not map one-to-one.

Authentication. OAuth 2.1 bearer token (Authorization: Bearer <token>) with the usage:read scope, consented at the organization level; access is limited to organizations enabled for the usage API. The authenticated user must be an organization admin or non-researcher admin.

A partner credential reads the same metrics for one client organization by naming it in the assertion's outset_org claim; the consent, role and allow-list conditions above are properties of a user-delegated token and have no partner analogue.

Date range. start_date and end_date are both required and inclusive, in YYYY-MM-DD (RFC 3339 full-date) format, evaluated in UTC. The range may span at most 366 days.

Pagination. Cursor-paginated, newest login first. When has_more is true, pass the returned next_cursor back as the cursor query parameter. Page size defaults to 50 and is capped at 200.

Requires the usage:read scope, on a user-delegated token or a partner credential.