---
title: "Get the raw action log."
method: GET
path: "/actionlog/logs.json"
tags: ["Action logs"]
---

# Get the raw action log.

`GET /actionlog/logs.json`

## Request

- Base URL: `https://passbolt.local`
- URL: `https://passbolt.local/actionlog/logs.json`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/passbolt/apis/passbolt-api/docs/actionlog/logs.json/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns the raw log entries recorded by the action log plugin, rather than the interpreted activities of an entity. Reserved to administrators.

## Query parameters

- `filter[has-users]` string[]
- `filter[is-success]` boolean
- `filter[created-after]` string
- `filter[created-before]` string
- `limit` integer
- `page` integer

## Response `200`

Operation is successful.

- object
  - `header` Header, required
    - `id` string, uuid, required
    - `status` 'success' | 'error', required
    - `servertime` integer, required
    - `action` string, uuid, required
    - `message` string, required
    - `url` string, uri, required
    - `code` integer, required
  - `body` LogEntry[], required
    - `id` string, uuid, required
    - `user_id` string, uuid: The user who performed the call, null for an unauthenticated one.
    - `action_id` string, uuid, required
    - `context` string, required: The method and the path of the call.
    - `status` 0 | 1, required: 1 when the call succeeded, 0 when it failed.
    - `created` string, date-time, required

## Other responses

- `401`: Authentication required.
- `403`: Access restricted

## Changes

- **2026-11-06** `8d72215e2274`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/passbolt/apis/passbolt-api/changes/actionlog/logs.json/get.md)

---

[API](https://skmtc.dev/passbolt/apis/passbolt-api.md) - [All operations](https://skmtc.dev/passbolt/apis/passbolt-api/llms.txt) - [OpenAPI document](https://skmtc.dev/passbolt/apis/passbolt-api/revisions/8d72215e2274?raw)