---
title: "List audit events."
method: GET
path: "/api/audit"
tags: ["Audit Log"]
---

# List audit events.

`GET /api/audit`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/audit`
- Auth: HTTP bearer

Returns audit events, most recent first, paginated. Filter by event type with event, by time with from and to (ISO-8601 instants; from is inclusive, to is exclusive), and by acting principal with owner. Reading the audit log is itself audited. The log covers the whole deployment, so this requires an administrator as well as the audit:read scope. Requires the `audit:read` scope.

## Query parameters

- `event` string
- `from` string
- `to` string
- `owner` string
- `order` string
- `offset` integer
- `limit` integer

## Headers

- `Authorization` string, required

## Response `200`

OK

- GetAuditResponse
  - `events` AuditEventView[]
    - `apiKeyId` string
    - `associatedObject` string
    - `clientIpAddress` string
    - `details` string
    - `event` string
    - `requestId` string
    - `source` string
    - `timestamp` string, date-time
    - `username` string: The username of the user who performed the action, when the actor is a user, including a user since deactivated. null for an event with no user actor, such as one Philter recorded itself.
  - `total` integer

## Other responses

- `400`: A timestamp could not be parsed, the range is reversed, or the event type is not one Philter emits.
- `401`: The Authorization header is absent or the API key is not recognized.
- `403`: The key does not hold audit:read, or the caller is not an administrator.
- `404`: The owner does not exist, or the caller may not reach it. The API does not distinguish the two, so an owner value cannot be used to discover accounts.
- `406`: No representation matches Accept.
- `413`: Content Too Large
- `415`: Unsupported Media Type
- `500`: Internal Server Error
- `503`: Service Unavailable

## Changes

- **2026-10-10** `c4f85daa9208`: 1 breaking, 15 info
  - the response's body type changed from `string` to `object` for status `404`
  - added the optional property `field` to the response with the `400` status
  - added the optional property `field` to the response with the `401` status
  - added the optional property `field` to the response with the `404` status
  - …12 more
- **2026-10-10** `1e983a7188bf`: 1 info
  - added the new optional `query` request parameter `order`
- **2026-10-10** `99428fb4cd2d`: 1 info
  - added the optional property `events/items/username` to the response with the `200` status
- **2026-10-07** `8c0c8ed36409`: 1 info
  - added the optional property `events/items/source` to the response with the `200` status
- **2026-10-05** `4082c17721d8`: 6 breaking, 6 info
  - removed the media type `*/*` for the response with the status `400`
  - removed the media type `*/*` for the response with the status `401`
  - removed the media type `*/*` for the response with the status `413`
  - removed the media type `*/*` for the response with the status `415`
  - …8 more

[Operation history](https://skmtc.dev/philterd/apis/philter-api/changes/api/audit/get.md)

---

[API](https://skmtc.dev/philterd/apis/philter-api.md) - [All operations](https://skmtc.dev/philterd/apis/philter-api/llms.txt) - [OpenAPI document](https://skmtc.dev/philterd/apis/philter-api/revisions/aa3d7ad1aab4?raw)