---
title: "List audit logs"
method: GET
path: "/organizations/{organization}/audit-log"
tags: ["Organizations"]
---

# List audit logs

`GET /organizations/{organization}/audit-log`

### Authorization
A service token or OAuth token must have at least one of the following access or scopes in order to use this API endpoint:

**Service Token Accesses**
 `read_audit_logs`

**OAuth Scopes**

 | Resource | Scopes |
| :------- | :---------- |
| Organization | `read_audit_logs` |

## Path parameters

- `organization` string, required

## Query parameters

- `starting_after` string
- `ending_before` string
- `limit` integer

## Response `200`

Returns the audit log events

- object
  - `type` string, required — The response type. Always "list" for paginated responses.
  - `has_next` boolean, required — Whether there is a next page of results
  - `has_prev` boolean, required — Whether there is a previous page of results
  - `cursor_start` string, nullable, required — The ID of the first object in the current results, or null when there are no results
  - `cursor_end` string, nullable, required — The ID of the last object in the current results, or null when there are no results
  - `data` object[], required
    - `id` string, required — The ID for the audit log
    - `actor_id` string, nullable, required — The ID of the actor
    - `actor_type` string, nullable, required — The type of the actor. Such as 'User' or 'ServiceToken'
    - `auditable_id` string, nullable, required — The ID of the auditable object
    - `auditable_type` string, nullable, required — The type of the auditable. Such as 'Organization' or 'Database'
    - `target_id` string, nullable, required — The ID of the target
    - `target_type` string, nullable, required — The type of the target. Such as 'DatabaseBranch' or 'DatabaseBranchPassword'
    - `location` string, nullable, required — The location of the actor based on their IP address
    - `target_display_name` string, nullable, required — The name of the target
    - `audit_action` string, required — The action that was taken
    - `action` string, required — The action that was taken
    - `actor_display_name` string, required — The name of the actor
    - `auditable_display_name` string, required — The name of the auditable object
    - `remote_ip` string, nullable, required — The IP address of the actor
    - `created_at` string, required — When the audit log was created
    - `updated_at` string, required — When the audit log was last updated
    - `metadata` object, nullable, required — Additional metadata containing details about the change

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `500` — Internal Server Error

## Changes

- **2026-06-01** `72506953f367` — 12 breaking, 4 info
  - the response property `cursor_end` became nullable for the status `200`
  - the response property `cursor_start` became nullable for the status `200`
  - the response property `data/items/actor_id` became nullable for the status `200`
  - the response property `data/items/actor_type` became nullable for the status `200`
  - …12 more

[Change history](https://skmtc.dev/planetscale/apis/planetscale-api/changes/organizations/:organization/audit-log/get.md)

---

[API](https://skmtc.dev/planetscale/apis/planetscale-api.md) · [All operations](https://skmtc.dev/planetscale/apis/planetscale-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/planetscale/planetscale-api/revisions/6d28c038c4fd/schema)