activity_logs
advanced_activity_logs

Organization-wide view of activity logs across every project in the organization.

Mounted at /api/organizations/<organization_id>/advanced_activity_logs/. Restricted to organization admins and owners.

get/api/organizations/{organization_id}/advanced_activity_logs/

Request

  • Base URL: https://us.posthog.com
  • URL: https://us.posthog.com/api/organizations/{organization_id}/advanced_activity_logs/
  • Auth: HTTP bearer

Path parameters

organization_idstring required

ID of the organization you're trying to access. To find the ID of the organization, make a call to /api/organizations/.

Query parameters

activitiesstring[]

Filter by activity types (e.g. "created", "updated", "deleted").

clientsstring[]

Filter by API clients that generated the activity (the x-posthog-client header, or 'scout:<skill_name>' for a scout run).

detail_filtersstring

JSON-encoded map of detail field paths to {operation, value} filters. Allowed operations: exact, contains, in.

end_datestring date-time

Upper bound on created_at (inclusive), ISO-8601.

followboolean

Keep the next link valid after the last entry, so the same cursor can be re-polled as new entries arrive. Only applies with oldest-first ordering. When following, stop on an empty results list rather than on a null next link.

hogql_filterstring

Reserved for future HogQL-based filtering.

include_valuesboolean

Include the previous and new values of changed fields. Only applies when schema is ocsf. Values can contain the content of the changed object, which makes responses larger and sends that content to your security tool.

ip_addressesstring[]

Filter by client IP addresses. Accepts exact IPv4/IPv6 values or wildcard patterns using * (e.g. 203.0.113.*). Multiple entries are OR-combined.

is_systemboolean nullable

When set, filters rows authored by the system (no user).

item_idsstring[]

Filter by the item_id of the affected resource(s).

ordering'-created_at' | 'created_at'

Sort by when the entry was created. Defaults to newest first. Use created_at for oldest first when polling for new entries, so a saved cursor picks up where the last request stopped.

  • -created_at - -created_at
  • created_at - created_at
pageinteger

Page number for pagination. When provided, uses page-based pagination ordered by most recent first.

page_sizeinteger

Number of results per page (default: 100, max: 1000).

schema'ocsf'

Response format. Set to ocsf to return Open Cybersecurity Schema Framework events for ingestion into a security tool. Omit for the default PostHog format.

  • ocsf - ocsf
scopesstring[]

Filter by activity scopes (e.g. "FeatureFlag", "Insight").

search_textstring

Free-text search across the detail JSON column.

start_datestring date-time

Lower bound on created_at (inclusive), ISO-8601.

team_idsinteger[]

Filter by project (team) IDs. Only honored on the organization-scoped endpoint; ignored on the project-scoped endpoint.

usersstring[]

Filter by users who performed the activity (user UUIDs).

was_impersonatedboolean nullable

When set, filters rows where the actor was impersonating another user.

Response

nextstring uri nullable
previousstring uri nullable
countinteger

Example response

{
  "next": "http://api.example.org/accounts/?cursor=cD00ODY%3D\"",
  "previous": "http://api.example.org/accounts/?cursor=cj0xJnA9NDg3",
  "count": 123
}

Changes

No recorded changes to this operation across all 1 revision of this API.