---
title: "List audit log records for an organization's exclusion list"
method: GET
path: "/exclusions/{organization}/audit/all"
tags: ["Exclusions"]
---

# List audit log records for an organization's exclusion list

`GET /exclusions/{organization}/audit/all`

## Request

- Base URL: `https://api.recordedfuture.com/collective-insights`
- URL: `https://api.recordedfuture.com/collective-insights/exclusions/{organization}/audit/all`
- Auth: OAuth 2
  - Authorization code: `https://id.recordedfuture.com/authorize`
  - Token URL: `https://id.recordedfuture.com/token`

Returns a page of the audit log for the specified organization's exclusion list. A record is
created for every create, update, and delete operation on an exclusion list item. Records are
returned with the most recent operation first.

## Path parameters

- `organization` string, required

## Query parameters

- `limit` integer
- `offset` string

## Response `200`

Exclusion list audit log records

- AuditLogResponse
  - `counts` PageCounts
    - `returned` integer: Number of items in the current response
    - `total` integer: Total number of items across all pages
  - `data` AuditRecord[]: Audit log records in the current page
    - `action` 'created' | 'updated' | 'deleted': Operation that was performed on the exclusion list item
    - `details` string: Human-readable description of the change
    - `item_id` string, uuid: ID of the exclusion list item the record refers to
    - `item_type` 'observable' | 'ip_range' | 'device_name': Exclusion type of the item at the time of the operation
    - `item_value` string: Value of the item at the time of the operation
    - `timestamp` string, date-time: Time the operation was performed
    - `user` string: User identity that performed the operation
  - `next_offset` string: Pagination offset for retrieving the next page. Absent on the last page.

## Other responses

- `400`: Client error
- `401`: Client error
- `403`: Client error
- `500`: Server error
- `503`: Server error

---

[API](https://skmtc.dev/recordedfuture/apis/collective-insights-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/collective-insights-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/collective-insights-api/revisions/260c9863a7cf?raw)