---
title: "List Account audit logs"
method: GET
path: "/audit-logs"
tags: ["Audit Logs"]
---

# List Account audit logs

`GET /audit-logs`

Returns complete retained `project.message_sent` events for the Account associated with the presented API key. The Account is determined by the key and cannot be specified in the request.

The first request must provide an `occurredAfter` and `occurredBefore` window over `occurredAt` no longer than 24 hours. The optional `messageRef` parameter returns only events with an exact match for the opaque `messageRef` value. Do not parse or transform this value. Continuation cursors expire after one hour. If window, limit, or `messageRef` parameters accompany a cursor, they must match the original request.

Events are ordered by `occurredAt` and `eventId` ascending. Each response contains only complete events and is limited to 8 MiB of uncompressed UTF-8 JSON. If one event exceeds that limit, the request returns `422 audit_log_content_too_large` instead of truncating its content.

Events can become available after their `occurredAt`. The returned `observedAt` records when Replit received the event, can be later than `occurredAt`, and is not used to filter this operation. This API does not provide a completion watermark or a guaranteed bound on late arrivals. Polling with overlapping windows reduces the risk of missing late events but cannot guarantee completeness. Deduplicate events by `eventId`.

Example request:

`GET /v1/audit-logs?occurredAfter=2026-08-04T00%3A00%3A00Z&occurredBefore=2026-08-05T00%3A00%3A00Z&messageRef=message123&limit=25`

An invalid cursor returns `400 invalid_cursor`:

```json
{
  "error": {
    "code": "invalid_cursor",
    "message": "Audit log cursor is invalid for this request.",
    "details": null
  }
}
```

An event that cannot fit in a complete response returns `422 audit_log_content_too_large`:

```json
{
  "error": {
    "code": "audit_log_content_too_large",
    "message": "One audit log event exceeds the response size limit.",
    "details": null
  }
}
```

## Query parameters

- `occurredAfter` string, date-time
- `occurredBefore` string, date-time
- `limit` integer
- `messageRef` string
- `cursor` string

## Response `200`

Audit log event list.

- AuditLogListResponse
  - `data` AuditLogEvent[], required
    - `eventId` string, required — Stable identifier for this event. Use it to deduplicate events across overlapping requests.
    - `observedAt` string, date-time, required — When Replit received the event.
    - `occurredAt` string, date-time, required — When the source action occurred.
    - `action` 'project.message_sent', required — Type of audit event.
    - `schemaVersion` 1, required — Version of this action's event schema.
    - `actor` union, required — User or system that caused the event.
      - object
        - `type` 'system', required
      - object
        - `type` 'user', required
        - `userId` string, required
    - `workspace` object, required — Workspace where the event occurred.
      - `id` string, required — Workspace identifier.
    - `project` object, required — Project where the event occurred.
      - `id` string, required — Project identifier.
    - `sessionId` string, required — Identifier for the Agent session containing the message.
    - `messageRef` string, required — Opaque identifier for the message. Do not parse this value.
    - `promptText` string, required — Complete user-submitted prompt text. Treat this field as sensitive customer content.
  - `pagination` union, required
    - object
      - `cursor` string, required — Opaque cursor for the next page.
      - `hasMore` true, required
    - object
      - `cursor` unknown, required
      - `hasMore` false, required

## Other responses

- `400` — The request parameters are invalid.
- `401` — The API key is missing, malformed, unknown, revoked, or expired.
- `403` — The API key lacks the required scope or Account entitlement.
- `422` — One valid event cannot fit in a complete response.
- `429` — The API key or operation exceeded its rate limit.
- `500` — The server encountered an unexpected error.
- `503` — A required API dependency is temporarily unavailable.

## Changes

- **2026-08-29** `7293f5108d59` — 28 warning
  - added the new `conflict` enum value to the `error/code` response property for the response status `400`
  - added the new `conflict` enum value to the `error/code` response property for the response status `401`
  - added the new `conflict` enum value to the `error/code` response property for the response status `403`
  - added the new `conflict` enum value to the `error/code` response property for the response status `422`
  - …24 more
- **2026-08-10** `a144b8316ac4` — 2 info
  - added the new optional `query` request parameter `messageRef`
  - for the `query` request parameter `cursor`, the maxLength was increased from `2048` to `4096`
- **2026-08-08** `c57911e5fe90` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/replit/apis/replit-api/changes/audit-logs/get.md)

---

[API](https://skmtc.dev/replit/apis/replit-api.md) · [All operations](https://skmtc.dev/replit/apis/replit-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/replit/replit-api/revisions/7293f5108d59/schema)