--- title: "Read an enterprise's audit log." method: GET path: "/enterprises/{enterpriseId}/audit-logs" tags: ["enterprises"] --- # Read an enterprise's audit log. `GET /enterprises/{enterpriseId}/audit-logs` ## Request - Base URL: `https://api.shorebird.dev/api/v1` - URL: `https://api.shorebird.dev/api/v1/enterprises/{enterpriseId}/audit-logs` - Auth: one of: - HTTP bearer - HTTP bearer Events about the enterprise, and its organizations' membership and access events, never their app content. An organization's events are here when they were written while it was in the enterprise. Takes the same query parameters, and pages the same way, as an organization's audit log. Owners and admins only, and a service account the enterprise owns whose role is `auditor`, which reads its own enterprise's log and nothing else. ## Query parameters - `per_page` integer - `cursor` string - `order` 'desc' | 'asc': The order audit log entries are listed in. - `startDate` string, date-time - `endDate` string, date-time - `appId` string - `actorId` integer - `operation` string ## Response `200` One page of audit log entries. - GetOrganizationAuditLogsResponse: The response body for GET /organizations/{organizationId}/audit-logs. - `data` AuditLogEvent[], required: The entries on this page, in the requested order. - `class_uid` 6003, required: The OCSF class, always API Activity (6003). - `category_uid` 6, required: The OCSF category, always Application Activity (6). - `activity_id` integer, required: What kind of operation this was: 1 create, 2 read, 3 update, 4 delete (or revoke), 99 other (such as a refused request). - `type_uid` integer, required: `class_uid * 100 + activity_id`, as OCSF defines it. - `time` integer, required: When the entry was recorded, in milliseconds since the Unix epoch. - `severity_id` 1, required: Always 1 (Informational). - `status_id` 1, required: Always 1 (Success). - `metadata` AuditLogEventMetadata, required: OCSF `metadata` for an audit log entry. - `version` string, required: The OCSF schema version, `1.9.0`. - `product` AuditLogProduct, required: OCSF `metadata.product`. Always Shorebird. - `name` string, required: Always `Shorebird`. - `vendor_name` string, required: Always `Shorebird`. - `uid` string, required: The entry's ID, as a string. - `tenant_uid` string: The organization's ID, as a string. Absent for an event above any organization, which belongs to an enterprise alone (its `unmapped.enterprise_id`). - `log_name` 'audit', required: Always `audit`. - `correlation_uid` string: The ID of the request that caused the entry, when recorded. Quote it to Shorebird support to trace the request. - `api` AuditLogApi, required: OCSF `api`, the operation performed. - `operation` string, required: The event's name, such as `organization.rename`. The value the `operation` filter takes. - `token` AuditLogApiToken: The API key (personal access token or service account key) the request was made with. Absent for other credentials. - `uid` string, required: The key's ID, which revoking it takes. - `name` string: The key's name when the entry was recorded. - `type_id` 7, required: Always 7, OCSF's API Token. - `type` 'API Token', required: Always `API Token`. - `actor` AuditLogActor, required: OCSF `actor`, who caused the entry. - `user` AuditLogActorUser, required: OCSF `actor.user`. A person is type 1 (`User`), a service account or a CI job acting as one is type 4 (`Service`), and Shorebird staff are type 99 (`shorebird_staff`) with no identity beyond that name. - `uid` string: The user's or service account's ID, as a string, when known. - `name` string: The actor's name, when known. - `email_addr` string: The actor's email, when known. - `type_id` integer, required: 1 for a person, 4 for a service account, 99 for Shorebird staff. - `type` 'User' | 'Service' | 'shorebird_staff', required: The name of `type_id`. - `session` AuditLogSession: The console or OAuth sign-in session the request was made under. Absent for API keys. - `uid` string, required: The session's ID (never its token), as a string. - `created_time` integer: When the session began, in milliseconds since the Unix epoch. - `issuer` string: The issuer of the identity the session's holder signed in with. - `is_mfa` boolean: Whether the sign-in used a second factor. Present only when the identity provider said; absent means unknown, not false. - `src_endpoint` AuditLogSourceEndpoint, required: OCSF `src_endpoint`, where the request came from: `ip` when it was recorded, otherwise `name` set to `unknown`. - `ip` string: The client's IP address. - `name` string: `unknown`, when no IP address is given. - `http_request` AuditLogHttpDetails: OCSF `http_request`. Present when a user agent was recorded. - `user_agent` string, required: The request's `User-Agent`. - `resources` AuditLogResource[], required: What the operation acted on. Always exactly one entry. - `type` string, required: What `uid` identifies, such as `organization` or `release`. - `uid` string, required: The resource's ID. - `unmapped` object, required: Fields OCSF has no place for, keyed in snake_case: the event's own metadata (which varies by event, nested keys included), `app_id` when the entry is about an app, `enterprise_id` when it belongs to an enterprise, and `actor_source`, the kind of credential that acted (for example `session`, `api_key`, `service_account`, `federated` or `admin_api`), when known. - `next_cursor` string: The opaque cursor of the next page; send it back as `cursor` to get that page. Newest first, absent on the last page. Oldest first, always present: the last entry's position, or the cursor that was sent when the page is empty. ## Other responses - `default`: Standard error response. Emitted for any non-2xx status where a body can be decoded into an [ErrorResponse]. ## Changes - **2026-11-05** `941da8871d10`: 1 info - endpoint added [Operation history](https://skmtc.dev/shorebird/apis/shorebird-codepush-api/changes/enterprises/:enterpriseId/audit-logs/get.md) --- [API](https://skmtc.dev/shorebird/apis/shorebird-codepush-api.md) - [All operations](https://skmtc.dev/shorebird/apis/shorebird-codepush-api/llms.txt) - [OpenAPI document](https://skmtc.dev/shorebird/apis/shorebird-codepush-api/revisions/941da8871d10?raw)