--- title: "Read an organization's audit log." method: GET path: "/organizations/{organizationId}/audit-logs" tags: ["organizations"] --- # Read an organization's audit log. `GET /organizations/{organizationId}/audit-logs` ## Request - Base URL: `https://api.shorebird.dev/api/v1` - URL: `https://api.shorebird.dev/api/v1/organizations/{organizationId}/audit-logs` - Auth: one of: - HTTP bearer - HTTP bearer Who did what in the organization, as OCSF 1.9.0 API Activity events (class 6003), so a SIEM can ingest it without a Shorebird-specific pipeline. The log always pages. Newest first (the default), `next_cursor` is present while older entries remain. Oldest first (`order=asc`), `next_cursor` is always present, so a poller can resume from where it stopped: entries younger than 60 seconds are held back until they settle, and a page with no entries echoes the cursor it was sent. Requires the plan's audit-log feature (`shorebird_plan_insufficient_tier` otherwise) and the `auditLogs.view` permission, which the `admin`, `owner` and `auditor` roles hold. ## Query parameters - `per_page` integer - `cursor` string - `order` 'desc' | 'asc': The order audit log entries are listed in. - `startDate` string, date-time - `endDate` string, date-time - `appId` string - `actorId` integer - `operation` string ## Response `200` One page of audit log entries. - GetOrganizationAuditLogsResponse: The response body for GET /organizations/{organizationId}/audit-logs. - `data` AuditLogEvent[], required: The entries on this page, in the requested order. - `class_uid` 6003, required: The OCSF class, always API Activity (6003). - `category_uid` 6, required: The OCSF category, always Application Activity (6). - `activity_id` integer, required: What kind of operation this was: 1 create, 2 read, 3 update, 4 delete (or revoke), 99 other (such as a refused request). - `type_uid` integer, required: `class_uid * 100 + activity_id`, as OCSF defines it. - `time` integer, required: When the entry was recorded, in milliseconds since the Unix epoch. - `severity_id` 1, required: Always 1 (Informational). - `status_id` 1, required: Always 1 (Success). - `metadata` AuditLogEventMetadata, required: OCSF `metadata` for an audit log entry. - `version` string, required: The OCSF schema version, `1.9.0`. - `product` AuditLogProduct, required: OCSF `metadata.product`. Always Shorebird. - `name` string, required: Always `Shorebird`. - `vendor_name` string, required: Always `Shorebird`. - `uid` string, required: The entry's ID, as a string. - `tenant_uid` string: The organization's ID, as a string. Absent for an event above any organization, which belongs to an enterprise alone (its `unmapped.enterprise_id`). - `log_name` 'audit', required: Always `audit`. - `correlation_uid` string: The ID of the request that caused the entry, when recorded. Quote it to Shorebird support to trace the request. - `api` AuditLogApi, required: OCSF `api`, the operation performed. - `operation` string, required: The event's name, such as `organization.rename`. The value the `operation` filter takes. - `token` AuditLogApiToken: The API key (personal access token or service account key) the request was made with. Absent for other credentials. - `uid` string, required: The key's ID, which revoking it takes. - `name` string: The key's name when the entry was recorded. - `type_id` 7, required: Always 7, OCSF's API Token. - `type` 'API Token', required: Always `API Token`. - `actor` AuditLogActor, required: OCSF `actor`, who caused the entry. - `user` AuditLogActorUser, required: OCSF `actor.user`. A person is type 1 (`User`), a service account or a CI job acting as one is type 4 (`Service`), and Shorebird staff are type 99 (`shorebird_staff`) with no identity beyond that name. - `uid` string: The user's or service account's ID, as a string, when known. - `name` string: The actor's name, when known. - `email_addr` string: The actor's email, when known. - `type_id` integer, required: 1 for a person, 4 for a service account, 99 for Shorebird staff. - `type` 'User' | 'Service' | 'shorebird_staff', required: The name of `type_id`. - `session` AuditLogSession: The console or OAuth sign-in session the request was made under. Absent for API keys. - `uid` string, required: The session's ID (never its token), as a string. - `created_time` integer: When the session began, in milliseconds since the Unix epoch. - `issuer` string: The issuer of the identity the session's holder signed in with. - `is_mfa` boolean: Whether the sign-in used a second factor. Present only when the identity provider said; absent means unknown, not false. - `src_endpoint` AuditLogSourceEndpoint, required: OCSF `src_endpoint`, where the request came from: `ip` when it was recorded, otherwise `name` set to `unknown`. - `ip` string: The client's IP address. - `name` string: `unknown`, when no IP address is given. - `http_request` AuditLogHttpDetails: OCSF `http_request`. Present when a user agent was recorded. - `user_agent` string, required: The request's `User-Agent`. - `resources` AuditLogResource[], required: What the operation acted on. Always exactly one entry. - `type` string, required: What `uid` identifies, such as `organization` or `release`. - `uid` string, required: The resource's ID. - `unmapped` object, required: Fields OCSF has no place for, keyed in snake_case: the event's own metadata (which varies by event, nested keys included), `app_id` when the entry is about an app, `enterprise_id` when it belongs to an enterprise, and `actor_source`, the kind of credential that acted (for example `session`, `api_key`, `service_account`, `federated` or `admin_api`), when known. - `next_cursor` string: The opaque cursor of the next page; send it back as `cursor` to get that page. Newest first, absent on the last page. Oldest first, always present: the last entry's position, or the cursor that was sent when the page is empty. ## Other responses - `400`: The organization id is not an integer (`organization_id_malformed`), the cursor is unreadable (`invalid_cursor`), or a filter is malformed (`audit_log_bad_request`, with the reason in `details`). - `403`: The caller lacks the `auditLogs.view` permission, or the plan does not include audit logs (`shorebird_plan_insufficient_tier`). - `404`: No such organization, or the caller is not a member of it (`organization_membership_guard_error`). - `424`: The organization's billing account could not be looked up (`organization_lookup_error`), or reading the log failed (`audit_log_fetch_error`). - `default`: Standard error response. Emitted for any non-2xx status where a body can be decoded into an [ErrorResponse]. --- [API](https://skmtc.dev/shorebird/apis/shorebird-codepush-api.md) - [All operations](https://skmtc.dev/shorebird/apis/shorebird-codepush-api/llms.txt) - [OpenAPI document](https://skmtc.dev/shorebird/apis/shorebird-codepush-api/revisions/941da8871d10?raw)