---
title: "Get Audit Log Events"
method: GET
path: "/orgs/{org_slug}/audit-log"
tags: ["audit-log"]
---

# Get Audit Log Events

`GET /orgs/{org_slug}/audit-log`

Paginated list of audit log events.

This endpoint consumes 1 unit of your quota.

This endpoint requires the following org token scopes:
- audit-log:list

## Path parameters

- `org_slug` string, required

## Query parameters

- `type` 'AddLicenseOverlayNote' | 'AssociateLabel' | 'CancelInvitation' | 'ChangeMemberRole' | 'ChangePlanSubscriptionSeats' | 'CreateApiToken' | 'CreateArtifact' | 'CreateAlertPolicy' | 'CreateFirewallCustomRegistry' | 'CreateFirewallDeploymentConfig' | 'CreateLabel' | 'CreateOauthRefreshToken' | 'CreateRepoAccessRule' | 'CreateUserWithPassword' | 'CreateWebhook' | 'CreateTicket' | 'CreateTicketingConfiguration' | 'CoanaCliLegacyModeCutoffUpdated' | 'CoanaCliLegacyModeDemoteOrg' | 'CoanaCliLegacyModePromoteOrg' | 'CreateAlertResolution' | 'DeleteAlertPolicy' | 'DeleteAlertResolution' | 'DeleteAlertTriage' | 'DeleteApiToken' | 'DeleteFirewallCustomRegistry' | 'DeleteFirewallDeploymentConfig' | 'DeleteFullScan' | 'DeleteLabel' | 'DeleteLabelSetting' | 'DeleteRepoAccessRule' | 'DeleteReport' | 'DeleteRepository' | 'DeleteTicketingConfiguration' | 'DeleteWebhook' | 'DisablePythonCliRunStreamingOverride' | 'DisassociateLabel' | 'DisconnectAsanaIntegration' | 'DisconnectJiraIntegration' | 'DisconnectLinearIntegration' | 'DowngradeOrganizationPlan' | 'EnablePythonCliRunStreamingOverride' | 'EnqueueAutopatchMergeRun' | 'EnqueueAutopatchPrepareJob' | 'FinalizeAlertPolicyMigration' | 'JoinOrganization' | 'AsanaIntegrationConnected' | 'JiraIntegrationConnected' | 'LinearIntegrationConnected' | 'MemberAdded' | 'MemberRemoved' | 'MemberRoleChanged' | 'RemoveLicenseOverlay' | 'RemoveMember' | 'RollbackAlertPolicyMigration' | 'ResetInvitationLink' | 'ResetOrganizationSettingToDefault' | 'RevokeOauthToken' | 'RotateOauthRefreshToken' | 'RevokeApiToken' | 'RotateApiToken' | 'SendInvitation' | 'SessionRevokedByUser' | 'SetLabelSettingToDefault' | 'SetSsoBypassMemberships' | 'SetSsoBypassRbacRoles' | 'StartAlertPolicyMigrationPreview' | 'SSOEmailVerificationCompleted' | 'SSOLoginCompleted' | 'SvdBackfillLegacyOverlay' | 'SvdReprocessClusters' | 'SyncOrganization' | 'TransferOwnership' | 'UpdateAlertTriage' | 'UpdateApiTokenCommitter' | 'UpdateApiTokenMaxQuota' | 'UpdateApiTokenName' | 'UpdateApiTokenScopes' | 'UpdateApiTokenVisibility' | 'UpdateAutopatchCurated' | 'UpdateAutopatchPrepareConfig' | 'UpdateFirewallCustomRegistry' | 'UpdateFirewallDeploymentConfig' | 'UpdateLabel' | 'UpdateLabelSetting' | 'UpdateLicenseOverlay' | 'UpdateOrganizationSetting' | 'UpdateRepoAccessRule' | 'UpdateTicketingConfiguration' | 'UpdateWebhook' | 'UpgradeOrganizationPlan' | 'UserMagicLinkSent' | 'UserSignedIn' | 'UserSignedOut'
- `per_page` integer
- `page` string
- `from` string

## Response `200`

The paginated list of events in an organizations audit log and the next page querystring token.

- object
  - `results` object[], required
    - `event_id` string
    - `created_at` string
    - `updated_at` string
    - `country_code` string, nullable
    - `organization_id` string, nullable
    - `ip_address` string, nullable
    - `payload` object, nullable
    - `status_code` integer, nullable
    - `type` string
    - `user_agent` string, nullable
    - `user_id` string, nullable
    - `user_email` string
    - `user_image` string
    - `organization_name` string
  - `nextPage` string, nullable, required

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `403` — Insufficient max_quota for API method
- `404` — Resource not found
- `429` — Insufficient quota for API route

---

[API](https://skmtc.dev/socket-dev/apis/socket.md) · [All operations](https://skmtc.dev/socket-dev/apis/socket/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/socket-dev/socket/revisions/bf994b75d33f/schema)