AD Base Entities3

AD Users11

AIA CAs3

Alerts17

Analysis3

API Info2

API Tokens3

Asset Isolation33

Asset Scores1

Attack Paths11

Audit1

getList audit logs

Auth14

Azure Entities1

BloodHound Users12

Cert Templates3

Client Ingest1

Clients24

Collection Uploads6

Collectors6

Computers16

Config4

Containers2

Custom Node Management5

Cypher12

Data Quality6

Database1

Datapipe4

Domains17

Enterprise CAs4

EULA1

Events (Schedules)5

GPOs6

Graph7

Groups10

Jobs9

Meta Entities1

NT Auth Stores3

OpenGraph (Experimental)8

OUs5

Permissions2

Risk Posture2

Roles2

Root CAs3

Search2

Tasks9

Audit

Community

Enterprise

List audit logs

Returns a list of audit logs.

get/api/v2/audit

Query parameters

skipinteger

The number of items to skip in a paginated response.

This query parameter is used for determining the number of objects to skip in pagination.

limitinteger

The limit of results requested by the client.

This query parameter is used for setting an upper limit of objects returned in paginated responses.

created_atstring

Filter results by column timestamp value formatted as an RFC-3339 string. Valid filter predicates are eq, neq, gt, gte, lt, lte.

Filter results by created_at value. See filter schema details for valid predicates.

sort_bystring

Sort by column. Can be used multiple times; prepend a hyphen for descending order. See parameter description for details about which columns are sortable.

Sortable columns are id, actor_id, actor_name, actor_email, action, request_id, created_at, source, and status.

beforestring date-time

Return logs created before the specified time. Value should be in the RFC-3339 format. If not supplied, this will default to the current time.

afterstring date-time

Return logs created after the specified time. Value should be in the RFC-3339 format. If not supplied, this will default to 1 year before the current time.

idstring

Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

actor_idstring

Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

actor_namestring

Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

actor_emailstring

Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

actionstring

Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

request_idstring

Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

sourcestring

Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

statusstring

Filter results by column string value. Valid filter predicates are eq, ~eq, neq.

Filter results by column value. Valid filter predicates are eq, neq. Valid values are success and failure.

Response

OK

Changes

Changed in 4 of the 66 revisions of this API.2020

Apr 1, 202640bf219eced691See the full diff
- ▲
  added the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ to the query request parameter created_at
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter action
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter actor_email
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter actor_id
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter actor_name
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter id
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter request_id
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter source
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter status
  request-parameter-pattern-added
- ○
  for the query request parameter created_at, the type/format was generalized from string/date-time to string/
  request-parameter-type-generalized
Apr 1, 20266aaeba6ecdc519See the full diff
- ▲
  for the query request parameter created_at, the type/format was changed from string/ to string/date-time
  request-parameter-type-changed
- ○
  removed the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ from the query request parameter created_at
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter action
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter actor_email
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter actor_id
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter actor_name
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter id
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter request_id
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter source
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter status
  request-parameter-pattern-removed
Apr 1, 2026674e0a229e8a91See the full diff
- ▲
  added the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ to the query request parameter created_at
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter action
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter actor_email
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter actor_id
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter actor_name
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter id
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter request_id
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter source
  request-parameter-pattern-added
- ▲
  added the pattern ^((eq|~eq|neq):)?[^:]+$ to the query request parameter status
  request-parameter-pattern-added
- ○
  for the query request parameter created_at, the type/format was generalized from string/date-time to string/
  request-parameter-type-generalized
Jan 12, 2026a426ff0abf8f19See the full diff
- ▲
  for the query request parameter created_at, the type/format was changed from string/ to string/date-time
  request-parameter-type-changed
- ○
  removed the pattern ^((eq|neq|gt|gte|lt|lte):)?[0-9]{4}-[0-9]{2}-[0-9]{2}[Tt][0-9]{2}:[0-9]{2}:[0-9]{2}(\.[0-9]{1,9})?([Zz]|-[0-9]{2}:[0-9]{2})$ from the query request parameter created_at
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter action
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter actor_email
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter actor_id
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter actor_name
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter id
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter request_id
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter source
  request-parameter-pattern-removed
- ○
  removed the pattern ^((eq|~eq|neq):)?[^:]+$ from the query request parameter status
  request-parameter-pattern-removed
This revision also has 3 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog