---
title: "Search Activity Logs"
method: POST
path: "/v1alpha2/activityLogs:search"
tags: ["ClientService"]
---

# Search Activity Logs

`POST /v1alpha2/activityLogs:search`

## Request

- Base URL: `https://api.thirdfort.dev/client/api`
- URL: `https://api.thirdfort.dev/client/api/v1alpha2/activityLogs:search`
- Auth: HTTP bearer

Returns activity log entries for the named resources and action keys, newest first. Event payloads are returned as typed JSON objects; their schemas are preview and may change without notice — treat the action_key and actor as the stable parts of each entry.

## Request body

- SearchActivityLogsRequest: Request message for [ClientService.SearchActivityLogs](#/operations/ClientService_SearchActivityLogs).
  - `resources` string[], required: Required. The canonical resource names to search activity logs for, e.g. a check name (`organizations/{org}/teams/{team}/checks/{check}`).
  - `actionKeys` string[], required: Required. Action keys to search for, e.g. `manualTask.create`, `manualTask.update`, `manualTask.complete`, `manualTask.cancel`.
  - `pageSize` integer: Optional. The maximum number of activity logs to return.
  - `pageToken` string: Optional. A page token, received from a previous `SearchActivityLogs` call. Provide this token to retrieve the subsequent page.

## Response `200`

A successful response.

- SearchActivityLogsResponse: Response message for [ClientService.SearchActivityLogs](#/operations/ClientService_SearchActivityLogs).
  - `logs` ActivityLog[]: The list of activity logs.
    - `id` string: Opaque identifier for this entry.
    - `createTime` string, date-time: When the action happened.
    - `source` string: The system component that recorded the entry.
    - `correlationId` string: Correlates entries that belong to the same logical operation.
    - `actor` string: The resource name of the actor that performed the action: a user (`organizations/{org}/users/{user}`), an integration (`partners/{partner}/integrations/{integration}` or `organizations/{org}/integrations/{integration}`), or `SYSTEM` for platform automations.
    - `action` ProtobufAny: Contains an arbitrary serialized protocol buffer message along with a type URL that identifies the message type.
      - `@type` string: A URL/resource name that uniquely identifies the type of the serialized protocol buffer message. This string must contain at least one "/" character. The last segment of the URL's path must represent the fully qualified name of the type (as in `path/google.protobuf.Duration`). The name should be in a canonical form (e.g., leading "." is not accepted). In practice, teams usually precompile into the binary all types that they expect it to use in the context of Any. However, for URLs which use the scheme `http`, `https`, or no scheme, one can optionally set up a type server that maps type URLs to message definitions as follows: * If no scheme is provided, `https` is assumed. * An HTTP GET on the URL must yield a google.protobuf.Type value in binary format, or produce an error. * Applications are allowed to cache lookup results based on the URL, or have them precompiled into a binary to avoid any lookup. Therefore, binary compatibility needs to be preserved on changes to types. (Use versioned type names to manage breaking changes.) Note: this functionality is not currently available in the official protobuf release, and it is not used for type URLs beginning with type.googleapis.com. Schemes other than `http`, `https` (or the empty scheme) might be used with implementation specific semantics.
    - `actionKey` string: The kind of action, e.g. `manualTask.create` or `manualTask.complete`.
  - `nextPageToken` string: A token to retrieve the next page of results. Pass this value in the page_token field in the subsequent call to `SearchActivityLogs`.

## Other responses

- `default`: An unexpected error response.

---

[API](https://skmtc.dev/thirdfort/apis/thirdfort-client-api-preview.md) - [All operations](https://skmtc.dev/thirdfort/apis/thirdfort-client-api-preview/llms.txt) - [OpenAPI document](https://skmtc.dev/thirdfort/apis/thirdfort-client-api-preview/revisions/3446b9aefa90?raw)