---
title: "Retrieve audit logs"
method: GET
path: "/{workspace}/audit_logs"
---

# Retrieve audit logs

`GET /{workspace}/audit_logs`

## Request

- Base URL: `https://modeanalytics.com/api`
- URL: `https://modeanalytics.com/api/{workspace}/audit_logs`
- Auth: HTTP basic
- TypeScript: <https://skmtc.dev/thoughtspot/apis/mode/docs/:workspace/audit_logs/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns a paginated list of audit log events for the given workspace.

## Path parameters

- `workspace` string, required

## Query parameters

- `start_timestamp` string, required
- `end_timestamp` string, required
- `action` string
- `entity_id` string
- `entity_type` string
- `entity_name` string
- `username` string
- `ip` string
- `event_source` string
- `next_token` string

## Response `200`

A list of audit logs matching the given filters.

- AuditLog: Represents a single audit log event.
  - `id` string: Unique ID for the audit event
  - `action` string: Action being audited
  - `description` string: One-liner describing the audit event
  - `context` object: Additional metadata associated with the audit event
    - `correlation_id` string
  - `actor` object: Information about the user or system that triggered the event
    - `ip` string
    - `user_agent` string
    - `user_id` string
    - `username` string
  - `entity` object: The primary entity affected in the action performed
    - `entity_name` string
    - `entity_type` string
    - `entity_id` string
  - `timestamp` string, date-time: Event timestamp
  - `workspace_username` string

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden

## Changes

- **2025-02-20** `4c694c3fdeb1`: 1 info
  - added the non-success response with the status `401`
- **2025-02-19** `f34426f43d8d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/thoughtspot/apis/mode/changes/:workspace/audit_logs/get.md)

---

[API](https://skmtc.dev/thoughtspot/apis/mode.md) - [All operations](https://skmtc.dev/thoughtspot/apis/mode/llms.txt) - [OpenAPI document](https://skmtc.dev/thoughtspot/apis/mode/revisions/4c694c3fdeb1?raw)