Skip to main content
GET
List audit logs
Requires the IAM action audit:ListLogs. See AUDIT permissions for the full list, what each one covers, and an example policy.

Authorizations

Authorization
string
header
required

An OAuth 2.0 bearer token, sent as Authorization: Bearer <token>. This is the recommended way to authenticate.

Get one by exchanging a service account's access key pair at POST /v1/oauth/token with grant_type=client_credentials. It is the standard client-credentials grant, so any OAuth-aware library will obtain and refresh it for you.

Tokens last an hour by default. The same access key pair is separately your AWS SigV4 credential for the S3-compatible object endpoint, which speaks nothing else.

Query Parameters

crn
string

Exact audit event CRN (crn:audit:::log/UUID). Foreign or mismatched identities yield an empty page. This selects the event itself, independently of resource and actor snapshots.

actor
string

Filter by a canonical UUID or an exact event-time actor CRN, including Workspace users, account IAM identities, and retained historical CRNs. Matches identities stored with events in the current organization, including deleted actors. Bare names and wildcard CRNs are unsupported. Events without a stored CRN remain searchable by UUID.

Example:

"550e8400-e29b-41d4-a716-446655440000"

actor_type
enum<string>

Filter by actor type

Available options:
user,
service_account,
system
Example:

"user"

action
string

Filter by action (exact match or prefix with wildcard, e.g., "iam.*")

Example:

"iam.policy.create"

resource_type
string

Filter by resource type

Example:

"instance"

resource
string

Filter by a canonical UUID or an event-time resource CRN, without looking up a live resource. A CRN matches exactly and also matches descendants at a literal / boundary: crn:network:region:account:vpc/prod matches stored crn:network:region:account:vpc/prod/subnet/private. Account and region are matched exactly within the current organization. Percent and underscore characters are literal, not wildcards. Bare names and wildcard CRNs are unsupported. Events without a stored CRN remain searchable by UUID. The resource_type filter applies independently, including to descendant events.

Example:

"crn:network:sa-saopaulo-1:acme:vpc/prod"

status
enum<string>

Filter by status

Available options:
success,
failure,
denied
Example:

"success"

ip_address
string

Filter by IP address

Example:

"192.168.1.100"

from
string<date-time>

Filter logs from this timestamp (inclusive)

Example:

"2026-01-01T00:00:00Z"

to
string<date-time>

Filter logs until this timestamp (exclusive)

Example:

"2026-02-01T00:00:00Z"

limit
integer
default:20

Maximum number of items to return. A value above the maximum is clamped to it rather than rejected, so a page shorter than the one you asked for is normal — page until meta.has_more is false, not until a page looks short.

Required range: 1 <= x <= 100
marker
string

Opaque pagination cursor. Echo back the meta.marker value from the previous page to fetch the next one; do not construct or parse it. The token's internal form varies by endpoint (a resource ID, a timestamp, …) and is not guaranteed stable across releases.

Response

List of audit logs

audit_logs
object[]
meta
object