> ## Documentation Index
> Fetch the complete documentation index at: https://developers.authlete.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Audit Logs

> Retrieve audit logs as a cursor-paginated list. Results can be filtered by time range, event type, and organization.

<Accordion title="Full description" defaultOpen={false}>
  The response contains a page of roughly `limit` entries together with a `nextCursor` value.
  Entries sharing the same timestamp are never split across pages, so a page may occasionally
  contain more than `limit` entries. To fetch the next page, repeat the request with the `cursor`
  parameter set to the `nextCursor` value from the previous response, keeping the other filter
  parameters unchanged. `nextCursor` is absent on the last page. If both `before` and `cursor`
  are provided, `cursor` takes precedence.

  This endpoint is hosted on the Authlete IdP server (`https://login.authlete.com`),
  not on the regional API clusters.
</Accordion>


## OpenAPI

````yaml https://spec.speakeasy.com/authlete/sdk-workspace/authlete-api-explorer-with-code-samples get /api/audit/entries
openapi: 3.0.3
info:
  title: Authlete API
  description: ''
  version: 3.0.16
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
servers:
  - description: 🇺🇸 US Cluster
    url: https://us.authlete.com
  - description: 🇯🇵 Japan Cluster
    url: https://jp.authlete.com
  - description: 🇪🇺 Europe Cluster
    url: https://eu.authlete.com
  - description: 🇧🇷 Brazil Cluster
    url: https://br.authlete.com
security:
  - bearer: []
tags:
  - name: Service Management
    description: >-
      API endpoints for managing services, including creation, update, and
      deletion of services.
    x-tag-expanded: false
  - name: Client Management
    description: >-
      API endpoints for managing OAuth clients, including creation, update, and
      deletion of clients.
    x-tag-expanded: false
  - name: Authorization Endpoint
    description: API endpoints for implementing OAuth 2.0 Authorization Endpoint.
    x-tag-expanded: false
  - name: Pushed Authorization Endpoint
    description: >-
      API endpoints for implementing OAuth 2.0 Pushed Authorization Requests
      (PAR).
    x-tag-expanded: false
  - name: Token Endpoint
    description: API endpoints for implementing OAuth 2.0 Token Endpoint.
    x-tag-expanded: false
  - name: Token Operations
    description: >-
      API endpoints for various token related operations, including creating,
      revoking and deleting access_tokens with specified scopes.
    x-tag-expanded: false
  - name: Introspection Endpoint
    description: API endpoints for implementing OAuth 2.0 Introspection Endpoint.
    x-tag-expanded: false
  - name: Revocation Endpoint
    description: API endpoint for implementing OAuth 2.0 Revocation Endpoint.
    x-tag-expanded: false
  - name: UserInfo Endpoint
    description: API endpoints for implementing OpenID Connect UserInfo Endpoint.
    x-tag-expanded: false
  - name: JWK Set Endpoint
    description: API endpoints for to generate JSON Web Key Set (JWKS) for a service.
    x-tag-expanded: false
  - name: Discovery Endpoint
    description: API endpoints for implementing OpenID Connect Discovery.
    x-tag-expanded: false
  - name: Configuration Endpoint
    description: API endpoint for accessing configuration settings for a service.
    x-tag-expanded: false
  - name: Dynamic Client Registration
    description: API endpoints for implementing OAuth 2.0 Dynamic Client Registration.
    x-tag-expanded: false
  - name: CIBA
    description: >-
      API endpoints for implementing Client-Initiated Backchannel Authentication
      (CIBA).
    x-tag-expanded: false
  - name: Grant Management Endpoint
    description: >-
      API endpoint for implementing OAuth 2.0 grants, including grant management
      actions like updating and revoking grants.
    x-tag-expanded: false
  - name: Jose Object
    description: API endpoints for JOSE objects.
    x-tag-expanded: false
  - name: Device Flow
    description: API endpoints for implementing OAuth 2.0 Device Flow
    x-tag-expanded: false
  - name: Federation Endpoint
    description: API endpoints for implementing OpenID Federation using Authlete.
    x-tag-expanded: false
  - name: Verifiable Credential Issuer
    description: >-
      API endpoints for implementing and running a Verifiable Credential Issuer
      (VCI).
    x-tag-expanded: false
  - name: Hardware Security Key
    description: API endpoints for managing hardware security keys (HSK).
    x-tag-expanded: false
  - name: Utility Endpoints
    description: API endpoints for various utility operations.
    x-tag-expanded: false
  - name: Native SSO
    description: API endpoints for Native SSO
    x-tag-expanded: false
  - name: Audit Logs
    description: >-
      API endpoints for retrieving audit logs, hosted on the Authlete IdP
      server.
    x-tag-expanded: false
paths:
  /api/audit/entries:
    servers:
      - url: https://login.authlete.com
        description: IDP Server
        x-speakeasy-server-id: idp
    get:
      tags:
        - Audit Logs
      summary: Get Audit Logs
      description: >
        Retrieve audit logs as a cursor-paginated list. Results can be filtered
        by time range, event type,

        and organization.
      operationId: audit_entries_get_idp_api
      parameters:
        - name: after
          in: query
          required: false
          description: Return logs after this timestamp (ISO 8601).
          schema:
            type: string
            format: date-time
        - name: before
          in: query
          required: false
          description: Return logs before this timestamp (ISO 8601).
          schema:
            type: string
            format: date-time
        - name: types
          in: query
          required: false
          description: >
            Filter by event type (e.g. `service.create`, `security.login`,
            `client.create`).

            Can be specified multiple times. The set of available event types is
            environment-specific

            and includes server-side types; retrieve the full list from the
            `/api/audit/types` endpoint.
          schema:
            type: array
            uniqueItems: true
            items:
              type: string
              example: service.create
        - name: organizationId
          in: query
          required: false
          description: >
            The organization to retrieve audit logs for. Not required when
            authenticating with an

            organization token — the token's own organization is used, and a
            differing value is

            rejected. Required for user access tokens, unless the user is an
            Authlete administrator

            (administrators may omit it to query across all organizations).
          schema:
            type: integer
            format: int64
        - name: limit
          in: query
          required: false
          description: >
            The maximum number of entries to return per page. Values outside the
            allowed range are

            clamped; the effective value is echoed back in the response.
          schema:
            type: integer
            default: 100
            minimum: 1
            maximum: 1000
        - name: cursor
          in: query
          required: false
          description: >
            An opaque cursor returned as `nextCursor` by a previous response.
            When provided, it takes

            precedence over the `before` parameter.
          schema:
            type: string
      responses:
        '200':
          description: A page of audit log entries matching the query.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/audit_entries_get_response'
              example:
                entries:
                  - event: service.create
                    status: completed
                    timestamp: '2026-06-01T12:34:56Z'
                    cluster: us
                    path: /api/service
                    remoteAddr: 203.0.113.10
                    userAgent: curl/8.4.0
                    user: admin@example.com
                    details:
                      serviceId: 21653835348762
                      organizationId: 123456789012345
                nextCursor: MjAyNi0wNi0wMVQxMjozNDo1Nlo
                limit: 100
        '400':
          $ref: '#/components/responses/idp_400'
        '401':
          $ref: '#/components/responses/idp_401'
        '403':
          $ref: '#/components/responses/idp_403'
        '500':
          $ref: '#/components/responses/idp_500'
      x-codeSamples:
        - lang: typescript
          label: Typescript (SDK)
          source: |-
            import { Authlete } from "@authlete/typescript-sdk";

            const authlete = new Authlete({
              bearer: process.env["AUTHLETE_BEARER"] ?? "",
            });

            async function run() {
              const result = await authlete.audit.get({
                types: [
                  "service.create",
                ],
              });

              for await (const page of result) {
                console.log(page);
              }
            }

            run();
      x-code-samples:
        - lang: shell
          label: curl
          source: >
            curl -v
            "https://login.authlete.com/api/audit/entries?types=service.create&limit=100"
            \

            -H 'Authorization: Bearer <organization-token>'
components:
  schemas:
    audit_entries_get_response:
      type: object
      properties:
        entries:
          type: array
          items:
            $ref: '#/components/schemas/audit_log_entry'
          description: >
            The audit log entries on this page, in reverse chronological order.
            Entries sharing the

            same timestamp are never split across pages, so a page may contain
            more than `limit` entries.
        nextCursor:
          type: string
          nullable: true
          description: >
            An opaque cursor pointing at the next page. Pass this value as the
            `cursor` parameter of the

            next request to fetch the following page. Absent or `null` on the
            last page.
        limit:
          type: integer
          description: >
            The effective page size limit applied to this response. May differ
            from the requested `limit`

            if the requested value was outside the allowed range.
    audit_log_entry:
      type: object
      properties:
        event:
          type: string
          description: The audit event type (e.g. service.create, security.login).
        status:
          type: string
          enum:
            - completed
            - failed
          description: Whether the action completed successfully or failed.
        timestamp:
          type: string
          format: date-time
          nullable: true
          description: >
            When the event occurred (ISO 8601). May be null for entries without
            a recorded

            timestamp; such entries are only returned on the first page of
            results.
        cluster:
          type: string
          description: The cluster or region where the event occurred.
        path:
          type: string
          description: The API path that triggered the event.
        remoteAddr:
          type: string
          description: The IP address of the client that performed the action.
        userAgent:
          type: string
          description: The user agent of the client.
        user:
          type: string
          description: The user or token that performed the action.
        details:
          type: object
          additionalProperties: true
          description: Additional event-specific metadata.
    idp_error:
      type: object
      description: >
        Error response returned by the Authlete IdP server. Unlike the main
        API's

        `resultCode`/`resultMessage` format, IdP errors carry a human-readable
        `error` message,

        optionally accompanied by contextual fields (such as `organizationId` or
        `apiServerId`).

        Request validation failures instead return an `errors` array of
        per-field messages.
      properties:
        error:
          type: string
          description: A human-readable error message.
        errors:
          type: array
          items:
            type: string
          description: >-
            Per-field validation error messages, present for request validation
            failures.
      additionalProperties: true
  responses:
    idp_400:
      description: ''
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/idp_error'
          example:
            error: Unknown user or invalid access token
    idp_401:
      description: ''
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/idp_error'
    idp_403:
      description: ''
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/idp_error'
          example:
            error: No access to organization for this user
    idp_500:
      description: ''
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/idp_error'
          example:
            error: An internal error occurred. Please try again later.
  securitySchemes:
    bearer:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: >
        Authenticate every request with a **Service Access Token** or
        **Organization Token**.

        Set the token value in the `Authorization: Bearer <token>` header.


        **Service Access Token**: Scoped to a single service. Use when
        automating service-level configuration or runtime flows.


        **Organization Token**: Scoped to the organization; inherits permissions
        across services. Use for org-wide automation or when managing multiple
        services programmatically.


        Both token types are issued by the Authlete console or provisioning
        APIs.

````