{
"code": "INTERNAL_SERVER_ERROR",
"message": "Internal server error",
"issues": []
}
Audit logs
List audit logs
Lists your organization’s audit log events in the range, newest first by default. These are the same events as the Audit Logs page.
Each event includes
What happened: its category, action, and operation type, such as read or update
Who did it: a user, an external user, an Admin API key, or the system
The resource it was about, and a related resource if there is one
When it happened, the IP address, and event-specific details
Filter by category, actor, resource type and action, resource, or operation type. Page through results with cursor.
Polling mode
To send events to your SIEM or another system, use polling mode: pass order=asc and from without to, then poll with each response’s nextCursor. The cursor is always returned, even when there are no new events. Request the next page right away while hasMore is true, and wait for your next poll once it is false.
Events can take up to 2 minutes to appear, so polling never skips an event that is still being recorded.
Each call to this endpoint records an audit log export event. Those events are filtered out of results for the Admin key that made the call. Other keys and the Audit Logs page still show them.
Requires the Audit logs permission (audit_logs:read).
desc (the default) returns the newest events first, and asc the oldest first. Using asc with no to is polling mode, which follows new events as they arrive.
Exclusive end of the range as an ISO 8601 timestamp. Defaults to now, except with order=asc, where leaving it out uses polling mode. The range can span at most 3 months. Events can take up to 2 minutes to appear.
The nextCursor from the previous response. It keeps the first request's order, from, and to, so you can leave those out, but any you pass must match. Pass the same filters as the first request.
{"docsConfig":{"theme":"mint","$schema":"https://mintlify.com/docs.json","name":"Cassidy","colors":{"primary":"#325ED1","light":"#547ADE","dark":"#2852BF"},"logo":{"light":"https://mintcdn.com/cassidy/wE0GgFgF7sg6yClA/logo/light.svg?fit=max\u0026auto=format\u0026n=wE0GgFgF7sg6yClA\u0026q=85\u0026s=a282ef0ea39b2568b4c0d9164c38a471","dark":"https://mintcdn.com/cassidy/wE0GgFgF7sg6yClA/logo/dark.svg?fit=max\u0026auto=format\u0026n=wE0GgFgF7sg6yClA\u0026q=85\u0026s=97b6c3e038ba04fb75c98291dce0f15e"},"favicon":"https://mintcdn.com/cassidy/OMxepbwbagSrdWXh/favicon.png?fit=max\u0026auto=format\u0026n=OMxepbwbagSrdWXh\u0026q=85\u0026s=e2b5f49115e3bdfcbf30f5793e849793","api":{"playground":{"display":"simple"}},"navbar":{"links":[{"href":"mailto:support@cassidyai.com","label":"Support"}],"primary":{"type":"button","label":"Get started","href":"https://app.cassidy.ai"}},"footer":{"socials":{"x":"https://x.com/Cassidy_AI","linkedin":"https://www.linkedin.com/company/cassidyai"}},"fonts":{"family":"Inter"},"integrations":{"intercom":{"appId":"n12guz9i"}},"contextual":{"options":["copy","download-spec"],"display":"header"},"styling":{"latex":false},"navigation":{"pages":[]}},"deployment":{"deploymentMetadataValue":{"subdomain":"cassidy","hasAudioNarration":false,"actualSubdomain":"cassidy","customDomains":["docs.cassidyai.com"],"gitSource":{"type":"github","owner":"cassidyai","repo":"cassidy","deployBranch":"main","contentDirectory":"docs","isPrivate":true,"mountPath":"","label":""},"chroma":{"liveDeploymentHistoryId":"6aeccc0a3c2f00fc09de9461","collectionId":"e3b19f4f-714b-495d-9f6d-628b95dba971","schemaVersion":"v3","latestBuiltDeploymentHistoryId":"6aeccc0a3c2f00fc09de9461"},"feedback":{"thumbs":false},"entitlements":{"AI_CHAT":{"status":"ENABLED"},"WEB_MCP":{"status":"ENABLED"},"NARRATION":{"status":"ENABLED"}},"buildId":"6aedf495d121ed565e10f3bf","clientVersion":"0.0.4074","searchFilterCounts":[{"language":"default","tag":"Documentation","count":214},{"language":"default","tag":"Integrations","count":133},{"language":"default","tag":"Workflows","count":117},{"language":"default","tag":"Use Cases","count":112},{"language":"default","tag":"Actions","count":44},{"language":"default","tag":"Agents","count":36},{"language":"default","tag":"Sales","count":24},{"language":"default","tag":"Advanced","count":21},{"language":"default","tag":"Marketing","count":18},{"language":"default","tag":"Settings and admin","count":17}]},"assistantConfig":{"enableAskAiButton":false,"enableStarterQuestions":false,"enableContextualStarterQuestions":false,"enableAskAiSearchBar":true},"basePath":"","hasChatPermissions":false,"hasWebMcpPermissions":true,"toggles":[{"name":"kill-isr","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-mintlify-slack","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"agent-integrations-settings","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"rbac-expansion","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-pr-grouping","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"custom-prefix","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"analytics-v7","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"user-flows-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"no-publish-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-onboarding","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"llms-txt-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving-live","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"stripTemperatureMiddleware","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"support-platform-pylon-zendesk","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"snapshot-serving","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"instant-rollback","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications-server","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"granular-notifications","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automations-fable","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fixed-ai-action-pricing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"automation-resolve-merge-conflict","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"scoped-publishing","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"mintql","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"page-level-analytics","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"editor-version-history-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"billing-page-v2","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"full-page-search","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workspace-projects","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"assistant-v5","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"fork-pr-previews","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"revalidation-jwt","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"vite-origin","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-sso-scim","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"hobby-abuse-scan","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"dashboard-inbox","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-signup","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-dual-write","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"workos-enabled","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"approve-review-flow","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"sso-setup-deadline-banner","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"turbopuffer-serve","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"live-agents","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false},{"name":"comment-mode","enabled":true,"variant":{"name":"disabled","enabled":false,"feature_enabled":true},"impressionData":false}],"googleFontsInlined":false},"customCss":[],"page":{"pagePath":"api-reference/audit-logs/list-audit-logs","slug":"/api-reference/audit-logs/list-audit-logs","pageMetadata":{"title":"List audit logs","description":"Lists your organization's audit log events in the range, newest first by default. These are the same events as the [Audit Logs](https://docs.cassidyai.com/settings/audit-logs) page.\n\n**Each event includes**\n- What happened: its category, action, and operation type, such as `read` or `update`\n- Who did it: a user, an external user, an Admin API key, or the system\n- The resource it was about, and a related resource if there is one\n- When it happened, the IP address, and event-specific details\n\nFilter by category, actor, resource type and action, resource, or operation type. Page through results with `cursor`.\n\n**Polling mode**\n\nTo send events to your SIEM or another system, use polling mode: pass `order=asc` and `from` without `to`, then poll with each response's `nextCursor`. The cursor is always returned, even when there are no new events. Request the next page right away while `hasMore` is true, and wait for your next poll once it is false.\n\nEvents can take up to 2 minutes to appear, so polling never skips an event that is still being recorded.\n\nEach call to this endpoint records an audit log export event. Those events are filtered out of results for the Admin key that made the call. Other keys and the Audit Logs page still show them.\n\nRequires the Audit logs permission (`audit_logs:read`).","deprecated":null,"version":null,"openapi":"/admin-api-openapi.json get /audit-logs","href":"/api-reference/audit-logs/list-audit-logs","autogeneratedByOpenApi":true,"hidden":true},"description":{"compiledSource":"\"use strict\";\nconst {Fragment: _Fragment, jsx: _jsx, jsxs: _jsxs} = arguments[0];\nconst {useMDXComponents: _provideComponents} = arguments[0];\nfunction _createMdxContent(props) {\n const _components = {\n a: \"a\",\n code: \"code\",\n li: \"li\",\n p: \"p\",\n strong: \"strong\",\n ul: \"ul\",\n ..._provideComponents(),\n ...props.components\n };\n return _jsxs(_Fragment, {\n children: [_jsxs(_components.p, {\n children: [\"Lists your organization’s audit log events in the range, newest first by default. These are the same events as the \", _jsx(_components.a, {\n href: \"https://docs.cassidyai.com/settings/audit-logs\",\n children: \"Audit Logs\"\n }), \" page.\"]\n }), \"\\n\", _jsx(_components.p, {\n children: _jsx(_components.strong, {\n children: \"Each event includes\"\n })\n }), \"\\n\", _jsxs(_components.ul, {\n children: [\"\\n\", _jsxs(_components.li, {\n children: [\"What happened: its category, action, and operation type, such as \", _jsx(_components.code, {\n children: \"read\"\n }), \" or \", _jsx(_components.code, {\n children: \"update\"\n })]\n }), \"\\n\", _jsx(_components.li, {\n children: \"Who did it: a user, an external user, an Admin API key, or the system\"\n }), \"\\n\", _jsx(_components.li, {\n children: \"The resource it was about, and a related resource if there is one\"\n }), \"\\n\", _jsx(_components.li, {\n children: \"When it happened, the IP address, and event-specific details\"\n }), \"\\n\"]\n }), \"\\n\", _jsxs(_components.p, {\n children: [\"Filter by category, actor, resource type and action, resource, or operation type. Page through results with \", _jsx(_components.code, {\n children: \"cursor\"\n }), \".\"]\n }), \"\\n\", _jsx(_components.p, {\n children: _jsx(_components.strong, {\n children: \"Polling mode\"\n })\n }), \"\\n\", _jsxs(_components.p, {\n children: [\"To send events to your SIEM or another system, use polling mode: pass \", _jsx(_components.code, {\n children: \"order=asc\"\n }), \" and \", _jsx(_components.code, {\n children: \"from\"\n }), \" without \", _jsx(_components.code, {\n children: \"to\"\n }), \", then poll with each response’s \", _jsx(_components.code, {\n children: \"nextCursor\"\n }), \". The cursor is always returned, even when there are no new events. Request the next page right away while \", _jsx(_components.code, {\n children: \"hasMore\"\n }), \" is true, and wait for your next poll once it is false.\"]\n }), \"\\n\", _jsx(_components.p, {\n children: \"Events can take up to 2 minutes to appear, so polling never skips an event that is still being recorded.\"\n }), \"\\n\", _jsx(_components.p, {\n children: \"Each call to this endpoint records an audit log export event. Those events are filtered out of results for the Admin key that made the call. Other keys and the Audit Logs page still show them.\"\n }), \"\\n\", _jsxs(_components.p, {\n children: [\"Requires the Audit logs permission (\", _jsx(_components.code, {\n children: \"audit_logs:read\"\n }), \").\"]\n })]\n });\n}\nfunction MDXContent(props = {}) {\n const {wrapper: MDXLayout} = {\n ..._provideComponents(),\n ...props.components\n };\n return MDXLayout ? _jsx(MDXLayout, {\n ...props,\n children: _jsx(_createMdxContent, {\n ...props\n })\n }) : _createMdxContent(props);\n}\nreturn {\n default: MDXContent\n};\n","frontmatter":{},"scope":{}},"pageType":"default","mdx":{"mdxSource":{"compiledSource":"\"use strict\";const{Fragment:_Fragment,jsx:_jsx}=arguments[0];const{useMDXComponents:_provideComponents}=arguments[0];function _createMdxContent(props){return _jsx(_Fragment,{})}function MDXContent(props={}){const{wrapper:MDXLayout}={..._provideComponents(),...props.components};return MDXLayout?_jsx(MDXLayout,{...props,children:_jsx(_createMdxContent,{...props})}):_createMdxContent(props)}return{default:MDXContent}","frontmatter":{},"scope":{"config":{},"pageMetadata":{"title":"List audit logs","description":"Lists your organization's audit log events in the range, newest first by default. These are the same events as the [Audit Logs](https://docs.cassidyai.com/settings/audit-logs) page.\n\n**Each event includes**\n- What happened: its category, action, and operation type, such as `read` or `update`\n- Who did it: a user, an external user, an Admin API key, or the system\n- The resource it was about, and a related resource if there is one\n- When it happened, the IP address, and event-specific details\n\nFilter by category, actor, resource type and action, resource, or operation type. Page through results with `cursor`.\n\n**Polling mode**\n\nTo send events to your SIEM or another system, use polling mode: pass `order=asc` and `from` without `to`, then poll with each response's `nextCursor`. The cursor is always returned, even when there are no new events. Request the next page right away while `hasMore` is true, and wait for your next poll once it is false.\n\nEvents can take up to 2 minutes to appear, so polling never skips an event that is still being recorded.\n\nEach call to this endpoint records an audit log export event. Those events are filtered out of results for the Admin key that made the call. Other keys and the Audit Logs page still show them.\n\nRequires the Audit logs permission (`audit_logs:read`).","deprecated":null,"version":null,"openapi":"/admin-api-openapi.json get /audit-logs","href":"/api-reference/audit-logs/list-audit-logs","autogeneratedByOpenApi":true,"hidden":true}}},"mdxSourceWithNoJs":null},"mdxExtracts":{"tableOfContents":[],"codeExamples":{}},"jsLinks":[],"openApiReferenceData":{"operation":{"operationId":"listAuditLogs","summary":"List audit logs","description":"Lists your organization's audit log events in the range, newest first by default. These are the same events as the [Audit Logs](https://docs.cassidyai.com/settings/audit-logs) page.\n\n**Each event includes**\n- What happened: its category, action, and operation type, such as `read` or `update`\n- Who did it: a user, an external user, an Admin API key, or the system\n- The resource it was about, and a related resource if there is one\n- When it happened, the IP address, and event-specific details\n\nFilter by category, actor, resource type and action, resource, or operation type. Page through results with `cursor`.\n\n**Polling mode**\n\nTo send events to your SIEM or another system, use polling mode: pass `order=asc` and `from` without `to`, then poll with each response's `nextCursor`. The cursor is always returned, even when there are no new events. Request the next page right away while `hasMore` is true, and wait for your next poll once it is false.\n\nEvents can take up to 2 minutes to appear, so polling never skips an event that is still being recorded.\n\nEach call to this endpoint records an audit log export event. Those events are filtered out of results for the Admin key that made the call. Other keys and the Audit Logs page still show them.\n\nRequires the Audit logs permission (`audit_logs:read`).","tags":["Audit logs"],"security":["2a6efef6-17bb-42ad-bd80-03e31dbd6e4f"],"parameters":["76a9030c-5c50-4c6f-8fbb-4e7cff967af5","bb9ffbeb-f9a3-46f7-b488-2565a3a73462","b8827121-4dad-4f3a-beea-e795ac6eb821","ba7723a7-27e7-4bf4-be38-756b60d5cbb0","1d782c3b-6f95-4332-8168-b9cca189f543","22eded5d-d944-4672-9786-2f3144b53c72","8f122728-8505-484f-ad9d-4956724f467f","6256f08c-7a17-4eb4-9682-2424bac50f77","f4b94520-7fa0-4f04-8906-ece434da02c4","b6acd0f7-2b85-4393-9ac4-77f040fa8e30","42087988-5945-40f4-9458-e79dcea5eec0","fd298a45-6aa2-471c-a79d-3bc807fa51b3"],"responses":{"200":"40d23982-ad2a-4176-918e-456c50429a72","400":"b4b95407-d651-42f9-95c1-1d0a3001d104","401":"8a3b053c-16a2-43ad-8f14-47f6816a031a","403":"97e2b62c-a54e-4eed-b9bf-1aeb35b5de3f","404":"d7253865-bc69-4fd5-859d-aa62837e2fb5","500":"8efb0b8a-a902-44cf-abd4-68b610e02904"},"method":"get","type":"path","servers":["01feda05-5951-43f0-aa13-35afeb50c0c7"],"path":"/audit-logs","baseUrlOptions":["https://app.cassidyai.com/api/admin/v1"],"title":"List audit logs","codeSamples":[],"requiredOnlyExamples":false,"requestExampleType":"generated","responseExampleType":"generated"},"dependencies":{"parameters":{"76a9030c-5c50-4c6f-8fbb-4e7cff967af5":{"in":"query","name":"category","schema":{"description":"Only return events in this category.","type":"string","enum":["authentication","identity-access","organization","agents","chats","workflows","knowledge-base","integrations","meetings","billing","audit","cassidy-apps"],"uniqueKey":"","typeLabel":"enum\u003cstring>"},"description":"Only return events in this category."},"bb9ffbeb-f9a3-46f7-b488-2565a3a73462":{"in":"query","name":"actorId","schema":{"oneOf":[{"type":"string","description":"Only return events performed by this actor: a user ID, an Admin API key ID, or `cassidy` for system events.","uniqueKey":"oneOf.0","typeLabel":"string"},{"type":"string","description":"Only return events performed by this actor: a user ID, an Admin API key ID, or `cassidy` for system events.","const":"cassidy","uniqueKey":"oneOf.1","typeLabel":"string"}],"uniqueKey":"","typeLabel":"string"},"description":"Only return events performed by this actor: a user ID, an Admin API key ID, or `cassidy` for system events."},"b8827121-4dad-4f3a-beea-e795ac6eb821":{"in":"query","name":"subjectType","schema":{"description":"Only return events about this kind of resource, such as `agent`.","type":"string","uniqueKey":"","typeLabel":"string"},"description":"Only return events about this kind of resource, such as `agent`."},"ba7723a7-27e7-4bf4-be38-756b60d5cbb0":{"in":"query","name":"subjectId","schema":{"description":"Only return events about the resource with this ID.","type":"string","uniqueKey":"","typeLabel":"string"},"description":"Only return events about the resource with this ID."},"1d782c3b-6f95-4332-8168-b9cca189f543":{"in":"query","name":"targetId","schema":{"description":"Only return events whose target has this ID.","type":"string","uniqueKey":"","typeLabel":"string"},"description":"Only return events whose target has this ID."},"22eded5d-d944-4672-9786-2f3144b53c72":{"in":"query","name":"action","schema":{"description":"With `subjectType`, only return this action, such as `created`.","type":"string","uniqueKey":"","typeLabel":"string"},"description":"With `subjectType`, only return this action, such as `created`."},"8f122728-8505-484f-ad9d-4956724f467f":{"in":"query","name":"operationTypes","schema":{"description":"Only return events of these operation types, as a comma-separated list.","minItems":1,"type":"array","items":{"type":"string","enum":["read","create","update","delete","execute"],"uniqueKey":"items.[INDEX]","typeLabel":"enum\u003cstring>"},"uniqueKey":"","typeLabel":"enum\u003cstring>[]"},"description":"Only return events of these operation types, as a comma-separated list."},"6256f08c-7a17-4eb4-9682-2424bac50f77":{"in":"query","name":"order","schema":{"description":"`desc` (the default) returns the newest events first, and `asc` the oldest first. Using `asc` with no `to` is [polling mode](https://docs.cassidyai.com/reference/admin-api#send-audit-logs-to-your-siem), which follows new events as they arrive.","type":"string","enum":["asc","desc"],"uniqueKey":"","typeLabel":"enum\u003cstring>"},"description":"`desc` (the default) returns the newest events first, and `asc` the oldest first. Using `asc` with no `to` is [polling mode](https://docs.cassidyai.com/reference/admin-api#send-audit-logs-to-your-siem), which follows new events as they arrive."},"f4b94520-7fa0-4f04-8906-ece434da02c4":{"in":"query","name":"from","schema":{"description":"Inclusive start of the range as an ISO 8601 timestamp. Required without `cursor`.","type":"string","format":"date-time","uniqueKey":"","typeLabel":"string\u003cdate-time>"},"description":"Inclusive start of the range as an ISO 8601 timestamp. Required without `cursor`."},"b6acd0f7-2b85-4393-9ac4-77f040fa8e30":{"in":"query","name":"to","schema":{"description":"Exclusive end of the range as an ISO 8601 timestamp. Defaults to now, except with `order=asc`, where leaving it out uses [polling mode](https://docs.cassidyai.com/reference/admin-api#send-audit-logs-to-your-siem). The range can span at most 3 months. Events can take up to 2 minutes to appear.","type":"string","format":"date-time","uniqueKey":"","typeLabel":"string\u003cdate-time>"},"description":"Exclusive end of the range as an ISO 8601 timestamp. Defaults to now, except with `order=asc`, where leaving it out uses [polling mode](https://docs.cassidyai.com/reference/admin-api#send-audit-logs-to-your-siem). The range can span at most 3 months. Events can take up to 2 minutes to appear."},"42087988-5945-40f4-9458-e79dcea5eec0":{"in":"query","name":"limit","schema":{"description":"Maximum number of records to return.","default":100,"type":"integer","minimum":1,"maximum":1000,"uniqueKey":"","typeLabel":"integer"},"description":"Maximum number of records to return."},"fd298a45-6aa2-471c-a79d-3bc807fa51b3":{"in":"query","name":"cursor","schema":{"description":"The `nextCursor` from the previous response. It keeps the first request's `order`, `from`, and `to`, so you can leave those out, but any you pass must match. Pass the same filters as the first request.","type":"string","uniqueKey":"","typeLabel":"string"},"description":"The `nextCursor` from the previous response. It keeps the first request's `order`, `from`, and `to`, so you can leave those out, but any you pass must match. Pass the same filters as the first request."}},"responses":{"40d23982-ad2a-4176-918e-456c50429a72":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"nextCursor":{"oneOf":[{"description":"Pass as `cursor` to get the next page. Null on the last page, except in [polling mode](https://docs.cassidyai.com/reference/admin-api#send-audit-logs-to-your-siem), where it is always returned so the next request resumes from it.","type":"string","isRequired":true,"uniqueKey":"nextCursor.oneOf.0","typeLabel":"string"},{"description":"Pass as `cursor` to get the next page. Null on the last page, except in [polling mode](https://docs.cassidyai.com/reference/admin-api#send-audit-logs-to-your-siem), where it is always returned so the next request resumes from it.","type":"null","isRequired":true,"uniqueKey":"nextCursor.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"nextCursor","typeLabel":"string | null"},"hasMore":{"type":"boolean","description":"Whether more events are available now.","isRequired":true,"uniqueKey":"hasMore","typeLabel":"boolean"},"auditLogs":{"type":"array","items":{"type":"object","properties":{"id":{"type":"string","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].id","typeLabel":"string"},"timestamp":{"type":"string","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].timestamp","typeLabel":"string"},"category":{"type":"string","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].category","typeLabel":"string"},"action":{"type":"string","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].action","typeLabel":"string"},"operationType":{"type":"string","enum":["read","create","update","delete","execute"],"isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].operationType","typeLabel":"enum\u003cstring>"},"actor":{"type":"object","properties":{"type":{"type":"string","enum":["user","system","externalUser","adminApiKey"],"isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].actor.type","typeLabel":"enum\u003cstring>"},"id":{"oneOf":[{"description":"The user ID for `user` actors and the Admin API key ID for `adminApiKey` actors. Null for other actors.","type":"string","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].actor.id.oneOf.0","typeLabel":"string"},{"description":"The user ID for `user` actors and the Admin API key ID for `adminApiKey` actors. Null for other actors.","type":"null","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].actor.id.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].actor.id","typeLabel":"string | null"},"name":{"type":"string","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].actor.name","typeLabel":"string"}},"required":["type","id","name"],"isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].actor","typeLabel":"object"},"subject":{"type":"object","properties":{"type":{"type":"string","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].subject.type","typeLabel":"string"},"id":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].subject.id.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].subject.id.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].subject.id","typeLabel":"string | null"},"name":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].subject.name.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].subject.name.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].subject.name","typeLabel":"string | null"}},"required":["type","id","name"],"isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].subject","typeLabel":"object"},"target":{"oneOf":[{"type":"object","required":["type","id","name"],"properties":{"type":{"type":"string","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].target.oneOf.0.type","typeLabel":"string"},"id":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].target.oneOf.0.id.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].target.oneOf.0.id.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].target.oneOf.0.id","typeLabel":"string | null"},"name":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].target.oneOf.0.name.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].target.oneOf.0.name.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].target.oneOf.0.name","typeLabel":"string | null"}},"isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].target.oneOf.0","typeLabel":"object"},{"type":"null","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].target.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].target","typeLabel":"object | null"},"ipAddress":{"oneOf":[{"type":"string","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].ipAddress.oneOf.0","typeLabel":"string"},{"type":"null","isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].ipAddress.oneOf.1","typeLabel":"null"}],"isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].ipAddress","typeLabel":"string | null"},"details":{"type":"object","propertyNames":{"type":"string"},"additionalProperties":{"oneOf":[{}],"uniqueKey":"auditLogs.items.[INDEX].details.additionalProperties","typeLabel":"any"},"isRequired":true,"uniqueKey":"auditLogs.items.[INDEX].details","typeLabel":"object"}},"required":["id","timestamp","category","action","operationType","actor","subject","target","ipAddress","details"],"uniqueKey":"auditLogs.items.[INDEX]","typeLabel":"object"},"isRequired":true,"uniqueKey":"auditLogs","typeLabel":"object[]"}},"required":["nextCursor","hasMore","auditLogs"],"uniqueKey":"","typeLabel":"object"},"examples":{"Example":{"title":"Example","value":{"nextCursor":"\u003cstring>","hasMore":true,"auditLogs":[{"id":"\u003cstring>","timestamp":"\u003cstring>","category":"\u003cstring>","action":"\u003cstring>","operationType":"read","actor":{"type":"user","id":"\u003cstring>","name":"\u003cstring>"},"subject":{"type":"\u003cstring>","id":"\u003cstring>","name":"\u003cstring>"},"target":{"type":"\u003cstring>","id":"\u003cstring>","name":"\u003cstring>"},"ipAddress":"\u003cstring>","details":{}}]}}},"exampleType":"generated"}},"exampleType":"generated"},"b4b95407-d651-42f9-95c1-1d0a3001d104":{"description":"Invalid input data","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"The error message","example":"Invalid input data","isRequired":true,"uniqueKey":"message","typeLabel":"string"},"code":{"type":"string","description":"The error code","example":"BAD_REQUEST","isRequired":true,"uniqueKey":"code","typeLabel":"string"},"issues":{"description":"An array of issues that were responsible for the error","example":[],"type":"array","items":{"type":"object","properties":{"message":{"type":"string","isRequired":true,"uniqueKey":"issues.items.[INDEX].message","typeLabel":"string"}},"required":["message"],"uniqueKey":"issues.items.[INDEX]","typeLabel":"object"},"uniqueKey":"issues","typeLabel":"object[]"}},"required":["message","code"],"title":"Invalid input data error (400)","description":"The error information","example":{"code":"BAD_REQUEST","message":"Invalid input data","issues":[]},"uniqueKey":"","typeLabel":"Invalid input data error (400) · object"},"examples":{"Example":{"title":"Example","value":{"code":"BAD_REQUEST","message":"Invalid input data","issues":[]}}},"exampleType":"generated"}},"exampleType":"generated"},"8a3b053c-16a2-43ad-8f14-47f6816a031a":{"description":"Authorization not provided","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"The error message","example":"Authorization not provided","isRequired":true,"uniqueKey":"message","typeLabel":"string"},"code":{"type":"string","description":"The error code","example":"UNAUTHORIZED","isRequired":true,"uniqueKey":"code","typeLabel":"string"},"issues":{"description":"An array of issues that were responsible for the error","example":[],"type":"array","items":{"type":"object","properties":{"message":{"type":"string","isRequired":true,"uniqueKey":"issues.items.[INDEX].message","typeLabel":"string"}},"required":["message"],"uniqueKey":"issues.items.[INDEX]","typeLabel":"object"},"uniqueKey":"issues","typeLabel":"object[]"}},"required":["message","code"],"title":"Authorization not provided error (401)","description":"The error information","example":{"code":"UNAUTHORIZED","message":"Authorization not provided","issues":[]},"uniqueKey":"","typeLabel":"Authorization not provided error (401) · object"},"examples":{"Example":{"title":"Example","value":{"code":"UNAUTHORIZED","message":"Authorization not provided","issues":[]}}},"exampleType":"generated"}},"exampleType":"generated"},"97e2b62c-a54e-4eed-b9bf-1aeb35b5de3f":{"description":"Insufficient access","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"The error message","example":"Insufficient access","isRequired":true,"uniqueKey":"message","typeLabel":"string"},"code":{"type":"string","description":"The error code","example":"FORBIDDEN","isRequired":true,"uniqueKey":"code","typeLabel":"string"},"issues":{"description":"An array of issues that were responsible for the error","example":[],"type":"array","items":{"type":"object","properties":{"message":{"type":"string","isRequired":true,"uniqueKey":"issues.items.[INDEX].message","typeLabel":"string"}},"required":["message"],"uniqueKey":"issues.items.[INDEX]","typeLabel":"object"},"uniqueKey":"issues","typeLabel":"object[]"}},"required":["message","code"],"title":"Insufficient access error (403)","description":"The error information","example":{"code":"FORBIDDEN","message":"Insufficient access","issues":[]},"uniqueKey":"","typeLabel":"Insufficient access error (403) · object"},"examples":{"Example":{"title":"Example","value":{"code":"FORBIDDEN","message":"Insufficient access","issues":[]}}},"exampleType":"generated"}},"exampleType":"generated"},"d7253865-bc69-4fd5-859d-aa62837e2fb5":{"description":"Not found","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"The error message","example":"Not found","isRequired":true,"uniqueKey":"message","typeLabel":"string"},"code":{"type":"string","description":"The error code","example":"NOT_FOUND","isRequired":true,"uniqueKey":"code","typeLabel":"string"},"issues":{"description":"An array of issues that were responsible for the error","example":[],"type":"array","items":{"type":"object","properties":{"message":{"type":"string","isRequired":true,"uniqueKey":"issues.items.[INDEX].message","typeLabel":"string"}},"required":["message"],"uniqueKey":"issues.items.[INDEX]","typeLabel":"object"},"uniqueKey":"issues","typeLabel":"object[]"}},"required":["message","code"],"title":"Not found error (404)","description":"The error information","example":{"code":"NOT_FOUND","message":"Not found","issues":[]},"uniqueKey":"","typeLabel":"Not found error (404) · object"},"examples":{"Example":{"title":"Example","value":{"code":"NOT_FOUND","message":"Not found","issues":[]}}},"exampleType":"generated"}},"exampleType":"generated"},"8efb0b8a-a902-44cf-abd4-68b610e02904":{"description":"Internal server error","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"The error message","example":"Internal server error","isRequired":true,"uniqueKey":"message","typeLabel":"string"},"code":{"type":"string","description":"The error code","example":"INTERNAL_SERVER_ERROR","isRequired":true,"uniqueKey":"code","typeLabel":"string"},"issues":{"description":"An array of issues that were responsible for the error","example":[],"type":"array","items":{"type":"object","properties":{"message":{"type":"string","isRequired":true,"uniqueKey":"issues.items.[INDEX].message","typeLabel":"string"}},"required":["message"],"uniqueKey":"issues.items.[INDEX]","typeLabel":"object"},"uniqueKey":"issues","typeLabel":"object[]"}},"required":["message","code"],"title":"Internal server error error (500)","description":"The error information","example":{"code":"INTERNAL_SERVER_ERROR","message":"Internal server error","issues":[]},"uniqueKey":"","typeLabel":"Internal server error error (500) · object"},"examples":{"Example":{"title":"Example","value":{"code":"INTERNAL_SERVER_ERROR","message":"Internal server error","issues":[]}}},"exampleType":"generated"}},"exampleType":"generated"}},"security":{"2a6efef6-17bb-42ad-bd80-03e31dbd6e4f":{"bearerAuth":{"type":"http","scheme":"bearer","description":"An Admin API key, starting with `cas_admin_`.","scopes":["audit_logs:read"],"schemeName":"bearerAuth"}}},"servers":{"01feda05-5951-43f0-aa13-35afeb50c0c7":{"url":"https://app.cassidyai.com/api/admin/v1"}},"processedSecurityOptions":[{"schemes":[{"scheme":{"type":"http","scheme":"bearer","description":"An Admin API key, starting with `cas_admin_`.","scopes":["audit_logs:read"],"schemeName":"bearerAuth"},"schema":{"title":"Bearer Auth","type":"string","isRequired":true,"description":"An Admin API key, starting with `cas_admin_`.","format":"bearer","typeLabel":"string\u003cbearer>","deprecated":false},"schemeName":"bearerAuth","name":"Authorization"}],"title":"bearerAuth"}]},"originalFileLocation":"admin-api-openapi.json"},"subdomain":"cassidy","siteName":"Cassidy","title":"List audit logs - Cassidy","navMaps":{"firstHrefInVersion":{},"firstHrefInLanguage":{}},"lastModified":"2026-11-05T18:34:05.082Z","originalFileLocation":"api-reference/audit-logs/list-audit-logs.mdx"},"headHtml":"\u003cscript data-mint-head>(function(){var d=document.documentElement,p=null;if(!p){try{p=localStorage.getItem(\"isDarkMode\")}catch(e){}if(p==='true')p='dark';else if(p==='false')p='light';if(p!=='light'\u0026\u0026p!=='dark'\u0026\u0026p!=='system')p=\"system\"}var r=p==='system'?(matchMedia(\"(prefers-color-scheme: dark)\").matches?'dark':'light'):p;d.classList.remove(r==='dark'?'light':'dark');d.classList.add(r);d.setAttribute(\"data-theme-preference\",p)})();\u003c/script>\u003cmeta data-mint-head name=\"description\" content=\"Lists your organization\u0026#x27;s audit log events in the range, newest first by default. These are the same events as the Audit Logs page. Each event includes - What happened: its category, action, and operation type, such as read or update - Who did it: a user, an external user, an Admin API key, or the system - The resource it was about, and a related resource if there is one - When it happened, the IP address, and event-specific details Filter by category, actor, resource type and action, resource, or operation type. Page through results with cursor. Polling mode To send events to your SIEM or another system, use polling mode: pass order=asc and from without to, then poll with each response\u0026#x27;s nextCursor. The cursor is always returned, even when there are no new events. Request the next page right away while hasMore is true, and wait for your next poll once it is false. Events can take up to 2 minutes to appear, so polling never skips an event that is still being recorded. Each call to this endpoint records an audit log export event. Those events are filtered out of results for the Admin key that made the call. Other keys and the Audit Logs page still show them. Requires the Audit logs permission (audit_logs:read).\">\u003cmeta data-mint-head name=\"application-name\" content=\"Cassidy\">\u003cmeta data-mint-head name=\"generator\" content=\"Mintlify\">\u003cmeta data-mint-head name=\"robots\" content=\"noindex\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/cassidy/gcVXXkk00gvCM7Lb/_generated/favicon/android-chrome-192x192.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"apple-touch-icon\" type=\"image/png\" sizes=\"180x180\" href=\"/mintlify-assets/_mintlify/favicons/cassidy/gcVXXkk00gvCM7Lb/_generated/favicon/apple-touch-icon.png\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/cassidy/gcVXXkk00gvCM7Lb/_generated/favicon/favicon-16x16.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/cassidy/gcVXXkk00gvCM7Lb/_generated/favicon/favicon-32x32.png\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/cassidy/gcVXXkk00gvCM7Lb/_generated/favicon/favicon.ico\" media=\"(prefers-color-scheme: light)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"192x192\" href=\"/mintlify-assets/_mintlify/favicons/cassidy/gcVXXkk00gvCM7Lb/_generated/favicon-dark/android-chrome-192x192.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"16x16\" href=\"/mintlify-assets/_mintlify/favicons/cassidy/gcVXXkk00gvCM7Lb/_generated/favicon-dark/favicon-16x16.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"icon\" type=\"image/png\" sizes=\"32x32\" href=\"/mintlify-assets/_mintlify/favicons/cassidy/gcVXXkk00gvCM7Lb/_generated/favicon-dark/favicon-32x32.png\" media=\"(prefers-color-scheme: dark)\">\u003clink data-mint-head rel=\"shortcut icon\" type=\"image/x-icon\" href=\"/mintlify-assets/_mintlify/favicons/cassidy/gcVXXkk00gvCM7Lb/_generated/favicon-dark/favicon.ico\" media=\"(prefers-color-scheme: dark)\">\u003cmeta data-mint-head property=\"og:title\" content=\"List audit logs - Cassidy\">\u003cmeta data-mint-head property=\"og:description\" content=\"Lists your organization\u0026#x27;s audit log events in the range, newest first by default. These are the same events as the Audit Logs page. Each event includes - What happened: its category, action, and operation type, such as read or update - Who did it: a user, an external user, an Admin API key, or the system - The resource it was about, and a related resource if there is one - When it happened, the IP address, and event-specific details Filter by category, actor, resource type and action, resource, or operation type. Page through results with cursor. Polling mode To send events to your SIEM or another system, use polling mode: pass order=asc and from without to, then poll with each response\u0026#x27;s nextCursor. The cursor is always returned, even when there are no new events. Request the next page right away while hasMore is true, and wait for your next poll once it is false. Events can take up to 2 minutes to appear, so polling never skips an event that is still being recorded. Each call to this endpoint records an audit log export event. Those events are filtered out of results for the Admin key that made the call. Other keys and the Audit Logs page still show them. Requires the Audit logs permission (audit_logs:read).\">\u003cmeta data-mint-head property=\"og:site_name\" content=\"Cassidy\">\u003cmeta data-mint-head property=\"og:url\" content=\"https://docs.cassidyai.com/api-reference/audit-logs/list-audit-logs\">\u003cmeta data-mint-head property=\"og:type\" content=\"website\">\u003cmeta data-mint-head property=\"og:image\" content=\"https://cassidy.mintlify.site/_mintlify/api/og/v2?division=Audit+logs\u0026amp;title=List+audit+logs\u0026amp;description=Lists+your+organization%27s+audit+log+events+in+the+range%2C+newest+first+by+default.+These+are+the+same+events+as+the+%5BAudit+Logs%5D%28https%3A%2F%2Fdocs.cassidyai.com%2Fsetti\u0026amp;theme=45b88f546508cec88c9d93c2\u0026amp;signature=00fcedfc7f74e80d8dc357c213d6279ff594d76ec58179cfad53fdef72af2ad5\">\u003cmeta data-mint-head property=\"og:image:width\" content=\"1200\">\u003cmeta data-mint-head property=\"og:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"twitter:card\" content=\"summary_large_image\">\u003cmeta data-mint-head name=\"twitter:title\" content=\"List audit logs - Cassidy\">\u003cmeta data-mint-head name=\"twitter:description\" content=\"Lists your organization\u0026#x27;s audit log events in the range, newest first by default. These are the same events as the Audit Logs page. Each event includes - What happened: its category, action, and operation type, such as read or update - Who did it: a user, an external user, an Admin API key, or the system - The resource it was about, and a related resource if there is one - When it happened, the IP address, and event-specific details Filter by category, actor, resource type and action, resource, or operation type. Page through results with cursor. Polling mode To send events to your SIEM or another system, use polling mode: pass order=asc and from without to, then poll with each response\u0026#x27;s nextCursor. The cursor is always returned, even when there are no new events. Request the next page right away while hasMore is true, and wait for your next poll once it is false. Events can take up to 2 minutes to appear, so polling never skips an event that is still being recorded. Each call to this endpoint records an audit log export event. Those events are filtered out of results for the Admin key that made the call. Other keys and the Audit Logs page still show them. Requires the Audit logs permission (audit_logs:read).\">\u003cmeta data-mint-head name=\"twitter:image\" content=\"https://cassidy.mintlify.site/_mintlify/api/og/v2?division=Audit+logs\u0026amp;title=List+audit+logs\u0026amp;description=Lists+your+organization%27s+audit+log+events+in+the+range%2C+newest+first+by+default.+These+are+the+same+events+as+the+%5BAudit+Logs%5D%28https%3A%2F%2Fdocs.cassidyai.com%2Fsetti\u0026amp;theme=45b88f546508cec88c9d93c2\u0026amp;signature=00fcedfc7f74e80d8dc357c213d6279ff594d76ec58179cfad53fdef72af2ad5\">\u003cmeta data-mint-head name=\"twitter:image:width\" content=\"1200\">\u003cmeta data-mint-head name=\"twitter:image:height\" content=\"630\">\u003cmeta data-mint-head name=\"msapplication-config\" content=\"/mintlify-assets/_mintlify/favicons/cassidy/gcVXXkk00gvCM7Lb/_generated/favicon/browserconfig.xml\">\u003cmeta data-mint-head name=\"apple-mobile-web-app-title\" content=\"Cassidy\">\u003cmeta data-mint-head name=\"msapplication-TileColor\" content=\"#325ED1\">\u003clink data-mint-head rel=\"canonical\" href=\"https://docs.cassidyai.com/api-reference/audit-logs/list-audit-logs\">\u003clink data-mint-head rel=\"alternate\" type=\"application/xml\" href=\"/sitemap.xml\">\u003clink data-mint-head rel=\"alternate\" type=\"text/markdown\" href=\"/api-reference/audit-logs/list-audit-logs.md\">\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://docs.cassidyai.com/#organization\",\"name\":\"Cassidy\",\"url\":\"https://docs.cassidyai.com\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https://mintcdn.com/cassidy/wE0GgFgF7sg6yClA/logo/light.svg?fit=max\u0026auto=format\u0026n=wE0GgFgF7sg6yClA\u0026q=85\u0026s=a282ef0ea39b2568b4c0d9164c38a471\"}},{\"@type\":\"WebSite\",\"@id\":\"https://docs.cassidyai.com#website\",\"name\":\"Cassidy\",\"url\":\"https://docs.cassidyai.com\",\"publisher\":{\"@id\":\"https://docs.cassidyai.com/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https://docs.cassidyai.com/api-reference/audit-logs/list-audit-logs#webpage\",\"url\":\"https://docs.cassidyai.com/api-reference/audit-logs/list-audit-logs\",\"name\":\"List audit logs\",\"description\":\"Lists your organization's audit log events in the range, newest first by default. These are the same events as the Audit Logs page. Each event includes - What happened: its category, action, and operation type, such as read or update - Who did it: a user, an external user, an Admin API key, or the system - The resource it was about, and a related resource if there is one - When it happened, the IP address, and event-specific details Filter by category, actor, resource type and action, resource, or operation type. Page through results with cursor. Polling mode To send events to your SIEM or another system, use polling mode: pass order=asc and from without to, then poll with each response's nextCursor. The cursor is always returned, even when there are no new events. Request the next page right away while hasMore is true, and wait for your next poll once it is false. Events can take up to 2 minutes to appear, so polling never skips an event that is still being recorded. Each call to this endpoint records an audit log export event. Those events are filtered out of results for the Admin key that made the call. Other keys and the Audit Logs page still show them. Requires the Audit logs permission (audit_logs:read).\",\"dateModified\":\"2026-11-05T18:34:05.082Z\",\"isPartOf\":{\"@id\":\"https://docs.cassidyai.com#website\"},\"breadcrumb\":{\"@id\":\"https://docs.cassidyai.com/api-reference/audit-logs/list-audit-logs#breadcrumb\"}},{\"@type\":\"BreadcrumbList\",\"@id\":\"https://docs.cassidyai.com/api-reference/audit-logs/list-audit-logs#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Admin API\",\"item\":\"https://docs.cassidyai.com/reference/admin-api\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"List audit logs\",\"item\":\"https://docs.cassidyai.com/api-reference/audit-logs/list-audit-logs\"}]},{\"@type\":[\"TechArticle\",\"APIReference\"],\"@id\":\"https://docs.cassidyai.com/api-reference/audit-logs/list-audit-logs#apireference\",\"headline\":\"List audit logs\",\"name\":\"List audit logs\",\"description\":\"Lists your organization's audit log events in the range, newest first by default. These are the same events as the Audit Logs page. Each event includes - What happened: its category, action, and operation type, such as read or update - Who did it: a user, an external user, an Admin API key, or the system - The resource it was about, and a related resource if there is one - When it happened, the IP address, and event-specific details Filter by category, actor, resource type and action, resource, or operation type. Page through results with cursor. Polling mode To send events to your SIEM or another system, use polling mode: pass order=asc and from without to, then poll with each response's nextCursor. The cursor is always returned, even when there are no new events. Request the next page right away while hasMore is true, and wait for your next poll once it is false. Events can take up to 2 minutes to appear, so polling never skips an event that is still being recorded. Each call to this endpoint records an audit log export event. Those events are filtered out of results for the Admin key that made the call. Other keys and the Audit Logs page still show them. Requires the Audit logs permission (audit_logs:read).\",\"url\":\"https://docs.cassidyai.com/api-reference/audit-logs/list-audit-logs\",\"mainEntityOfPage\":{\"@id\":\"https://docs.cassidyai.com/api-reference/audit-logs/list-audit-logs#webpage\"},\"dateModified\":\"2026-11-05T18:34:05.082Z\",\"publisher\":{\"@id\":\"https://docs.cassidyai.com/#organization\"},\"isPartOf\":{\"@id\":\"https://docs.cassidyai.com#website\"}}]}\u003c/script>\u003cscript data-mint-head type=\"application/ld+json\">{\"@context\":\"https://schema.org\",\"@type\":\"WebSite\",\"name\":\"Cassidy\",\"creator\":{\"@type\":\"Organization\",\"name\":\"Mintlify\",\"url\":\"https://mintlify.com\"}}\u003c/script>","siteName":"Cassidy","nav":{"global":null,"tabs":[{"tab":"Documentation","pages":[{"title":"Documentation","href":""}]},{"tab":"Cassidy University","pages":[{"title":"Cassidy University","href":"/university"}]},{"tab":"Guides","pages":[{"title":"Guides","href":"/guides/chatting-with-an-agent"}]},{"tab":"Integrations","pages":[{"title":"Integrations","href":"/integrations/overview"}]},{"tab":"API Reference","hidden":true,"menu":[{"item":"Admin API","icon":"chart-column","description":"Pull organization-wide usage and activity.","groups":[{"group":"Admin API","pages":[{"title":"Pull usage analytics with the Admin API","description":"Create an Admin API key and pull organization-wide usage, Workflow runs, Agent chats, meetings, and Audit Logs into your own reports and dashboards.","icon":"chart-column","href":"/reference/admin-api"},{"group":"Analytics","pages":[{"title":"Get metrics timeseries","description":"Charts one metric across your organization over time, with a value for each time bucket and a total for the range.\n\n**Metrics** (`metric`)\n- `credits`: credits used across your organization\n- `meetingHours`: hours of meetings recorded\n- `meetings`: meetings recorded\n- `chatMessages`: messages sent to Agents\n- `workflowRuns`: Workflow runs\n\nEach meeting is attributed to one member, the person who first added the notetaker, so a person filter counts the meetings attributed to them. Totals include meetings deleted since.\n\n**Buckets** (`unit`)\n- `hour`, `day`, `week`, or `month`, in UTC. `credits` is available per day or coarser.\n\nNarrow the results to a person, group, Workflow, source, or specific Agents or models with the filters below.\n\nBuckets are in UTC, so daily totals can differ slightly from the Analytics dashboard, which uses your local time zone.\n\nRequires the Analytics permission (`analytics:read`).","deprecated":null,"version":null,"openapi":"/admin-api-openapi.json get /metrics/timeseries","href":"/api-reference/analytics/get-metrics-timeseries"},{"title":"Get metrics breakdown","description":"Totals one metric over the range for each user, group, Agent, Workflow, or source, largest first. For example, credits by person, Workflow runs by Workflow, or chat messages by source, such as Slack or Microsoft Teams.\n\n**Metrics and the dimensions they support** (`metric` and `groupBy`)\n- `credits`: `user`, `group`, `agent`, `workflow`, `source`\n- `chatMessages`: `user`, `group`, `agent`, `source`\n- `workflowRuns`: `user`, `group`, `workflow`\n- `meetingHours`: `user`, `group`\n- `meetings`: `user`, `group`\n\nFor `meetingHours` and `meetings`, each meeting counts toward the member it's attributed to, the person who first added the notetaker. To see who joined each meeting, use `/meetings`.\n\nNarrow the results to a person, group, Workflow, source, or specific Agents or models with the filters below.\n\nThe range is widened to whole days in UTC.\n\nRequires the Analytics permission (`analytics:read`).","deprecated":null,"version":null,"openapi":"/admin-api-openapi.json get /metrics/breakdown","href":"/api-reference/analytics/get-metrics-breakdown"}]},{"group":"Workflow runs","pages":[{"title":"List Workflow runs","description":"Lists individual Workflow runs started in the range, newest first.\n\n**Each run includes**\n- The Workflow and the person who started it\n- Its status, such as `success`, `failed`, or `running`\n- Whether it was a test run\n- The credits it used\n\nFilter by Workflow or person, or leave out test runs. Page through results with `cursor`.\n\n`credits` is null while a run is in progress.\n\nRequires the Workflow runs permission (`workflow_runs:read`).","deprecated":null,"version":null,"openapi":"/admin-api-openapi.json get /workflow-runs","href":"/api-reference/workflow-runs/list-workflow-runs"}]},{"group":"Chats","pages":[{"title":"List chats","description":"Lists Agent chats started in the range, newest first.\n\n**Each chat includes**\n- Its name and most recent Agent\n- The person who started it\n- Where it happened (`source`), such as `web`, `slack`, `teams`, or `embedded`\n- When it started and when it was last active\n- The credits it used\n\nFilter by person, Agent, model, or source. Agent and model filters match the chat's most recent Agent, so a chat that switched Agents is listed under the one it uses now. Page through results with `cursor`.\n\nExcludes chats run by Workflows and Agent test chats. Messages are not included.\n\nRequires the Chats permission (`chats:read`).","deprecated":null,"version":null,"openapi":"/admin-api-openapi.json get /chats","href":"/api-reference/chats/list-chats"}]},{"group":"Meetings","pages":[{"title":"List meetings","description":"Lists recorded meetings whose recording ended in the range, newest first.\n\n**Each meeting includes**\n- Its title and meeting platform\n- When recording started and ended, and the hours recorded\n- The members who added the notetaker\n- The members who joined, and how many other people joined\n\nFilter by a person to list the meetings they joined. Page through results with `cursor`.\n\nRequires the Meetings permission (`meetings:read`).","deprecated":null,"version":null,"openapi":"/admin-api-openapi.json get /meetings","href":"/api-reference/meetings/list-meetings"}]},{"group":"Audit logs","pages":[{"title":"List audit logs","deprecated":null,"version":null,"openapi":"/admin-api-openapi.json get /audit-logs","href":"/api-reference/audit-logs/list-audit-logs"}]}]}]},{"item":"Agents API","icon":"robot","description":"Chat with your Agents from your own apps.","pages":[{"title":"Agents API","href":"/reference/agents-api"}]}]},{"tab":"Use Cases","pages":[{"title":"Use Cases","href":"/use-cases"}]}]},"basePath":"","title":"List audit logs - Cassidy","buildId":"dpl_BLQvU86QFwq3AhPofSTw6q8dGWKm","deploymentId":"dpl_BLQvU86QFwq3AhPofSTw6q8dGWKm","dynamics":["c2aa737661","2b790eda92","b0f84f53ff","a9bb46feb3"],"chunks":["OpenApiReferenceProvider-Myd8dsju.js","utils-C2HkQgW0.js","cloneDeep-izs3Hzxb.js","_Uint8Array-BVIqJ90l.js","isObjectLike-C8vmzPEN.js","isArray-Dcu1dQ5t.js","utils-8rSppmTv.js","toString-BX-iyh8G.js","isSymbol-CSH9U2Gm.js","addUniqueKeysToSchema-B6MjiCFm.js","snippetPresets-DwrSAONL.js","style-to-object-BY3JEAdk.js","v4-DIgz8zy6.js","ApiExamples-1-a5UQKQ.js","isEqual-BfaiBbcl.js","usePlaygroundInputsStore-C541m7wZ.js","shallow-CWELCZ77.js","getApiPlaygroundDisplay-CTo5Zn03.js","CodeSnippet-D--dzvnl.js","CodeSnippets-DM3cXEDh.js","Page-CxAy5y67.js","getPastedJson-C-VECgcL.js","icon-BPq2-Mg3.js","MethodPill-D9J5cUHd.js","DuplicateIcon-BqHaxUnD.js","createIcon-CIbcZHp9.js","DynamicMarkdown-BKiHAm_d.js","SectionHeading-DstQXt3H.js","axios-vUo_bRtp.js","Markdown-CpxgzsKA.js","clsx-C5EfhVm0.js","lib-DuNMoZ05.js","lib-B8HbPgcC.js","html-void-elements-mCSPHezU.js","dist-CJ9Oly2E.js","katex-YMM-FMeD.js","marked.esm-CZWythHk.js","AssistantPageLink-Mk6P3qvh.js"]}