> ## Documentation Index > Fetch the complete documentation index at: https://docs.cassidyai.com/llms.txt > Use this file to discover all available pages before exploring further. # List audit logs > Lists your organization's audit log events in the range, newest first by default. These are the same events as the [Audit Logs](https://docs.cassidyai.com/settings/audit-logs) page. **Each event includes** - What happened: its category, action, and operation type, such as `read` or `update` - Who did it: a user, an external user, an Admin API key, or the system - The resource it was about, and a related resource if there is one - When it happened, the IP address, and event-specific details Filter by category, actor, resource type and action, resource, or operation type. Page through results with `cursor`. **Polling mode** To send events to your SIEM or another system, use polling mode: pass `order=asc` and `from` without `to`, then poll with each response's `nextCursor`. The cursor is always returned, even when there are no new events. Request the next page right away while `hasMore` is true, and wait for your next poll once it is false. Events can take up to 2 minutes to appear, so polling never skips an event that is still being recorded. Each call to this endpoint records an audit log export event. Those events are filtered out of results for the Admin key that made the call. Other keys and the Audit Logs page still show them. Requires the Audit logs permission (`audit_logs:read`). ## OpenAPI ````yaml /admin-api-openapi.json get /audit-logs openapi: 3.1.1 info: title: Cassidy Admin API description: Read your organization's usage analytics and activity in Cassidy. version: 1.0.0 servers: - url: https://app.cassidyai.com/api/admin/v1 security: [] tags: - name: Analytics - name: Workflow runs - name: Chats - name: Meetings - name: Audit logs externalDocs: url: https://docs.cassidyai.com/reference/admin-api paths: /audit-logs: get: tags: - Audit logs summary: List audit logs description: >- Lists your organization's audit log events in the range, newest first by default. These are the same events as the [Audit Logs](https://docs.cassidyai.com/settings/audit-logs) page. **Each event includes** - What happened: its category, action, and operation type, such as `read` or `update` - Who did it: a user, an external user, an Admin API key, or the system - The resource it was about, and a related resource if there is one - When it happened, the IP address, and event-specific details Filter by category, actor, resource type and action, resource, or operation type. Page through results with `cursor`. **Polling mode** To send events to your SIEM or another system, use polling mode: pass `order=asc` and `from` without `to`, then poll with each response's `nextCursor`. The cursor is always returned, even when there are no new events. Request the next page right away while `hasMore` is true, and wait for your next poll once it is false. Events can take up to 2 minutes to appear, so polling never skips an event that is still being recorded. Each call to this endpoint records an audit log export event. Those events are filtered out of results for the Admin key that made the call. Other keys and the Audit Logs page still show them. Requires the Audit logs permission (`audit_logs:read`). operationId: listAuditLogs parameters: - in: query name: category schema: description: Only return events in this category. type: string enum: - authentication - identity-access - organization - agents - chats - workflows - knowledge-base - integrations - meetings - billing - audit - cassidy-apps description: Only return events in this category. - in: query name: actorId schema: description: >- Only return events performed by this actor: a user ID, an Admin API key ID, or `cassidy` for system events. anyOf: - type: string - type: string const: cassidy description: >- Only return events performed by this actor: a user ID, an Admin API key ID, or `cassidy` for system events. - in: query name: subjectType schema: description: Only return events about this kind of resource, such as `agent`. type: string description: Only return events about this kind of resource, such as `agent`. - in: query name: subjectId schema: description: Only return events about the resource with this ID. type: string description: Only return events about the resource with this ID. - in: query name: targetId schema: description: Only return events whose target has this ID. type: string description: Only return events whose target has this ID. - in: query name: action schema: description: With `subjectType`, only return this action, such as `created`. type: string description: With `subjectType`, only return this action, such as `created`. - in: query name: operationTypes schema: description: >- Only return events of these operation types, as a comma-separated list. minItems: 1 type: array items: type: string enum: - read - create - update - delete - execute description: >- Only return events of these operation types, as a comma-separated list. - in: query name: order schema: description: >- `desc` (the default) returns the newest events first, and `asc` the oldest first. Using `asc` with no `to` is [polling mode](https://docs.cassidyai.com/reference/admin-api#send-audit-logs-to-your-siem), which follows new events as they arrive. type: string enum: - asc - desc description: >- `desc` (the default) returns the newest events first, and `asc` the oldest first. Using `asc` with no `to` is [polling mode](https://docs.cassidyai.com/reference/admin-api#send-audit-logs-to-your-siem), which follows new events as they arrive. - in: query name: from schema: description: >- Inclusive start of the range as an ISO 8601 timestamp. Required without `cursor`. type: string format: date-time description: >- Inclusive start of the range as an ISO 8601 timestamp. Required without `cursor`. - in: query name: to schema: description: >- Exclusive end of the range as an ISO 8601 timestamp. Defaults to now, except with `order=asc`, where leaving it out uses [polling mode](https://docs.cassidyai.com/reference/admin-api#send-audit-logs-to-your-siem). The range can span at most 3 months. Events can take up to 2 minutes to appear. type: string format: date-time description: >- Exclusive end of the range as an ISO 8601 timestamp. Defaults to now, except with `order=asc`, where leaving it out uses [polling mode](https://docs.cassidyai.com/reference/admin-api#send-audit-logs-to-your-siem). The range can span at most 3 months. Events can take up to 2 minutes to appear. - in: query name: limit schema: description: Maximum number of records to return. default: 100 type: integer minimum: 1 maximum: 1000 description: Maximum number of records to return. - in: query name: cursor schema: description: >- The `nextCursor` from the previous response. It keeps the first request's `order`, `from`, and `to`, so you can leave those out, but any you pass must match. Pass the same filters as the first request. type: string description: >- The `nextCursor` from the previous response. It keeps the first request's `order`, `from`, and `to`, so you can leave those out, but any you pass must match. Pass the same filters as the first request. responses: '200': description: Successful response content: application/json: schema: type: object properties: nextCursor: description: >- Pass as `cursor` to get the next page. Null on the last page, except in [polling mode](https://docs.cassidyai.com/reference/admin-api#send-audit-logs-to-your-siem), where it is always returned so the next request resumes from it. type: - string - 'null' hasMore: type: boolean description: Whether more events are available now. auditLogs: type: array items: type: object properties: id: type: string timestamp: type: string category: type: string action: type: string operationType: type: string enum: - read - create - update - delete - execute actor: type: object properties: type: type: string enum: - user - system - externalUser - adminApiKey id: description: >- The user ID for `user` actors and the Admin API key ID for `adminApiKey` actors. Null for other actors. type: - string - 'null' name: type: string required: - type - id - name subject: type: object properties: type: type: string id: type: - string - 'null' name: type: - string - 'null' required: - type - id - name target: anyOf: - type: object properties: type: type: string id: type: - string - 'null' name: type: - string - 'null' required: - type - id - name - type: 'null' ipAddress: type: - string - 'null' details: type: object propertyNames: type: string additionalProperties: {} required: - id - timestamp - category - action - operationType - actor - subject - target - ipAddress - details required: - nextCursor - hasMore - auditLogs '400': description: Invalid input data content: application/json: schema: $ref: '#/components/schemas/error.BAD_REQUEST' '401': description: Authorization not provided content: application/json: schema: $ref: '#/components/schemas/error.UNAUTHORIZED' '403': description: Insufficient access content: application/json: schema: $ref: '#/components/schemas/error.FORBIDDEN' '404': description: Not found content: application/json: schema: $ref: '#/components/schemas/error.NOT_FOUND' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/error.INTERNAL_SERVER_ERROR' security: - bearerAuth: - audit_logs:read components: schemas: error.BAD_REQUEST: type: object properties: message: type: string description: The error message example: Invalid input data code: type: string description: The error code example: BAD_REQUEST issues: description: An array of issues that were responsible for the error example: [] type: array items: type: object properties: message: type: string required: - message required: - message - code title: Invalid input data error (400) description: The error information example: code: BAD_REQUEST message: Invalid input data issues: [] error.UNAUTHORIZED: type: object properties: message: type: string description: The error message example: Authorization not provided code: type: string description: The error code example: UNAUTHORIZED issues: description: An array of issues that were responsible for the error example: [] type: array items: type: object properties: message: type: string required: - message required: - message - code title: Authorization not provided error (401) description: The error information example: code: UNAUTHORIZED message: Authorization not provided issues: [] error.FORBIDDEN: type: object properties: message: type: string description: The error message example: Insufficient access code: type: string description: The error code example: FORBIDDEN issues: description: An array of issues that were responsible for the error example: [] type: array items: type: object properties: message: type: string required: - message required: - message - code title: Insufficient access error (403) description: The error information example: code: FORBIDDEN message: Insufficient access issues: [] error.NOT_FOUND: type: object properties: message: type: string description: The error message example: Not found code: type: string description: The error code example: NOT_FOUND issues: description: An array of issues that were responsible for the error example: [] type: array items: type: object properties: message: type: string required: - message required: - message - code title: Not found error (404) description: The error information example: code: NOT_FOUND message: Not found issues: [] error.INTERNAL_SERVER_ERROR: type: object properties: message: type: string description: The error message example: Internal server error code: type: string description: The error code example: INTERNAL_SERVER_ERROR issues: description: An array of issues that were responsible for the error example: [] type: array items: type: object properties: message: type: string required: - message required: - message - code title: Internal server error error (500) description: The error information example: code: INTERNAL_SERVER_ERROR message: Internal server error issues: [] securitySchemes: bearerAuth: type: http scheme: bearer description: An Admin API key, starting with `cas_admin_`. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.