List audit logs with filters

POST

https://{tenant}.atomicwork.com/api/v1/audit-logs/list

POST

/api/v1/audit-logs/list

curl -X POST https://{tenant}.atomicwork.com/api/v1/audit-logs/list \
     -H "X-Workspace-Id: {{workspace_id}}" \
     -H "X-Api-Key: <apiKey>" \
     -H "Content-Type: application/json" \
     -d '{
  "0": {
    "attribute": "event_at",
    "operator": "IS_BETWEEN",
    "values": [
      {
        "value": "2024-01-01T00:00:00Z"
      },
      {
        "value": "2024-12-31T23:59:59Z"
      }
    ]
  },
  "1": {
    "attribute": "module",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 1
      },
      {
        "value": 9
      }
    ]
  },
  "2": {
    "attribute": "event_type",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 2
      },
      {
        "value": 3
      }
    ]
  },
  "3": {
    "attribute": "actor_id",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 123
      }
    ]
  }
}'

200Audit Logs_postapi_v1_audit_logs_list_example

{}

List audit logs with structured filters for actor, module, and event type

Filtering

Use the filters field to narrow results. Pass an empty array or omit the field to retrieve all records.

Each filter object has the following fields:

Field	Type	Description
`attribute`	string	The field to filter on (see Supported attributes below)
`operator`	string	Comparison operator (see Available operators below)
`values`	array	One or more `{ "value": <scalar> }` objects

Supported attributes

Attribute	Typical operator	Description
`event_at`	`IS_BETWEEN`	Event timestamp. Requires exactly two values: `[start, end]` (both inclusive). Accepts ISO 8601 (`2024-01-01T00:00:00Z`) or date-only (`2024-01-01` — end date is automatically extended to `T23:59:59Z`). On export, defaults to the last 6 months if omitted.
`actor_id`	`IS_ANY_OF`	Numeric user ID of the person who performed the action (the `id` field from `GET /api/v1/users`).
`module`	`IS_ANY_OF`	Module integer ID (not the name). See the Module IDs reference table below.
`event_type`	`IS_ANY_OF`	Event type integer ID (not the name). See the Event Type IDs reference table below. Not every event type is valid for every module — unsupported combinations return zero results.

Available operators

Operator	Meaning
`EQUALS`	Exact match
`NOT_EQUALS`	Exclude exact match
`IN` / `IS_ANY_OF`	Match any value in the list
`IS_NOT_ANY_OF`	Exclude all listed values
`IS_BETWEEN`	Inclusive range — pass exactly two values: `[start, end]`
`IS_ON_OR_BEFORE` / `IS_ON_OR_AFTER`	Date/time boundary comparisons
`CONTAINS` / `TEXT_CONTAINS`	Substring or set membership
`IS_NULL` / `IS_NOT_NULL`	Null checks — `values` array can be empty
`STARTS_WITH` / `ENDS_WITH`	String prefix/suffix match

Module IDs (use with attribute: "module")

ID	Module	What it covers
`0`	APPS	Third-party app connections (connect / disconnect / update)
`1`	USERS	User creation and profile updates
`2`	WORKFLOWS	Automation workflow changes
`3`	SERVICE_CATALOG	Service catalog items
`4`	SECURITY	Login, logout, API key creation / deletion
`5`	SKILL	AI skill changes
`6`	WORKSPACES	Workspace settings changes
`7`	TENANT_MIGRATION	Sandbox import / export
`8`	AGENT_GROUPS	Agent group changes
`9`	ACCESS_MANAGEMENT	Role and access control changes
`10`	AI_AGENTS	AI agent changes
`11`	AGENT_AVAILABILITY	Agent availability updates
`12`	CUSTOM_OBJECTS	Custom object type changes

Event Type IDs (use with attribute: "event_type")

ID	Event Type
`0`	CONNECTED
`1`	DISCONNECTED
`2`	CREATED
`3`	UPDATED
`4`	ENABLED
`5`	DISABLED
`6`	DELETED
`7`	IMPORT
`8`	EXPORT
`9`	RESTORED
`10`	LOGIN
`12`	LOGOUT

Module → valid event types

Module	Valid event type IDs
APPS (0)	0 (CONNECTED), 1 (DISCONNECTED), 3 (UPDATED)
USERS (1)	2 (CREATED), 3 (UPDATED)
WORKFLOWS (2)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
SERVICE_CATALOG (3)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
SECURITY (4)	2 (CREATED), 6 (DELETED), 10 (LOGIN), 12 (LOGOUT)
SKILL (5)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
WORKSPACES (6)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
TENANT_MIGRATION (7)	7 (IMPORT), 8 (EXPORT)
AGENT_GROUPS (8)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
ACCESS_MANAGEMENT (9)	2 (CREATED), 3 (UPDATED), 6 (DELETED), 9 (RESTORED)
AI_AGENTS (10)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
AGENT_AVAILABILITY (11)	3 (UPDATED)
CUSTOM_OBJECTS (12)	2 (CREATED), 3 (UPDATED), 6 (DELETED)

Example

[
  {
    "attribute": "event_at",
    "operator": "IS_BETWEEN",
    "values": [
      {
        "value": "2024-01-01T00:00:00Z"
      },
      {
        "value": "2024-12-31T23:59:59Z"
      }
    ]
  },
  {
    "attribute": "module",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 1
      },
      {
        "value": 9
      }
    ]
  },
  {
    "attribute": "event_type",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 2
      },
      {
        "value": 3
      }
    ]
  },
  {
    "attribute": "actor_id",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 123
      }
    ]
  }
]

Authentication

X-Api-Keystring

API Key authentication via header

Request

This endpoint expects an object.

search_keystringOptional

pageintegerOptional>=1Defaults to 1

per_pageintegerOptional10-100Defaults to 25

next_page_tokenstringOptional

filterslist of objectsOptional

sort_orderenumOptional

Allowed values:

Response

Successful response

Filtering

Authentication

Headers

Request

Response