List audit log events

curl --request GET \
  --url https://v1.api.altostrat.io/audit-logs \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://v1.api.altostrat.io/audit-logs', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://v1.api.altostrat.io/audit-logs",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://v1.api.altostrat.io/audit-logs"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://v1.api.altostrat.io/audit-logs")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "data": [
    {
      "log_id": "log_2zqrA8B3C4d5E6f7g8h9I0jKlMn",
      "organization_id": "org_xWl6uERh4pBpJxhA",
      "workspace_id": "ws_sz4e50hmqKgjxwiYsK",
      "user_id": "auth0|9b6efd7459f548c8bb542fe81568791f",
      "name": "Jane Doe",
      "email": "jane.doe@altostrat.io",
      "session_id": "sess_a1b2c3d4e5f6a7b8",
      "event_time": "2025-10-29T12:26:01.123Z",
      "method": "PUT",
      "endpoint": "/api/v1/projects/proj_A7Bkj29s/settings",
      "status_code": 200,
      "status_code_type": "2xx",
      "ip_address": "188.45.21.109",
      "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",
      "frontend_page": "/projects/proj_A7Bkj29s/settings/general",
      "request_payload": {
        "name": "My Awesome Updated Project",
        "visibility": "private"
      },
      "response_payload": {
        "status": "success",
        "message": "Project settings updated successfully."
      },
      "request_id": "req_abc123xyz789-test-01",
      "ttl": 1766862361
    }
  ],
  "pagination": {
    "count": 25,
    "limit": 25,
    "cursor": "eyJQSyI6eyJTIjoiT1JH...In0sInNrIjp7IlMiOiJMT0cj...In19",
    "has_more": true
  },
  "filters": {
    "start_date": "2025-10-01",
    "http_verb": "PUT",
    "limit": 25
  },
  "query_info": {
    "scanned_count": 150,
    "query_time_seconds": 0.082
  },
  "warnings": [
    "Results may be incomplete when using search_term due to query limitations. Use more specific, indexed filters for comprehensive results."
  ],
  "context": {
    "requesting_user_id": "auth0|5a4b3c2d1e0f9g8h7i6j5k4l",
    "requesting_workspace_id": "ws_abc123def456ghi789",
    "organization_id": "org_xWl6uERh4pBpJxhA",
    "timestamp": "2025-10-29T14:05:12.345Z"
  }
}

{
  "type": "invalid_request_error",
  "code": "parameter_invalid",
  "message": "The 'end_date' must be after or equal to the 'start_date'.",
  "doc_url": "https://docs.altostrat.io/errors/parameter_invalid"
}

{
  "type": "invalid_request_error",
  "code": "parameter_invalid",
  "message": "The 'end_date' must be after or equal to the 'start_date'.",
  "doc_url": "https://docs.altostrat.io/errors/parameter_invalid"
}

{
  "type": "invalid_request_error",
  "code": "parameter_invalid",
  "message": "The 'end_date' must be after or equal to the 'start_date'.",
  "doc_url": "https://docs.altostrat.io/errors/parameter_invalid"
}

GET

audit-logs

List audit log events

curl --request GET \
  --url https://v1.api.altostrat.io/audit-logs \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://v1.api.altostrat.io/audit-logs', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://v1.api.altostrat.io/audit-logs",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://v1.api.altostrat.io/audit-logs"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://v1.api.altostrat.io/audit-logs")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "data": [
    {
      "log_id": "log_2zqrA8B3C4d5E6f7g8h9I0jKlMn",
      "organization_id": "org_xWl6uERh4pBpJxhA",
      "workspace_id": "ws_sz4e50hmqKgjxwiYsK",
      "user_id": "auth0|9b6efd7459f548c8bb542fe81568791f",
      "name": "Jane Doe",
      "email": "jane.doe@altostrat.io",
      "session_id": "sess_a1b2c3d4e5f6a7b8",
      "event_time": "2025-10-29T12:26:01.123Z",
      "method": "PUT",
      "endpoint": "/api/v1/projects/proj_A7Bkj29s/settings",
      "status_code": 200,
      "status_code_type": "2xx",
      "ip_address": "188.45.21.109",
      "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",
      "frontend_page": "/projects/proj_A7Bkj29s/settings/general",
      "request_payload": {
        "name": "My Awesome Updated Project",
        "visibility": "private"
      },
      "response_payload": {
        "status": "success",
        "message": "Project settings updated successfully."
      },
      "request_id": "req_abc123xyz789-test-01",
      "ttl": 1766862361
    }
  ],
  "pagination": {
    "count": 25,
    "limit": 25,
    "cursor": "eyJQSyI6eyJTIjoiT1JH...In0sInNrIjp7IlMiOiJMT0cj...In19",
    "has_more": true
  },
  "filters": {
    "start_date": "2025-10-01",
    "http_verb": "PUT",
    "limit": 25
  },
  "query_info": {
    "scanned_count": 150,
    "query_time_seconds": 0.082
  },
  "warnings": [
    "Results may be incomplete when using search_term due to query limitations. Use more specific, indexed filters for comprehensive results."
  ],
  "context": {
    "requesting_user_id": "auth0|5a4b3c2d1e0f9g8h7i6j5k4l",
    "requesting_workspace_id": "ws_abc123def456ghi789",
    "organization_id": "org_xWl6uERh4pBpJxhA",
    "timestamp": "2025-10-29T14:05:12.345Z"
  }
}

{
  "type": "invalid_request_error",
  "code": "parameter_invalid",
  "message": "The 'end_date' must be after or equal to the 'start_date'.",
  "doc_url": "https://docs.altostrat.io/errors/parameter_invalid"
}

{
  "type": "invalid_request_error",
  "code": "parameter_invalid",
  "message": "The 'end_date' must be after or equal to the 'start_date'.",
  "doc_url": "https://docs.altostrat.io/errors/parameter_invalid"
}

{
  "type": "invalid_request_error",
  "code": "parameter_invalid",
  "message": "The 'end_date' must be after or equal to the 'start_date'.",
  "doc_url": "https://docs.altostrat.io/errors/parameter_invalid"
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

start_date

string<date>

The start date for the query range, inclusive. Format: YYYY-MM-DD.

Example:

"2025-10-01"

end_date

string<date>

The end date for the query range, inclusive. Must be on or after start_date. Format: YYYY-MM-DD.

Example:

"2025-10-31"

user_id

string

Filter events to a specific user by their unique identifier.

Example:

"auth0|9b6efd7459f548c8bb542fe81568791f"

workspace_id

string

Filter events to a specific workspace by its unique identifier.

Example:

"ws_sz4e50hmqKgjxwiYsK"

http_verb

string

Filter by HTTP method (e.g., POST, DELETE). To exclude a method, prefix it with an exclamation mark (e.g., !GET).

Example:

"POST"

status_code

integer

Filter by a specific HTTP status code.

Required range: 100 <= x <= 599

Example:

404

endpoint

string

Filter by the API endpoint path. This is a prefix search (e.g., /api/v1/users will match /api/v1/users/usr_123).

Example:

"/api/v1/projects"

search_term

string

A free-text search term. This will search across fields like endpoint, user name, email, IP address, and request/response payloads. Note: Using search_term may be less performant than indexed filters.

Example:

"user login failed"

ip_address

string<ipv4>

Filter events originating from a specific IP address.

Example:

"198.51.100.14"

cursor

string

An opaque string that identifies the starting point for the next page of results. Get this value from the pagination.cursor field of a previous response.

Example:

"eyJQSyI6eyJTIjoiT1JH...In0sInNrIjp7IlMiOiJMT0cj...In19"

limit

integer

default:25

A limit on the number of objects to be returned, between 1 and 100. The default is 25.

Required range: 1 <= x <= 100

Example:

50

sort_order

enum<string>

default:desc

The order in which to sort the results. desc for most recent first, asc for oldest first.

Available options:

asc,

desc

Example:

"desc"

Response

A paginated list of audit log events matching the query.

data

object[]

Show child attributes

pagination

object

Show child attributes

filters

object

The filters that were applied to this query.

Example:

{
  "start_date": "2025-10-01",
  "http_verb": "PUT",
  "limit": 25
}

query_info

object

Metadata about the query execution.

Show child attributes

warnings

string[]

A list of warnings about the query, such as when using potentially incomplete filters.

Example:

[
  "Results may be incomplete when using search_term due to query limitations. Use more specific, indexed filters for comprehensive results."
]

context

object

Contextual information about the API request itself.

Show child attributes

⌘I

Getting Started

Platform & Identity

Device Management & Orchestration

Automation & AI

Network Services & Connectivity

Security & Threat Management

Monitoring & Analytics

Core Services & Utilities

List audit log events

Authorizations

Query Parameters

Response