Read administrator audit logs. GET /api/openapi/v1/audit-logs, scope admin.v1.audit-logs.read.
- Scope: admin.v1.audit-logs.read
- Permission: Read administrator audit logs (audit-logs)
- Permission type: Read
- Endpoint: GET/api/openapi/v1/audit-logs
Authentication and request headers
Call with an application API key. This endpoint checks only the scope above; read, manage and execute permissions do not imply one another.
| Name | Location | Type | Required | Description | Example |
|---|---|---|---|---|---|
| Authorization | header | string | Yes | Application API key, passed as a Bearer token. | Bearer qwk_*** |
| X-Request-Id | header | string | No | Optional request tracing identifier; generated by the server if omitted. | req-20260831-001 |
Request parameters
| Name | Location | Type | Required | Description | Example |
|---|---|---|---|---|---|
| from | query | string · date-time | Required | Inclusive creation/event time, RFC3339 with timezone; keep fixed while paging. | "2026-08-27T10:00:00Z" |
| to | query | string · date-time | Required | Exclusive creation/event time, after from and at most 180 days later; keep fixed while paging. | "2026-08-27T10:00:00Z" |
| cursor | query | string | No | Opaque next_cursor from the previous page of the same organization and time interval. | "<string>" |
| page_size | query | integer · int64 | No | Page size | 20 |
Request example
cURL
Responses
200 OK
| Name | Type | Required | Description | Example |
|---|---|---|---|---|
| has_more | boolean | Yes | Whether more results are available | false |
| items | array<OpenapifacadeAuditLog> | Yes | Records | [{"action_code":"<string>","actor_auxiliary_identifier_snapshot":"<string>","actor_auxiliary_value_snapshot":"<string>","actor_email_snapshot":"<string>","actor_name_snapshot":"<string>","actor_qid_snapshot":"<string>","actor_user_id":"<string>","after_display":"<string>","before_display":"<string>","category":"<string>","detail_attributes":{},"detail_code":"<string>","detail_text":"<string>","event_id":"<string>","http_method":"<string>","occurred_at":"2026-08-27T10:00:00Z","operation_id":"<string>","org_id":"<string>","payload_hash":"<string>","replay_of_event_id":"<string>","request_id":"<string>","resource_id":"<string>","resource_label":"<string>","resource_type":"<string>","result":"<string>","route_template":"<string>","schema_version":0,"source":"<string>","source_ip":"<string>","source_service":"<string>","success_count":0,"target_count":0,"trace_id":"<string>"}] |
| items[].action_code | string | Yes | Actions | "<string>" |
| items[].actor_auxiliary_identifier_snapshot | string | Yes | Actor auxiliary identifier type at the time of the action | "<string>" |
| items[].actor_auxiliary_value_snapshot | string | Yes | Actor auxiliary identifier at the time of the action | "<string>" |
| items[].actor_email_snapshot | string | No | Actor email at the time of the action | "<string>" |
| items[].actor_name_snapshot | string | No | Actor name at the time of the action | "<string>" |
| items[].actor_qid_snapshot | string | Yes | Actor QID at the time of the action | "<string>" |
| items[].actor_user_id | string | Yes | Actor ID | "<string>" |
| items[].after_display | string ｜ null | Yes | Values after the change | "<string>" |
| items[].before_display | string ｜ null | Yes | Values before the change | "<string>" |
| items[].category | string | Yes | Log category | "<string>" |
| items[].detail_attributes | object | Yes | Detail attributes | {} |
| items[].detail_code | string | No | Detail code | "<string>" |
| items[].detail_text | string | No | Action details | "<string>" |
| items[].event_id | string | Yes | Event ID | "<string>" |
| items[].http_method | string | Yes | HTTP method | "<string>" |
| items[].occurred_at | string · date-time | Yes | Time | "2026-08-27T10:00:00Z" |
| items[].operation_id | string | Yes | API operation ID | "<string>" |
| items[].org_id | string | Yes | Organization ID | "<string>" |
| items[].payload_hash | string | Yes | Event payload hash | "<string>" |
| items[].replay_of_event_id | string ｜ null | Yes | Original event ID for replay | "<string>" |
| items[].request_id | string | Yes | Request ID | "<string>" |
| items[].resource_id | string | No | Resource ID | "<string>" |
| items[].resource_label | string | No | Target | "<string>" |
| items[].resource_type | string | Yes | Resource type | "<string>" |
| items[].result | string | Yes | Result | "<string>" |
| items[].route_template | string | Yes | API route template | "<string>" |
| items[].schema_version | integer · int64 | Yes | Event schema version | 0 |
| items[].source | string | Yes | Source | "<string>" |
| items[].source_ip | string | No | Source IP | "<string>" |
| items[].source_service | string | Yes | Source service | "<string>" |
| items[].success_count | integer · int64 | No | Successful count | 0 |
| items[].target_count | integer · int64 | No | Target user count | 0 |
| items[].trace_id | string | No | Trace ID | "<string>" |
| next_cursor | string | Yes | Next page cursor | "<string>" |
default Flat business error
| Name | Type | Required | Description | Example |
|---|---|---|---|---|
| code | string | No | Stable business error code | "<string>" |
| detail | string | Yes | Human-readable error description | "<string>" |
| details | OpenapiErrorDetails | No | Error details | {"field":"<string>","reason":"<string>","suggestion":"<string>"} |
| details.field | string | No | Request field that failed validation | "<string>" |
| details.reason | string | No | Stable validation failure reason | "<string>" |
| details.suggestion | string | No | Suggested normalized value | "<string>" |
| error | string | Yes | Stable HTTP error type | "<string>" |