auditLog.list

post

https://api.ashbyhq.com/auditLog.list

Beta

This API is in active development and only available in a closed beta with early design partners.

Lists an organization's audit log entries, newest first. The targetTypes and
categories you can filter on are a fixed, code-defined vocabulary; see the
Audit Log Vocabulary guide for valid values and filter examples.

Pagination: follow opaque cursor / nextCursor; see
Pagination and Incremental Synchronization.

Returns audit events for all objects in the organization, including confidential jobs
and projects, with no confidentiality filtering.

Retention of request metadata: entries older than 30 days do not retain the request
that triggered them, so request.id and request.ipAddress are always null on
those entries. Because the cutoff is relative to the time of the request, an entry that
includes request metadata today returns it as null once it ages past 30 days, and a
single page can contain entries on both sides of the cutoff.

Error codes:

Code	Description
`invalid_input`	A date bound is not a valid ISO 8601 date, `endDate` is before `startDate`, the explicit span exceeds 18 months, or a `targetTypes` / `categories` value is not in the vocabulary.
`audit_logs_not_enabled`	Your organization does not have the Audit Logs feature.
`cursor_invalid`	The provided `cursor` could not be decoded.
`missing_endpoint_permission`	The API key lacks the `auditLogsRead` scope. Returned with HTTP `403`.

Requires the auditLogsRead permission.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

cursor

string

Opaque pagination cursor from a previous response's nextCursor. Reuse it only with the same startDate, endDate, and filter parameters as the request that produced it; changing the window or filters while keeping a cursor can return empty or incomplete pages.

limit

integer

≤ 100

Maximum entries per page. Defaults to 100 when omitted. Maximum is 100.

startDate

string

ISO 8601 start of the date window (UTC). When omitted, defaults to 24 hours before endDate. When only startDate is supplied, endDate defaults to startDate plus 24 hours (not until now) — use both bounds for a custom span.

endDate

string

ISO 8601 end of the date window (UTC). When omitted with startDate, defaults to startDate plus 24 hours; when both are omitted, defaults to the current time.

actorIds

array of strings

length ≤ 100

Restricts results to entries whose actor id is one of these values. An empty array is ignored, same as omitting this field. Max 100 items.

actorIds

targetIds

array of strings

length ≤ 100

Restricts results to entries whose target object id is one of these values. Combined with other filters using AND (all conditions must match). An empty array is ignored. Max 100 items.

targetIds

targetTypes

array of strings

length ≤ 100

Restricts results to entries whose target type is one of these values (e.g. "job", "app_user"). When both targetTypes and categories are supplied, matching uses OR (entries that match either filter). Combined with targetIds and actorIds using AND. An empty array is ignored. Max 100 items.

targetTypes

200Responses from the auditLog.list endpoint