--- title: "List audit logs" slug: "list-audit-logs" updated: 2026-04-23T09:04:09Z published: 2026-04-23T09:04:09Z canonical: "developers.torq.io/list-audit-logs" --- > ## Documentation Index > Fetch the complete documentation index at: https://developers.torq.io/llms.txt > Use this file to discover all available pages before exploring further. # List audit logs Get/v1alpha/audit_logs The audit log endpoint enables you to retrieve log entries from Torq. The logs are retrieved for the workspace on which the API key used for authenticating the request was created. For more information, see the [audit logs documentation](https://kb.torq.io/en/articles/9174571-audit-logs-apis-streamline-auditing-with-torq). SecurityHTTPType bearer Query parametersstart_timestring (date-time) Will retrieve log entries created after this timestamp. This parameter is optional. If empty, will retrieve all log entries from the previous 24 hours until the end timestamp. If neither a start or end timestamp is provided, will pull all log entries created in the last 24 hours. Timestamps are in RFC 3339 format, for example, `2022-03-09T08:40:18.490771179Z`. end_timestring (date-time) Will retrieve log entries created before this timestamp. This parameter is optional. If empty, will retrieve all log entries from the start timestamp until now. If both the start or end timestamp are empty, will pull all log entries created in the last 24 hours. Timestamps are in RFC 3339 format, for example, `2022-03-09T08:40:18.490771179Z`. page_sizeinteger (int32) The maximum number of log entries to retrieve per page. Default is 100. Maximum is 500. If results exceed the defined page size, use [pagination](https://developers.torq.io/apidocs/pagination) to retrieve the next page Default100 page_tokenstring Token received from a previous List audit logs request. Provide this to retrieve the next page of results. orderstring Sort results by timestamp. Can be asc (oldest first) or desc (latest first). Default is desc. Default"desc" Responses200 A successful response. Expand Allobject audit_logs Array of object (v1alphaAuditLog) An array of audit log objects. object idstring (uuid) Unique identifier of the log entry. Example74e19393-3e94-48d2-8b60-26f2d2665942 timestampstring (date-time) The timestamp when the action that created the log entry was performed. For example, if a secret was deleted, it's the timestamp when the secret was was deleted. Example2022-03-09T08:40:18.490771179Z emailstring (email) The email address of the actor that performed the action that created the log entry. If actor type is "web_app", it's the authenticated user's email address. If the actor type is api_key, it's the email address of the user that generated the API key. Exampleuser@email.com actor_namestring (email) The name of the actor that performed the action that created the log entry. Can be the user name or the API key name. Exampleuser@email.com actor_typestring The type of actor that performed the action that created the log entry. Can be "web_app", "api_key", or "slack". Exampleweb_app actionstring The action that created the log entry. For example: "Integration created". ExampleIntegration created resource_idstring (uuid) Unique identifier of the resource on which the action was taken. Example74e19393-3e94-48d2-8b60-26f2d2665942 resource_namestring The name of the resource on which the action was taken. For example, if a secret was deleted, this would be the name of the secret that was deleted. ExampleMy Integration ipstring The IP address of the actor, either a public IPv4 or IPv6 address. Example8.8.8.8 user_agentstring The data that the browser sends in the User-Agent header in the HTTP request. This information is not authenticated and should be treated accordingly. ExampleMozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36 extra_dataobject Additional data relevant to the action performed. Workflows will include the revision id, users will include the user's role. account_idstring (uuid) Unique identifier of the workspace where the action was performed. Example74e19393-3e94-48d2-8b60-26f2d2665942 account_namestring The name of the workspace where the action was performed. ExampleMy Workspace next_page_tokenstring When a token is returned it indicates there is another page of results to retrieve. Pass this token in the pageToken parameter in a subsequent List audit logs request to retrieve the next page of results. If this field is empty, there are no additional pages to retrieve. 401 Invalid bearer token. If you receive this message more than once try creating a new Client ID/Client Secret or generating a new bearer token. object 403 You don't have permission to access this resource. object