Search Audit Log
Use the audit search request to get either a complete list of your system audit logs or filter that list for logs matching specific conditions
Endpoint
Method: POST
URL: /audit/V1/search
Query Parameters
Parameter Name | Data Type | Description | Required/Optional |
|---|---|---|---|
| Integer | The audit log can be split into pages to make it easier to use, the For example a value of | Optional, defaults to |
| String | Sort your results by specifying what parameter in the response to sort by, and then what order to sort them in, this is in the form See content Sub-parameters for a list of valid parameters to sort by. Valid orders: descending ( For example setting | Optional |
Request Parameter
Parameter Name | Data Type | Description | Required/Optional |
|---|---|---|---|
| Date-Time | As your full audit log can be substantial and cover a wide timeframe, use Format: For example your full audit log could start on June 14th 2024 at 13:00, but you only want to display audit log entries from June 29th 2024 at 16:00. For this, you would enter a value of | Required |
| Date-Time | As your full audit log can be substantial and cover a wide timeframe, use Format: For example, your full audit log would end at the most recent audit log entry, but you only want to display audit log entries up to June 29th 2024 at 16:00. For this, you would enter a value of | Required |
| String | Enter text to filter the audit log by, and the audit log only displays entries that contain the specified text. | Optional |
| String | Filter your audit log by Use the get audit filters request to view audit log activity types in your system. | Optional |
| String | Filter your audit log by Use the get audit filters request to view audit log action types in your system. | Optional |
| Boolean | Filter your audit log by whether or not the action that resulted in the audit log entry was successful ( | Optional |
| String | The audit log is split into pages, with page length determined by the | Optional |
Response and Error Code
Response Code | Condition |
|---|---|
200 | OK |
400 | Bad Request (it's likely that one or more required parameters is missing) |
Response Parameter
The response of a successful post audit search request will provide the parameters listed in the table below, the content, pageable, and sort array parameters have sub-parameters that are covered in more detail in their own table.
For an example response, see Sample Response.
Parameter Name | Data Type | Description |
|---|---|---|
| Array | The log entries in the current page, these are the details for each system action, see content Sub-parameters for information on each of the parameters for each log entry. |
| String | The audit log is split into pages, with page length determined by the |
| Number | The total number of audit log records in your system. |
| String | A quick way to tell if your audit log has reached the maximum of 10,000 logs that can be fetched by this request. A value of |
content sub-parametersParameter | Data Type | Description |
|---|---|---|
| String | The ID of the specific audit log entry. |
| Number | The epoch time (the number of seconds that have elapsed since January 1, 1970 (midnight UTC/GMT) not counting leap seconds) for the action that caused the audit log to be created. |
| String | The type of activity in the system that generated the log entry, for example, To get a list of possible activity types, use the get audit filters request. |
| String | The type of action performed that led to the audit log entry being created. |
| String | A user-friendly description of the action that led to the audit log entry. |
| String | The information that was entered into the system to complete the action that led to the audit log entry. |
| String | A description of the action taken by the system in response to the action input. |
| String | The ID of your tenant, the tenant the audit log entry displayed belongs to. |
| String | The user's email address whose activity in the system generated the log entry, if applicable. |
| Integer | The user ID of the user whose activity in the system generated the log entry, if applicable. |
| Number | The epoch time for when the specific audit log entry was created. |
| Boolean | Whether or not the action that resulted in the audit log entry was successful ( |
| String | Who or what caused the audit log to be created, typically the user who performed the action, or |
| String | An internal reference field used to track specific logs during development. As a customer, your logs do not populate this field. |
Sample Request
/audit/V1/search?size=30&sort=createDate,desc
{
"startDate":"2026-01-26T00:00:00.000Z",
"endDate":"2026-01-27T23:59:59.999Z",
"searchText":"",
"activityType":["USER_MANAGEMENT","POLICY_MANAGEMENT"],
"actionType":[],
"success":"",
"nextPageToken":"WyIxNzY5NTE5MjY1MDAwIiwiMTc2OTUxOTI2NTg2NCJd"
}Sample Response
Note
The below sample response has been shortened for document formatting purposes, where content only shows two audit log entries rather than the 30 specified in size.
{
"content": [
{
"id": "qSPX_psBSMhcaCypl9w1",
"timestamp": 1769507100465,
"activityType": "USER_MANAGEMENT",
"actionType": "USER_PREFERENCE_LIST",
"actionDescription": "List of private and public preferences viewable by the user.",
"actionInput": "",
"actionOutput": "{preferences=(Count: 5)}",
"tenantId": "26837380-45f1-4f96-85ed-b8d1h656r66h",
"emailId": "john.doe@uniphore.com",
"userId": "auth0|683fdbd6hr5b2e04458f876c",
"createdDate": 1769507100000,
"success": true,
"createdBy": "john.doe@uniphore.com",
"traceId": ""
},
{
"id": "yqDX_psBFm-PXj-dmRpZ",
"timestamp": 1769507100981,
"activityType": "POLICY_MANAGEMENT",
"actionType": "POLICY_PURGE_ACTION",
"actionDescription": "Purge",
"actionInput": "{tenantId=26298780-45f1-4f96-85ed-b8d9e656f32d, policyId=101, policyName=Purge Capital 2}",
"actionOutput": " | AuditLog status: LOCKED and count: 35",
"tenantId": "26298780-45f1-4f96-85ed-b8d9e656f32d",
"emailId": "SYSTEM",
"userId": "SYSTEM",
"createdDate": 1769507100000,
"success": false,
"createdBy": "SYSTEM",
"traceId": ""
}
],
"nextPageToken": "WyIxNzY5NTE5MjY1MDAwIiwiMTc2OTUvULP5kGm4jCJd",
"total": 450,
"totalRelation": "eq"
}