Search audit logs

POST

/audit-logs/search

AuditLogs

Search, filter, and sort workspace security audit events using JSONLogic expressions. Supports filtering by eventType, actorId, actorType, subjectUserId, appContext, platform, and a createdAt range, and optionally resolves actor and subject display names. Reads the D1 mirror, so results are eventually consistent with the DynamoDB source by a few seconds. Restricted to admin and owner.

Request

Body Params application/json

Examples

Responses

🟢200OK

application/json

Audit logs matching search criteria

Bodyapplication/json

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.aworld.cloud/dashboard/v1/audit-logs/search' \
--header 'Content-Type: application/json' \
--data '{
    "filter": {
        "==": [
            {
                "var": "fieldName"
            },
            "value"
        ]
    },
    "sort": {
        "field": "createdAt",
        "order": "asc"
    },
    "limit": 20,
    "nextToken": "string",
    "fields": [
        "actor"
    ]
}'

Response Example

{
    "items": [
        {
            "auditLogId": "string",
            "eventType": "SIGN_IN_SUCCESS",
            "actorId": "string",
            "actorType": "user",
            "subjectUserId": "string",
            "appContext": "administration",
            "ipAddress": "string",
            "userAgent": "string",
            "platform": "web",
            "details": {
                "property1": "string",
                "property2": "string"
            },
            "createdAt": "2019-08-24T14:15:22.123Z",
            "updatedAt": "2019-08-24T14:15:22.123Z",
            "actor": {
                "actorId": "string",
                "actorType": "user",
                "kind": "user",
                "name": "string",
                "email": "string"
            },
            "subject": {
                "userId": "string",
                "name": "string",
                "email": "string",
                "unresolved": true
            }
        }
    ],
    "nextToken": "eyJwayI6IndvcmtzcGFjZUlkI3pPR0JndVctQWoiLCJxdWl6SWQiOiItRktBdDZfbXM4M3RvSUZaLWVjeFQifQ=="
}

Modified at 2026-10-09 12:43:10

List audit logs

List notification rule translations