List audit logs with filters

POST https://{tenant}.atomicwork.com/api/v1/audit-logs/list

List audit logs with structured filters for actor, module, and event type

Filtering

Use the filters field to narrow results. Pass an empty array or omit the field to retrieve all records.

Each filter object has the following fields:

Field	Type	Description
`attribute`	string	The field to filter on (see Supported attributes below)
`operator`	string	Comparison operator (see Available operators below)
`values`	array	One or more objects

Attribute	Typical operator	Description
`event_at`	`IS_BETWEEN`	Event timestamp. Requires exactly two values: `[start, end]` (both inclusive). Accepts ISO 8601 (`2024-01-01T00:00:00Z`) or date-only (`2024-01-01` — end date is automatically extended to `T23:59:59Z`). On export, defaults to the last 6 months if omitted.
`actor_id`	`IS_ANY_OF`	Numeric user ID of the person who performed the action (the `id` field from `GET /api/v1/users`).
`module`	`IS_ANY_OF`	Module integer ID (not the name). See the Module IDs reference table below.
`event_type`	`IS_ANY_OF`	Event type integer ID (not the name). See the Event Type IDs reference table below. Not every event type is valid for every module — unsupported combinations return zero results.

Operator	Meaning
`EQUALS`	Exact match
`NOT_EQUALS`	Exclude exact match
`IN` / `IS_ANY_OF`	Match any value in the list
`IS_NOT_ANY_OF`	Exclude all listed values
`IS_BETWEEN`	Inclusive range — pass exactly two values: `[start, end]`
`IS_ON_OR_BEFORE` / `IS_ON_OR_AFTER`	Date/time boundary comparisons
`CONTAINS` / `TEXT_CONTAINS`	Substring or set membership
`IS_NULL` / `IS_NOT_NULL`	Null checks — `values` array can be empty
`STARTS_WITH` / `ENDS_WITH`	String prefix/suffix match

ID	Module	What it covers
`0`	APPS	Third-party app connections (connect / disconnect / update)
`1`	USERS	User creation and profile updates
`2`	WORKFLOWS	Automation workflow changes
`3`	SERVICE_CATALOG	Service catalog items
`4`	SECURITY	Login, logout, API key creation / deletion
`5`	SKILL	AI skill changes
`6`	WORKSPACES	Workspace settings changes
`7`	TENANT_MIGRATION	Sandbox import / export
`8`	AGENT_GROUPS	Agent group changes
`9`	ACCESS_MANAGEMENT	Role and access control changes
`10`	AI_AGENTS	AI agent changes
`11`	AGENT_AVAILABILITY	Agent availability updates
`12`	CUSTOM_OBJECTS	Custom object type changes

ID	Event Type
`0`	CONNECTED
`1`	DISCONNECTED
`2`	CREATED
`3`	UPDATED
`4`	ENABLED
`5`	DISABLED
`6`	DELETED
`7`	IMPORT
`8`	EXPORT
`9`	RESTORED
`10`	LOGIN
`12`	LOGOUT

Module	Valid event type IDs
APPS (0)	0 (CONNECTED), 1 (DISCONNECTED), 3 (UPDATED)
USERS (1)	2 (CREATED), 3 (UPDATED)
WORKFLOWS (2)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
SERVICE_CATALOG (3)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
SECURITY (4)	2 (CREATED), 6 (DELETED), 10 (LOGIN), 12 (LOGOUT)
SKILL (5)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
WORKSPACES (6)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
TENANT_MIGRATION (7)	7 (IMPORT), 8 (EXPORT)
AGENT_GROUPS (8)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
ACCESS_MANAGEMENT (9)	2 (CREATED), 3 (UPDATED), 6 (DELETED), 9 (RESTORED)
AI_AGENTS (10)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
AGENT_AVAILABILITY (11)	3 (UPDATED)
CUSTOM_OBJECTS (12)	2 (CREATED), 3 (UPDATED), 6 (DELETED)

[
  {
    "attribute": "event_at",
    "operator": "IS_BETWEEN",
    "values": [
      {
        "value": "2024-01-01T00:00:00Z"
      },
      {
        "value": "2024-12-31T23:59:59Z"
      }
    ]
  },
  {
    "attribute": "module",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 1
      },
      {
        "value": 9
      }
    ]
  },
  {
    "attribute": "event_type",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 2
      },
      {
        "value": 3
      }
    ]
  },
  {
    "attribute": "actor_id",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 123
      }
    ]
  }
]

cURL

curl -X POST 'https://{tenant}.atomicwork.com/api/v1/audit-logs/list' \
  -H 'X-Api-Key: <api-key>' \
  -H 'Content-Type: application/json' \
  -d '{"search_key": "string", "page": 0, "per_page": 0, "next_page_token": "string", "filters": [{"attribute": "string", "operator": "LIKE", "values": ["\u2026"]}], "sort_order": "EVENT_AT_DESC"}'

List audit logs with filters

Filtering

List audit logs with filters

Filtering

Authorization

Headers

Body

Response