List audit log events
Organizations
List audit log events
Returns immutable organization audit events in reverse chronological order for SIEM ingestion. Requires an Enterprise organization and an administrator API key.
GET
List audit log events
Authorizations
API key authentication using Bearer token format: Bearer <basedash_api_key>
Path Parameters
Organization ID
Query Parameters
Maximum number of items to return (1-100, default 50)
Required range:
1 <= x <= 100Cursor for pagination (ID of the last item from previous page)
Exact dot-namespaced action
Available options:
user.login, user.logout, member.joined, member.invited, member.invite_revoked, member.role_changed, member.deactivated, member.reactivated, group.created, group.updated, group.deleted, group.member_added, group.member_removed, grant.created, grant.updated, grant.deleted, data_source.created, data_source.updated, data_source.deleted, data_source.sync_requested, data_source.schema_synced, data_source.credentials_viewed, api_key.created, api_key.deleted, scim_token.created, scim_token.deleted, organization.created, organization.updated, organization.jwt_secret_viewed, organization.jwt_secret_copied, domain.created, domain.updated, domain.deleted, dashboard.created, dashboard.deleted, dashboard.archived, dashboard.restored, dashboard.public_sharing_enabled, dashboard.public_sharing_disabled, automation.created, automation.deleted, automation.archived, automation.restored, mcp_connector.created, mcp_connector.updated, mcp_connector.deleted, mcp_connector.tool_access_updated, public_api.request, scim.user_created, scim.user_updated, scim.user_deactivated, scim.group_created, scim.group_updated, scim.group_deleted, query.executed, query.mutating_executed, data.exported, ai.tool_executed Actor user ID
Available options:
AUTHENTICATION, MEMBERS, ACCESS_CONTROL, DATA_SOURCES, QUERIES, EXPORTS, AI, ORGANIZATION, CONTENT, INTEGRATIONS Inclusive lower timestamp or date boundary
Case-insensitive actor, action, target name, or target ID search
Available options:
WEB, PUBLIC_API, SCIM, SLACK, MCP, SYSTEM, PUBLIC_DASHBOARD Exact target resource type
Inclusive upper timestamp or date boundary