> ## Documentation Index > Fetch the complete documentation index at: https://basedash.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # List audit log events > Returns immutable organization audit events in reverse chronological order for SIEM ingestion. Requires an Enterprise organization and an administrator API key. ## OpenAPI ````yaml https://charts.basedash.com/api/public/openapi get /api/public/organizations/{orgId}/audit-logs openapi: 3.1.0 info: title: Basedash Public API version: 0.0.0 description: >- API for programmatic access to Basedash features. Use API keys for authentication. contact: name: Basedash Support url: https://basedash.com email: support@basedash.com servers: - url: https://charts.basedash.com description: Production security: [] tags: - name: Organizations description: Manage organizations - name: Groups description: Manage organization groups and memberships - name: Data Sources description: Manage database connections and data sources - name: MCP servers description: Manage MCP server data sources - name: Insights description: Manage generated insights - name: Automations description: Manage automations and automation runs - name: Skills description: Manage organization skills - name: Definitions description: Manage reusable SQL definitions - name: Dashboards description: Manage dashboards and their tabs - name: Charts description: Manage charts and their SQL queries - name: Chats description: >- Chat with the Basedash AI agent about your data. Start a chat by sending a message, then continue the conversation with follow-up messages. The assistant responds asynchronously: pass the `wait` query parameter to receive the finished response in the same request, or poll the assistant message (or stream its events) after an HTTP 202. Chats created through the API are not shown in the Basedash app. paths: /api/public/organizations/{orgId}/audit-logs: get: tags: - Organizations summary: List audit log events description: >- Returns immutable organization audit events in reverse chronological order for SIEM ingestion. Requires an Enterprise organization and an administrator API key. parameters: - schema: type: string description: Organization ID required: true description: Organization ID name: orgId in: path - schema: type: integer minimum: 1 maximum: 100 default: 50 description: Maximum number of items to return (1-100, default 50) required: false description: Maximum number of items to return (1-100, default 50) name: limit in: query - schema: type: string description: Cursor for pagination (ID of the last item from previous page) required: false description: Cursor for pagination (ID of the last item from previous page) name: cursor in: query - schema: type: string enum: - user.login - user.logout - member.joined - member.invited - member.invite_revoked - member.role_changed - member.deactivated - member.reactivated - group.created - group.updated - group.deleted - group.member_added - group.member_removed - grant.created - grant.updated - grant.deleted - data_source.created - data_source.updated - data_source.deleted - data_source.sync_requested - data_source.schema_synced - data_source.credentials_viewed - api_key.created - api_key.deleted - scim_token.created - scim_token.deleted - organization.created - organization.updated - organization.jwt_secret_viewed - organization.jwt_secret_copied - domain.created - domain.updated - domain.deleted - dashboard.created - dashboard.deleted - dashboard.archived - dashboard.restored - dashboard.public_sharing_enabled - dashboard.public_sharing_disabled - automation.created - automation.deleted - automation.archived - automation.restored - mcp_connector.created - mcp_connector.updated - mcp_connector.deleted - mcp_connector.tool_access_updated - public_api.request - scim.user_created - scim.user_updated - scim.user_deactivated - scim.group_created - scim.group_updated - scim.group_deleted - query.executed - query.mutating_executed - data.exported - ai.tool_executed description: Exact dot-namespaced action required: false description: Exact dot-namespaced action name: action in: query - schema: type: string description: Actor user ID required: false description: Actor user ID name: actorId in: query - schema: type: string enum: - AUTHENTICATION - MEMBERS - ACCESS_CONTROL - DATA_SOURCES - QUERIES - EXPORTS - AI - ORGANIZATION - CONTENT - INTEGRATIONS required: false name: category in: query - schema: anyOf: - type: string format: date-time - type: string format: date description: Inclusive lower timestamp or date boundary required: false description: Inclusive lower timestamp or date boundary name: from in: query - schema: type: string description: Case-insensitive actor, action, target name, or target ID search required: false description: Case-insensitive actor, action, target name, or target ID search name: search in: query - schema: type: string enum: - WEB - PUBLIC_API - SCIM - SLACK - MCP - SYSTEM - PUBLIC_DASHBOARD required: false name: source in: query - schema: type: string description: Exact target resource type required: false description: Exact target resource type name: targetType in: query - schema: anyOf: - type: string format: date-time - type: string format: date description: Inclusive upper timestamp or date boundary required: false description: Inclusive upper timestamp or date boundary name: to in: query responses: '200': description: Audit events retrieved successfully content: application/json: schema: $ref: '#/components/schemas/PublicAuditLogListResponse' '400': description: Bad request - Invalid filters content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Unauthorized - Missing or invalid API key content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: Forbidden - Enterprise plan required content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: Not found - Organization not found or no administrator access content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: Rate limit exceeded - Too many requests content: application/json: schema: $ref: '#/components/schemas/RateLimitErrorResponse' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: PublicAuditLogListResponse: type: object properties: data: type: array items: $ref: '#/components/schemas/PublicAuditLogEvent' pagination: $ref: '#/components/schemas/PaginationMeta' required: - data - pagination ErrorResponse: type: object properties: error: $ref: '#/components/schemas/ApiError' required: - error RateLimitErrorResponse: type: object properties: error: $ref: '#/components/schemas/RateLimitError' required: - error PublicAuditLogEvent: type: object properties: id: type: string description: Audit event ID createdAt: type: string format: date-time description: Event timestamp organizationId: type: string description: Organization ID action: type: string description: Stable dot-namespaced action name category: type: string enum: - AUTHENTICATION - MEMBERS - ACCESS_CONTROL - DATA_SOURCES - QUERIES - EXPORTS - AI - ORGANIZATION - CONTENT - INTEGRATIONS actorType: type: string enum: - USER - API_KEY - SCIM - SYSTEM - ANONYMOUS actorUserId: type: - string - 'null' actorEmail: type: - string - 'null' apiKeyId: type: - string - 'null' scimTokenId: type: - string - 'null' targetType: type: - string - 'null' targetId: type: - string - 'null' targetDisplay: type: - string - 'null' source: type: string enum: - WEB - PUBLIC_API - SCIM - SLACK - MCP - SYSTEM - PUBLIC_DASHBOARD ipAddress: type: - string - 'null' userAgent: type: - string - 'null' metadata: {} required: - id - createdAt - organizationId - action - category - actorType - actorUserId - actorEmail - apiKeyId - scimTokenId - targetType - targetId - targetDisplay - source - ipAddress - userAgent PaginationMeta: type: object properties: nextCursor: type: - string - 'null' description: Cursor for the next page (null if no more pages) hasMore: type: boolean description: Whether there are more items after this page required: - nextCursor - hasMore ApiError: type: object properties: title: type: string description: Error type identifier detail: type: string description: Human-readable error description required: - title - detail RateLimitError: allOf: - $ref: '#/components/schemas/ApiError' - type: object properties: title: type: string enum: - RateLimitExceeded retryAfterMs: type: number description: Milliseconds until the rate limit window resets required: - retryAfterMs securitySchemes: bearerAuth: type: http scheme: bearer description: >- API key authentication using Bearer token format: `Bearer ` ````