<!-- llms.txt: https://workos.com/llms.txt -->

# Audit logs

Search the audit events of the organization the token was issued for and export them.

## Get an audit event

Calls the `auditEvent` query.

:::code-group

```graphql language="graphql" title="Query" tab="1"
query AuditEvent($id: ID!) {
  auditEvent(id: $id) {
    action
    actor {
      id
      name
      type
    }
    createdAt
    data
    id
    occurredAt
    targets
    updatedAt
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "auditEvent": {
      "action": "action_example",
      "actor": {
        "id": "id_example",
        "name": "name_example",
        "type": "type_example"
      },
      "createdAt": "2024-01-01T00:00:00.000Z",
      "data": {},
      "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "occurredAt": "2024-01-01T00:00:00.000Z",
      "targets": [
        "targets_example"
      ],
      "updatedAt": "2024-01-01T00:00:00.000Z"
    }
  }
}
```

:::

## List audit events

Calls the `auditEvents` query.

:::code-group

```graphql language="graphql" title="Query" tab="1"
query AuditEvents($after: String, $before: String, $filter: AuditEventFilterInput!, $limit: Int, $order: PaginationOrder) {
  auditEvents(after: $after, before: $before, filter: $filter, limit: $limit, order: $order) {
    data {
      action
      actor {
        id
        name
        type
      }
      createdAt
      data
      id
      occurredAt
      targets
      updatedAt
    }
    listMetadata {
      after
      before
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "auditEvents": {
      "data": [
        {
          "action": "action_example",
          "actor": {
            "id": "id_example",
            "name": "name_example",
            "type": "type_example"
          },
          "createdAt": "2024-01-01T00:00:00.000Z",
          "data": {},
          "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
          "occurredAt": "2024-01-01T00:00:00.000Z",
          "targets": [
            "targets_example"
          ],
          "updatedAt": "2024-01-01T00:00:00.000Z"
        }
      ],
      "listMetadata": {
        "after": "after_example",
        "before": "before_example"
      }
    }
  }
}
```

:::

## Get an audit log export

Calls the `auditLogExport` query.

:::code-group

```graphql language="graphql" title="Query" tab="1"
query AuditLogExport($id: ID!) {
  auditLogExport(id: $id) {
    createdAt
    id
    state
    updatedAt
    url
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "auditLogExport": {
      "createdAt": "2024-01-01T00:00:00.000Z",
      "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "state": "Error",
      "updatedAt": "2024-01-01T00:00:00.000Z",
      "url": "url_example"
    }
  }
}
```

:::

## Get the audit log stream

The audit log stream destination configured for the token's organization, or null when no stream is configured.

:::code-group

```graphql language="graphql" title="Query" tab="1"
query AuditLogStream {
  auditLogStream {
    auditLogTrailId
    errorMessage
    id
    lastSyncedEventId
    state
    type
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "auditLogStream": {
      "auditLogTrailId": "auditLogTrailId_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "errorMessage": "errorMessage_example",
      "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "lastSyncedEventId": "lastSyncedEventId_example",
      "state": "Active",
      "type": "AzureSentinel"
    }
  }
}
```

:::

## Create an audit log export

Calls the `createAuditLogExport` mutation.

:::code-group

```graphql language="graphql" title="Mutation" tab="1"
mutation CreateAuditLogExport($input: CreateAuditLogExportInput!) {
  createAuditLogExport(input: $input) {
    __typename
    ... on AuditLogExport {
      createdAt
      id
      state
      updatedAt
      url
    }
    ... on InvalidAuditLogExportDateRange {
      message
    }
    ... on NoAuditEventsFound {
      message
    }
  }
}
```

```json language="json" title="Response" tab="2"
{
  "data": {
    "createAuditLogExport": {
      "__typename": "AuditLogExport",
      "createdAt": "2024-01-01T00:00:00.000Z",
      "id": "id_01EHWNCE74X7JSDV0X3SZ3KJNY",
      "state": "Error",
      "updatedAt": "2024-01-01T00:00:00.000Z",
      "url": "url_example"
    }
  }
}
```

:::

### Query auditEvent

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | ID! | Yes |  |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `action` | String! |  |
| `actor` | AuditEventActor! |  |
| `createdAt` | DateTime! |  |
| `data` | JSON! |  |
| `id` | ID! |  |
| `occurredAt` | DateTime! |  |
| `targets` | [String!]! |  |
| `updatedAt` | DateTime! |  |

### Query auditEvents

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `after` | String | No |  |
| `before` | String | No |  |
| `filter` | AuditEventFilterInput! | Yes |  |
| `limit` | Int | No |  |
| `order` | PaginationOrder | No | Enum represents the pagination order. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `data` | [AuditEvent!]! |  |
| `listMetadata` | ListMetadata! |  |

### Query auditLogExport

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | ID! | Yes |  |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `createdAt` | DateTime! |  |
| `id` | ID! |  |
| `state` | AuditLogExportState! |  |
| `updatedAt` | DateTime! |  |
| `url` | String | A signed URL to the CSV file. Only defined once the export is ready. |

### Query auditLogStream

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `auditLogTrailId` | ID! |  |
| `errorMessage` | String | The most recent delivery error message, if any. |
| `id` | ID! |  |
| `lastSyncedEventId` | String | The ID of the last audit log event delivered to the stream. |
| `state` | AuditLogStreamState! | The delivery state of an audit log stream. |
| `type` | AuditLogStreamType! | The destination provider audit log events are streamed to. |

### Mutation createAuditLogExport

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `actions` | [String!] | No |  |
| `actorIds` | [String!] | No |  |
| `actorNames` | [String!] | No |  |
| `rangeEnd` | DateTime! | Yes |  |
| `rangeStart` | DateTime! | Yes |  |
| `targetIds` | [String!] | No |  |
| `targetTypes` | [String!] | No |  |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `AuditLogExport` | AuditLogExport |  |
| `InvalidAuditLogExportDateRange` | InvalidAuditLogExportDateRange |  |
| `NoAuditEventsFound` | NoAuditEventsFound |  |