List audit logs with filters

POST https://{tenant}.atomicwork.com/api/v1/audit-logs/list

List audit logs with structured filters for actor, module, and event type

Filtering

Use the filters field to narrow results. Pass an empty array or omit the field to retrieve all records.

Each filter object has the following fields:

Field	Type	Description
`attribute`	string	The field to filter on (see Supported attributes below)
`operator`	string	Comparison operator (see Available operators below)
`values`	array	One or more `\{ "value": \<scalar> \}` objects

Supported attributes

Attribute	Typical operator	Description
`event_at`	`IS_BETWEEN`	Event timestamp. Requires exactly two values: `[start, end]` (both inclusive). Accepts ISO 8601 (`2024-01-01T00:00:00Z`) or date-only (`2024-01-01` — end date is automatically extended to `T23:59:59Z`). On export, defaults to the last 6 months if omitted.
`actor_id`	`IS_ANY_OF`	Numeric user ID of the person who performed the action (the `id` field from `GET /api/v1/users`).
`module`	`IS_ANY_OF`	Module integer ID (not the name). See the Module IDs reference table below.
`event_type`	`IS_ANY_OF`	Event type integer ID (not the name). See the Event Type IDs reference table below. Not every event type is valid for every module — unsupported combinations return zero results.

Available operators

Operator	Meaning
`EQUALS`	Exact match
`NOT_EQUALS`	Exclude exact match
`IN` / `IS_ANY_OF`	Match any value in the list
`IS_NOT_ANY_OF`	Exclude all listed values
`IS_BETWEEN`	Inclusive range — pass exactly two values: `[start, end]`
`IS_ON_OR_BEFORE` / `IS_ON_OR_AFTER`	Date/time boundary comparisons
`CONTAINS` / `TEXT_CONTAINS`	Substring or set membership
`IS_NULL` / `IS_NOT_NULL`	Null checks — `values` array can be empty
/

Module IDs (use with attribute: "module")

ID	Module	What it covers
`0`	APPS	Third-party app connections (connect / disconnect / update)
`1`	USERS	User creation and profile updates
`2`	WORKFLOWS	Automation workflow changes
`3`	SERVICE_CATALOG	Service catalog items
`4`	SECURITY	Login, logout, API key creation / deletion
`5`	SKILL	AI skill changes
`6`	WORKSPACES	Workspace settings changes
`7`	TENANT_MIGRATION	Sandbox import / export
`8`	AGENT_GROUPS	Agent group changes
`9`	ACCESS_MANAGEMENT	Role and access control changes
`10`	AI_AGENTS	AI agent changes
`11`	AGENT_AVAILABILITY

Event Type IDs (use with attribute: "event_type")

ID	Event Type
`0`	CONNECTED
`1`	DISCONNECTED
`2`	CREATED
`3`	UPDATED
`4`	ENABLED
`5`	DISABLED
`6`	DELETED
`7`	IMPORT
`8`	EXPORT
`9`	RESTORED
`10`	LOGIN
`12`	LOGOUT

Module → valid event types

Module	Valid event type IDs
APPS (0)	0 (CONNECTED), 1 (DISCONNECTED), 3 (UPDATED)
USERS (1)	2 (CREATED), 3 (UPDATED)
WORKFLOWS (2)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
SERVICE_CATALOG (3)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
SECURITY (4)	2 (CREATED), 6 (DELETED), 10 (LOGIN), 12 (LOGOUT)
SKILL (5)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
WORKSPACES (6)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
TENANT_MIGRATION (7)	7 (IMPORT), 8 (EXPORT)
AGENT_GROUPS (8)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
ACCESS_MANAGEMENT (9)	2 (CREATED), 3 (UPDATED), 6 (DELETED), 9 (RESTORED)
AI_AGENTS (10)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
AGENT_AVAILABILITY (11)	3 (UPDATED)
CUSTOM_OBJECTS (12)	2 (CREATED), 3 (UPDATED), 6 (DELETED)

Example

[
  {
    "attribute": "event_at",
    "operator": "IS_BETWEEN",
    "values": [
      {
        "value": "2024-01-01T00:00:00Z"
      },
      {
        "value": "2024-12-31T23:59:59Z"
      }
    ]
  },
  {
    "attribute": "module",
    "operator": "IS_ANY_OF",
    "values": [
      {

Authorization

X-Api-Keyheaderstringrequired

API key authentication.

Headers

X-Workspace-Idheaderstring

Body

search_keybodystring

pagebodyinteger

per_pagebodyinteger

next_page_tokenbodystring

filtersbodyarray of object

sort_orderbodyenum (string)

Allowed valuesEVENT_AT_DESCEVENT_AT_ASC

Response

200

Successful response

Filtering

Authorization

Headers

Body

properties

Response