Skip to content
Try for free
On this page

Audit logs

List audit logs

List an organization audit trail with filters and opaque cursor pagination. Requires an Enterprise subscription and organization admin or owner access. Workspace API keys return `403`; use a personal API key or scoped OAuth token. OAuth scope: `api:read`.

GET/api/v2/audit-logs

List an organization audit trail with filters and opaque cursor pagination. Requires an Enterprise subscription and organization admin or owner access. Workspace API keys return 403; use a personal API key or scoped OAuth token.

OAuth scope: api:read.

Authentication

Send a personal or workspace API key in X-API-Key. See key types and access; operations that reject workspace keys say so in their description.

Send X-API-Key in the request header.

Alternatively

Send a Sim OAuth access token in Authorization: Bearer. See OAuth authentication and scopes.

Authorization: Bearer YOUR_ACCESS_TOKEN

Required scopes: api:read

OAuth flows
json
{
  "authorizationCode": {
    "authorizationUrl": "https://www.sim.ai/api/auth/oauth2/authorize",
    "tokenUrl": "https://www.sim.ai/api/auth/oauth2/token",
    "refreshUrl": "https://www.sim.ai/api/auth/oauth2/token",
    "scopes": {
      "api:read": "Read your workspaces, workflows, files, tables, and logs",
      "api:write": "Read, create, change, run, and delete resources in your workspaces",
      "offline_access": "Stay signed in without asking again"
    }
  }
}

OAuth scope: api:read.

Query parameters

actionstring

Filter by exact action name.

resourceTypestring

Filter by resource type. Accepts a comma-separated set; members are trimmed and deduplicated, and member order affects neither the result nor the cursor.

resourceIdstring

Filter by exact resource identifier.

workspaceIdstring

Filter to actions in one workspace.

minLength
1
maxLength
128
startDatestring

Include audit entries created at or after this UTC ISO 8601 timestamp, such as 2026-08-06T00:00:00Z. Dates without a time, timestamps with an offset instead of Z, and year 0000 are rejected.

format
date-time
pattern
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
endDatestring

Include audit entries created at or before this UTC ISO 8601 timestamp, such as 2026-08-06T00:00:00Z. Dates without a time, timestamps with an offset instead of Z, and year 0000 are rejected.

format
date-time
pattern
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
includeDepartedboolean

Include actions by users who have left the organization.

limitinteger

Maximum audit entries to return per page. Must be a whole number from 1 to 100. Defaults to 50.

default
50
minimum
1
maximum
100
cursorstring

Opaque cursor from the previous page. Send it back with the same sort and filters; only limit may change. Change anything else and pagination must restart without a cursor.

minLength
1
organizationIdstring

Organization whose audit trail should be queried. Defaults to the caller's own organization when omitted. A caller that belongs to no organization, or that names one it is not a member of, is refused with a 403.

minLength
1
actorEmailstring

Filter by actor email address.

format
email
pattern
^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$

Responses

200

A page of audit-log entries.

object

A cursor-paginated page of audit-log entries.

2 fields
dataarrayRequired

Items in the current page.

Schema details
Array itemobject

Public enterprise audit-log entry with privacy-sensitive request data omitted.

11 fields
idstringRequired

Unique audit-log entry identifier.

workspaceIdvalueRequired

Workspace where the action occurred, or null for organization-level actions.

Schema details

Any of

Option 1string
Option 2null
actorNamevalueRequired

Display name of the person who performed the action.

Schema details

Any of

Option 1string
Option 2null
actorEmailvalueRequired

Email address of the person who performed the action.

Schema details

Any of

Option 1string
format
email
pattern
^(?!\.)(?!.*\.\.)([A-Za-z0-9_'+\-\.]*)[A-Za-z0-9_+-]@([A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$
Option 2null
actionstringRequired

Action that was performed.

resourceTypestringRequired

Type of resource affected by the action.

resourceIdvalueRequired

Affected resource ID. Null for folder events, which identify folders by path.

Schema details

Any of

Option 1string
Option 2null
resourceNamevalueRequired

Display name of the affected resource.

Schema details

Any of

Option 1string
Option 2null
descriptionvalueRequired

Human-readable description of the action.

Schema details

Any of

Option 1string
Option 2null
metadatavalueRequired

Additional JSON details specific to the action.

createdAtstringRequired

ISO 8601 timestamp when the action occurred.

format
date-time

Additional properties are not allowed.

nextCursorvalueRequired

Opaque cursor for the next page. Send it back as cursor; null means there are no more pages. Do not construct a cursor yourself.

Schema details

Any of

Option 1string
Option 2null

Additional properties are not allowed.

Response example 1

json
{
  "data": [
    {
      "id": "audit_2c3d4e5f6g",
      "workspaceId": "a91c4b2e-6d3f-4e8a-b5c7-0d9e2f1a8c64",
      "actorName": "Jane Smith",
      "actorEmail": "jane@example.com",
      "action": "file.uploaded",
      "resourceType": "file",
      "resourceId": "wf_V1StGXR8z5jdHi6BmyT91",
      "resourceName": "data.csv",
      "description": "Uploaded file \"data.csv\" via API",
      "metadata": {
        "fileSize": 1024,
        "fileType": "text/csv"
      },
      "createdAt": "2026-01-15T10:30:00Z"
    }
  ],
  "nextCursor": null
}

Response headers

X-RateLimit-Limitinteger

Maximum requests allowed in the current window.

minimum
0
maximum
9007199254740991
X-RateLimit-Remaininginteger

Requests remaining in the current window.

minimum
0
maximum
9007199254740991
X-RateLimit-Resetstring

ISO 8601 timestamp when the current rate-limit window resets.

format
date-time
pattern
^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
Was this helpful?
Suggest an edit