Filter and export audit logs

Browse in the app

On Audit logs, choose Start date (UTC) and End date (UTC), then select Apply dates. Both dates are included. The page initially shows 30 calendar days including today; select any older period of up to 31 days to investigate historical activity. Date controls remain available when a period has no records.

Load More retrieves more records within the applied dates. Changing the applied dates starts a new list. Export downloads the loaded rows that match the current search and filters as CSV; load all pages in the selected period before exporting if you need every matching row.

Use the API or MCP

Audit log tools accept OAuth connections and API service keys with the READ_TENANT grant. OAuth calls also require permission to read the workspace’s audit logs (administrator access under the standard roles). Service keys can read and export audit logs only for their own workspace, with normal customer audit log visibility.

Use TenantGetAuditLogs for a page of events or TenantGetAuditLogExport for a compressed download. Both accept the same filters:

Parameter	Meaning
tenant	Workspace ID; the MCP connection can supply the selected workspace.
startAt	Inclusive timestamp, including a timezone. Defaults to 30 days before endAt.
endAt	Exclusive timestamp, including a timezone. Defaults to the first request’s current time.
actorIds	User IDs or service-key IDs.
operations	Exact audit operation identifiers, such as policy:update.
resourceTypes	Exact resource types, such as policy.
resourceIds	Exact resource IDs.

Values within an array combine with OR; different filters combine with AND. Values are case-sensitive literals. Omit an array to leave that filter unrestricted; provided arrays must contain 1–50 nonempty values, each at most 256 bytes. The selected time range must be at most 31 days. Split longer investigations into adjacent ranges, reusing one range’s endAt as the next range’s startAt.

For example, call either MCP tool with:

{
  "startAt": "2026-09-01T00:00:00Z",
  "endAt": "2026-09-08T00:00:00Z",
  "operations": ["policy:update"],
  "resourceTypes": ["policy"]
}

Read pages

TenantGetAuditLogs returns rows and cursor, newest first. Pass a nonempty cursor to retrieve the next page, keeping the same filters. An empty cursor means there are no more matching records. The first page fixes the time range for the remaining pages. Events ingested later with timestamps inside that range may still change the result; pagination is not a database snapshot.

The optional limit defaults to 100 and accepts 1–1000. Pages keep equal timestamps together and may exceed that target, up to 4999 records. If 5000 matching records share a timestamp, the request returns 422; use narrower actor, operation, or resource filters. Cursors from the previous audit log implementation are rejected with 400; restart from the first page.

REST uses GET /api/v1/tenants/{tenant}/audit-logs. Supply array filters as repeated query parameters, for example operations=policy:update&operations=policy:create.

Download an export

TenantGetAuditLogExport calls GET /api/v1/tenants/{tenant}/audit-logs/export, with filters in query parameters. The file is prepared in the background. The call waits up to 15 seconds for it (wait sets a different number of seconds, up to 25) and then answers with the export’s status. While the status is PENDING or RUNNING, call again with the same filters until it is COMPLETED; the response then carries downloadUrl, fileName, and recordCount. A completed export is reused for an hour, so repeated calls with the same filters return the same file. An export without endAt covers events up to the moment it was requested. A FAILED export without a failureReason is retried by the next call; one with a failureReason cannot succeed as requested: narrow the filters for TOO_LARGE or INVALID_PARAMETERS, and contact support for UNAVAILABLE.

Download downloadUrl directly to oneleet-audit-logs.jsonl.gz using your client’s file or shell capabilities. Each decompressed line contains one JSON event with the same fields as a listing row. Ask the assistant to generate a local parser and return only the resulting summary to its context. Calling the export tool creates the downloadable artifact; the client performs the local save.

Download links expire after one hour. Export objects use the existing private storage bucket’s 90-day cleanup policy. Treat the URL as a temporary credential.

Exports are limited to 100,000 records and 100 MiB of uncompressed JSON. An export over a limit, or one whose events share a timestamp too densely to page, ends with status FAILED and no file; the next call with the same filters starts a new one. Invalid filters are refused with 400. Unconfigured export storage returns 503.