curl -X GET "https://app.cotool.ai/api/audit-logs" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"import requests
url = "https://app.cotool.ai/api/audit-logs"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cotool.ai/api/audit-logs', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));HttpResponse<String> response = Unirest.get("https://app.cotool.ai/api/audit-logs")
.header("Authorization", "Bearer <token>")
.asString();package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.cotool.ai/api/audit-logs"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}[
{
"id": "<string>",
"timestamp": "<string>",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"event": "<string>",
"actor": "<string>",
"userId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"ipAddress": "<string>",
"chatId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"runId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"triggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"data": {},
"createdAt": "<string>",
"user": {
"email": "<string>"
},
"agent": {
"name": "<string>"
},
"trigger": {
"name": "<string>",
"type": "<string>"
}
}
]{
"error": "<string>",
"issues": [
{}
]
}{
"error": "<string>"
}{
"error": "<string>",
"missingPerms": [
"<string>"
]
}{
"error": "<string>"
}List audit logs
Return a paginated list of audit logs filtered by query parameters such as userId, event type, date range, etc. Supports two pagination modes: limit/offset (default), and keyset cursors for continuous export — when a page is full, the X-Next-Cursor response header carries an opaque cursor for the next page; pass it back as the cursor query parameter. An absent header (or a short page) means there is no more data. Cursor pages stay equally fast at any depth, unlike large offsets.
curl -X GET "https://app.cotool.ai/api/audit-logs" \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json"import requests
url = "https://app.cotool.ai/api/audit-logs"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://app.cotool.ai/api/audit-logs', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));HttpResponse<String> response = Unirest.get("https://app.cotool.ai/api/audit-logs")
.header("Authorization", "Bearer <token>")
.asString();package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://app.cotool.ai/api/audit-logs"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}[
{
"id": "<string>",
"timestamp": "<string>",
"organizationId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"event": "<string>",
"actor": "<string>",
"userId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"ipAddress": "<string>",
"chatId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"agentId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"runId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"triggerId": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"data": {},
"createdAt": "<string>",
"user": {
"email": "<string>"
},
"agent": {
"name": "<string>"
},
"trigger": {
"name": "<string>",
"type": "<string>"
}
}
]{
"error": "<string>",
"issues": [
{}
]
}{
"error": "<string>"
}{
"error": "<string>",
"missingPerms": [
"<string>"
]
}{
"error": "<string>"
}Authorizations
API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here
Query Parameters
Filter audit logs by specific user ID
1Filter audit logs by event type (e.g., user.login, agent.runStarted)
Filter audit logs by actor type (user, agent, chat)
Filter audit logs by specific chat ID
1Filter audit logs by specific agent ID
1Filter audit logs by specific trigger ID
1Filter audit logs by tool family (e.g. "slack" matches data.toolId = "slack" and any "slack_*" tool)
Filter audit logs from this date onwards (ISO string format)
Filter audit logs up to this date (ISO string format)
Text search across event type, actor, user email, agent name, and data fields
Maximum number of audit logs to return (1-100, default: 50)
1 <= x <= 100Number of audit logs to skip for pagination (default: 0, max: 10000). For continuous export or deep pagination, use cursor pagination instead.
0 <= x <= 10000Opaque keyset-pagination cursor from the X-Next-Cursor response header of the previous page. Preferred over offset for continuous export: pages stay equally fast at any depth and an empty page means there is no more data. Mutually exclusive with offset; only supported with sortBy=timestamp.
1Field to sort audit logs by (default: timestamp)
timestamp, createdAt Sort direction for audit logs (default: desc)
asc, desc Response
Successful response
Unique identifier for this audit log entry
1When the audited event occurred
Organization where the event took place
Type of event that was audited (e.g., user.login, agent.runStarted)
Who or what performed the action (user, agent, chat)
ID of the user involved in the event (null if not applicable)
IP address where the event originated (null if not applicable)
ID of the chat involved in the event (null if not applicable)
ID of the agent involved in the event (null if not applicable)
ID of the agent run involved in the event (null if not applicable)
ID of the trigger involved in the event (null if not applicable)
Additional event-specific data (null if no extra data)
Show child attributes
Show child attributes
When this audit log entry was created in the database
Hydrated user information (included when available)
Show child attributes
Show child attributes
Hydrated agent information (included when available)
Show child attributes
Show child attributes
Hydrated trigger information (included when available)
Show child attributes
Show child attributes
Was this page helpful?