# Audit log

Every change in the organization, including those made with tokens. Read only.

**Common tasks**

- [Read the audit log](#get-organizations-organization-audit-logs)

**Only in the app:** Nothing. The audit log is read only, in the app too.

**How it works in the app:** [help article](https://infranest.io/docs/audit-log).

**Scopes:** Read with `audit-log.read`. See [Tokens and scopes](../tokens-and-scopes.md#scopes).

<div class="ref-index">

[Audit logs](#audit-logs) <span class="ops-count">2</span>

</div>

Every endpoint below takes a token in the `Authorization: Bearer` header and answers JSON. Errors use the shared format in [Errors](../errors.md). Base address: `https://api.infranest.io/api`.

## Audit logs

### List audit log entries {#get-organizations-organization-audit-logs}

<div class="op">

<div class="op-text">

`GET` `/organizations/{organization}/audit-logs`

**Scope:** `audit-log.read` · **Changes data:** no

Who changed what in the organization, newest first. Filter with the dates `from` and `to`, `action` (matches part of the name), `resource_type` and `token_id` for changes made through one API token; page with `per_page` (default 25, at most 100) and `page`.

| Field | Type | Notes |
|---|---|---|
| `organization_id`<br><span class="field-meta">path · required</span> | integer | Your organization's ID. |

**Errors:** [`unauthenticated`](../errors.md#unauthenticated), [`scope_missing`](../errors.md#scope_missing), [`wrong_organization`](../errors.md#wrong_organization), [`test_token_required`](../errors.md#test_token_required), [`test_token_sandbox_only`](../errors.md#test_token_sandbox_only), [`permission_denied`](../errors.md#permission_denied), [`not_found`](../errors.md#not_found), [`rate_limited`](../errors.md#rate_limited)

</div>

<div class="op-code">

**Request**

```sh
curl "https://api.infranest.io/api/organizations/42/audit-logs" \
  -H "Authorization: Bearer $INFRANEST_TOKEN" \
  -H "Accept: application/json"
```

**Response** · 200

```json
{
  "current_page": 1,
  "data": [
    {
      "id": 25,
      "organization_id": 1,
      "user_id": 1,
      "action": "status_page_subscribers.viewed",
      "resource_type": "StatusPage",
      "resource_id": 1,
      "meta": {
        "count": 3,
        "status_page": "Northwind Cloud Status"
      },
      "ip_address": "127.0.0.1",
      "user_agent": "Symfony",
      "created_at": "2026-01-15T12:00:00.000000Z",
      "impersonator_id": null,
      "via_token_id": 5,
      "via_token_name": "api-samples",
      "user": {
        "id": 1,
        "name": "Alex Rivera",
        "email": "demo@example.com",
        "analytics_id": null
      },
      "impersonator": null
    },
    {
      "id": 24,
      "organization_id": 1,
      "user_id": 1,
      "action": "data.exported",
      "resource_type": null,
      "resource_id": null,
      "meta": {
        "month": "2025-12",
        "format": "csv",
        "filters": [],
        "resource": "uptime-report"
      },
      "ip_address": "127.0.0.1",
      "user_agent": "Symfony",
      "created_at": "2026-01-15T12:00:00.000000Z",
      "impersonator_id": null,
      "via_token_id": 5,
      "via_token_name": "api-samples",
      "user": {
        "id": 1,
        "name": "Alex Rivera",
        "email": "demo@example.com",
        "analytics_id": null
      },
      "impersonator": null
    }
  ],
  "first_page_url": "http://localhost/api/organizations/1/audit-logs?page=1",
  "from": 1,
  "last_page": 1,
  "last_page_url": "http://localhost/api/organizations/1/audit-logs?page=1",
  "links": [
    {
      "url": null,
      "label": "&laquo; Previous",
      "page": null,
      "active": false
    },
    {
      "url": "http://localhost/api/organizations/1/audit-logs?page=1",
      "label": "1",
      "page": 1,
      "active": true
    }
  ],
  "next_page_url": null,
  "path": "http://localhost/api/organizations/1/audit-logs",
  "per_page": 25,
  "prev_page_url": null,
  "to": 24,
  "total": 24
}
```

</div>

</div>

---

### Export the audit log as CSV {#get-organizations-organization-audit-logs-export}

<div class="op">

<div class="op-text">

`GET` `/organizations/{organization}/audit-logs/export`

**Scope:** `audit-log.read` · **Changes data:** no

Downloads every matching entry as a CSV file, with the same filters as the list and no paging. The export is itself recorded in the audit log.

| Field | Type | Notes |
|---|---|---|
| `organization_id`<br><span class="field-meta">path · required</span> | integer | Your organization's ID. |

**Errors:** [`unauthenticated`](../errors.md#unauthenticated), [`scope_missing`](../errors.md#scope_missing), [`wrong_organization`](../errors.md#wrong_organization), [`test_token_required`](../errors.md#test_token_required), [`test_token_sandbox_only`](../errors.md#test_token_sandbox_only), [`permission_denied`](../errors.md#permission_denied), [`not_found`](../errors.md#not_found), [`rate_limited`](../errors.md#rate_limited)

</div>

<div class="op-code">

**Request**

```sh
curl "https://api.infranest.io/api/organizations/42/audit-logs/export" \
  -H "Authorization: Bearer $INFRANEST_TOKEN" \
  -H "Accept: application/json"
```

**Response** · 200 — The matching audit log entries as CSV. (`text/csv`)

</div>

</div>