> ## Documentation Index > Fetch the complete documentation index at: https://docs.notifuse.com/llms.txt > Use this file to discover all available pages before exploring further. # List audit logs > Returns one page of audit entries, newest first. With scope=workspace (the default) workspace_id is required and the caller must be an owner of that workspace or hold the audit_logs read permission; with scope=deployment the caller must be a root user and every entry is returned, optionally narrowed to one workspace. Never refused for licence reasons: the page works in every licence state on whatever was recorded while a key covered audit logs. ## OpenAPI ````yaml /openapi.json get /api/auditLogs.list openapi: 3.0.3 info: title: Notifuse API description: API for Notifuse - a transactional email and newsletter management platform version: 1.0.0 contact: name: Notifuse Support url: https://www.notifuse.com/support email: hello@notifuse.com license: name: BUSL-1.1 url: https://github.com/Notifuse/notifuse/blob/main/LICENSE servers: - url: https://{notifuseDomain} description: Customer-specific Notifuse API server variables: notifuseDomain: description: Your unique Notifuse domain default: demo.notifuse.com security: [] paths: /api/auditLogs.list: get: tags: - Audit logs summary: List audit logs description: > Returns one page of audit entries, newest first. With scope=workspace (the default) workspace_id is required and the caller must be an owner of that workspace or hold the audit_logs read permission; with scope=deployment the caller must be a root user and every entry is returned, optionally narrowed to one workspace. Never refused for licence reasons: the page works in every licence state on whatever was recorded while a key covered audit logs. operationId: listAuditLogs parameters: - name: scope in: query required: false schema: type: string enum: - workspace - deployment default: workspace - name: workspace_id in: query required: false schema: type: string description: Required in workspace scope; optional narrowing in deployment scope. example: ws_1234567890 - name: actions in: query required: false schema: type: string description: Comma-separated action names, e.g. templates.update,lists.create. - name: categories in: query required: false schema: type: string description: Comma-separated categories. - name: actor_id in: query required: false schema: type: string - name: actor_email in: query required: false schema: type: string description: Substring match, case-insensitive. - name: actor_type in: query required: false schema: type: string enum: - user - api_key - system - anonymous - name: outcome in: query required: false schema: type: string enum: - success - failure - denied - name: target_type in: query required: false schema: type: string - name: target_id in: query required: false schema: type: string - name: ip_address in: query required: false schema: type: string - name: from in: query required: false schema: type: string format: date-time description: >- Only entries at or after this instant (RFC3339). A malformed value is a 400. - name: to in: query required: false schema: type: string format: date-time - name: cursor in: query required: false schema: type: string description: The next_cursor of the previous page. - name: limit in: query required: false schema: type: integer default: 50 maximum: 100 description: Clamped to 100. responses: '200': description: One page content: application/json: schema: $ref: '#/components/schemas/AuditLogListResponse' '400': description: Malformed filter content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: >- Not an owner, no audit_logs read permission, or not root for the deployment scope content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - BearerAuth: [] components: schemas: AuditLogListResponse: type: object properties: logs: type: array items: $ref: '#/components/schemas/AuditLog' next_cursor: type: string description: Present when has_more is true; pass it back as cursor. has_more: type: boolean ErrorResponse: type: object properties: error: type: string description: Error message required: - error AuditLog: type: object description: >- One recorded control-plane action. workspace_id is absent for deployment-level entries (sign-ins, the licence, the system settings). properties: id: type: string example: 8b8dd285f6874c17b5edcb39ef3e0b8b occurred_at: type: string format: date-time workspace_id: type: string example: ws_1234567890 action: type: string description: The RPC route that performed the action, verbatim. example: workspaces.inviteMember category: type: string example: members outcome: type: string enum: - success - failure - denied status_code: type: integer example: 200 actor_type: type: string enum: - user - api_key - system - anonymous actor_id: type: string actor_email: type: string actor_name: type: string actor_role: type: string enum: - owner - member - root auth_method: type: string enum: - session - api_key - magic_code - sso - root_password target_type: type: string example: invitation target_id: type: string target_name: type: string example: bob@example.com ip_address: type: string example: 203.0.113.9 user_agent: type: string request_id: type: string description: Echoed on every API response as X-Request-ID. changes: type: object additionalProperties: $ref: '#/components/schemas/AuditChange' metadata: type: object additionalProperties: true AuditChange: type: object description: >- One field's before and after. Secrets are replaced by "[redacted]" on both sides. properties: old: description: The value before the action new: description: The value after the action securitySchemes: BearerAuth: type: http scheme: bearer description: API token for authentication ````