List audit logs with filters

POST https://{tenant}.atomicwork.com/api/v1/audit-logs/list

List audit logs with structured filters for actor, module, and event type

Filtering

Use the filters field to narrow results. Pass an empty array or omit the field to retrieve all records.

Each filter object has the following fields:

Field	Type	Description
`attribute`	string	The field to filter on (see Supported attributes below)
`operator`	string	Comparison operator (see Available operators below)
`values`	array	One or more `\{ "value": \<scalar> \}` objects

Supported attributes

Attribute	Typical operator	Description
`event_at`	`IS_BETWEEN`	Event timestamp. Requires exactly two values: `[start, end]` (both inclusive). Accepts ISO 8601 (`2024-01-01T00:00:00Z`) or date-only (`2024-01-01` — end date is automatically extended to `T23:59:59Z`). On export, defaults to the last 6 months if omitted.
`actor_id`	`IS_ANY_OF`	Numeric user ID of the person who performed the action (the `id` field from `GET /api/v1/users`).
`module`	`IS_ANY_OF`	Module integer ID (not the name). See the Module IDs reference table below.
`event_type`	`IS_ANY_OF`	Event type integer ID (not the name). See the Event Type IDs reference table below. Not every event type is valid for every module — unsupported combinations return zero results.

Available operators

Operator	Meaning
`EQUALS`	Exact match
`NOT_EQUALS`	Exclude exact match
`IN` / `IS_ANY_OF`	Match any value in the list
`IS_NOT_ANY_OF`	Exclude all listed values
`IS_BETWEEN`	Inclusive range — pass exactly two values: `[start, end]`
`IS_ON_OR_BEFORE` / `IS_ON_OR_AFTER`	Date/time boundary comparisons
`CONTAINS` / `TEXT_CONTAINS`	Substring or set membership
`IS_NULL` / `IS_NOT_NULL`	Null checks — `values` array can be empty
`STARTS_WITH` / `ENDS_WITH`	String prefix/suffix match

Module IDs (use with attribute: "module")

ID	Module	What it covers
`0`	APPS	Third-party app connections (connect / disconnect / update)
`1`	USERS	User creation and profile updates
`2`	WORKFLOWS	Automation workflow changes
`3`	SERVICE_CATALOG	Service catalog items
`4`	SECURITY	Login, logout, API key creation / deletion
`5`	SKILL	AI skill changes
`6`	WORKSPACES	Workspace settings changes
`7`	TENANT_MIGRATION	Sandbox import / export
`8`	AGENT_GROUPS	Agent group changes
`9`	ACCESS_MANAGEMENT	Role and access control changes
`10`	AI_AGENTS	AI agent changes
`11`	AGENT_AVAILABILITY	Agent availability updates
`12`	CUSTOM_OBJECTS	Custom object type changes

Event Type IDs (use with attribute: "event_type")

ID	Event Type
`0`	CONNECTED
`1`	DISCONNECTED
`2`	CREATED
`3`	UPDATED
`4`	ENABLED
`5`	DISABLED
`6`	DELETED
`7`	IMPORT
`8`	EXPORT
`9`	RESTORED
`10`	LOGIN
`12`	LOGOUT

Module → valid event types

Module	Valid event type IDs
APPS (0)	0 (CONNECTED), 1 (DISCONNECTED), 3 (UPDATED)
USERS (1)	2 (CREATED), 3 (UPDATED)
WORKFLOWS (2)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
SERVICE_CATALOG (3)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
SECURITY (4)	2 (CREATED), 6 (DELETED), 10 (LOGIN), 12 (LOGOUT)
SKILL (5)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
WORKSPACES (6)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
TENANT_MIGRATION (7)	7 (IMPORT), 8 (EXPORT)
AGENT_GROUPS (8)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
ACCESS_MANAGEMENT (9)	2 (CREATED), 3 (UPDATED), 6 (DELETED), 9 (RESTORED)
AI_AGENTS (10)	2 (CREATED), 3 (UPDATED), 6 (DELETED)
AGENT_AVAILABILITY (11)	3 (UPDATED)
CUSTOM_OBJECTS (12)	2 (CREATED), 3 (UPDATED), 6 (DELETED)

Example

[
  {
    "attribute": "event_at",
    "operator": "IS_BETWEEN",
    "values": [
      {
        "value": "2024-01-01T00:00:00Z"
      },
      {
        "value": "2024-12-31T23:59:59Z"
      }
    ]
  },
  {
    "attribute": "module",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 1
      },
      {
        "value": 9
      }
    ]
  },
  {
    "attribute": "event_type",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 2
      },
      {
        "value": 3
      }
    ]
  },
  {
    "attribute": "actor_id",
    "operator": "IS_ANY_OF",
    "values": [
      {
        "value": 123
      }
    ]
  }
]

Authorization

X-Api-Keyheaderstringrequired

Headers

X-Workspace-Idheaderstring

Body

search_keybodystring

pagebodyinteger

per_pagebodyinteger

next_page_tokenbodystring

filtersbodyarray of object

sort_orderbodyenum (string)

Response

200application/json

Successful response

cURL

curl -X POST 'https://{tenant}.atomicwork.com/api/v1/audit-logs/list' \
  -H 'X-Api-Key: <api-key>' \
  -H 'Content-Type: application/json' \
  -d '{"search_key": "string", "page": 0, "per_page": 0, "next_page_token": "string", "filters": [{"attribute": "string", "operator": "LIKE", "values": ["\u2026"]}], "sort_order": "EVENT_AT_DESC"}'

Field

Type

Description

attribute

string

The field to filter on (see Supported attributes below)

operator

string

Comparison operator (see Available operators below)

values

array

One or more \{ "value": \<scalar> \} objects

Attribute

Typical operator

Description

event_at

IS_BETWEEN

Event timestamp. Requires exactly two values: [start, end] (both inclusive). Accepts ISO 8601 (2024-01-01T00:00:00Z) or date-only (2024-01-01 — end date is automatically extended to T23:59:59Z). On export, defaults to the last 6 months if omitted.

actor_id

IS_ANY_OF

Numeric user ID of the person who performed the action (the id field from GET /api/v1/users).

module

IS_ANY_OF

Module integer ID (not the name). See the Module IDs reference table below.

event_type

IS_ANY_OF

Event type integer ID (not the name). See the Event Type IDs reference table below. Not every event type is valid for every module — unsupported combinations return zero results.

Operator

Meaning

EQUALS

Exact match

NOT_EQUALS

Exclude exact match

IN / IS_ANY_OF

Match any value in the list

IS_NOT_ANY_OF

Exclude all listed values

IS_BETWEEN

Inclusive range — pass exactly two values: [start, end]

IS_ON_OR_BEFORE / IS_ON_OR_AFTER

Date/time boundary comparisons

CONTAINS / TEXT_CONTAINS

Substring or set membership

IS_NULL / IS_NOT_NULL

Null checks — values array can be empty

STARTS_WITH / ENDS_WITH

String prefix/suffix match

Module

What it covers

0

APPS

Third-party app connections (connect / disconnect / update)

1

USERS

User creation and profile updates

2

WORKFLOWS

Automation workflow changes

3

SERVICE_CATALOG

Service catalog items

4

SECURITY

5

SKILL

AI skill changes

6

WORKSPACES

Workspace settings changes

7

TENANT_MIGRATION

Sandbox import / export

8

AGENT_GROUPS

Agent group changes

9

ACCESS_MANAGEMENT

Role and access control changes

10

AI_AGENTS

AI agent changes

11

AGENT_AVAILABILITY

Agent availability updates

12

CUSTOM_OBJECTS

Custom object type changes

Event Type

0

CONNECTED

1

DISCONNECTED

2

CREATED

3

UPDATED

4

ENABLED

5

DISABLED

6

DELETED

7

IMPORT

8

EXPORT

9

RESTORED

10

12

LOGOUT

Module

Valid event type IDs

APPS (0)

0 (CONNECTED), 1 (DISCONNECTED), 3 (UPDATED)

USERS (1)

2 (CREATED), 3 (UPDATED)

WORKFLOWS (2)