--- title: Logs --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [Organizations](https://developers.cloudflare.com/api/resources/organizations) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Logs #### LogsAudit ##### [Get organization audit logs (Version 2)](https://developers.cloudflare.com/api/resources/organizations/subresources/logs/subresources/audit/methods/list) GET/organizations/{organization\_id}/logs/audit ##### [Get resource change history from an organization audit log entry (Version 2)](https://developers.cloudflare.com/api/resources/organizations/subresources/logs/subresources/audit/methods/history) GET/organizations/{organization\_id}/logs/audit/{id}/history ##### ModelsExpand Collapse

AuditListResponse object {id, action, actor, 3 more }

id: optional string A unique identifier for the audit log entry. maxLength32 Link to this property

action: optional object {description, result, time, type } Provides information about the action performed.

description: optional string A short description of the action performed. Link to this property result: optional string The result of the action, indicating success or failure. Link to this property time: optional string A timestamp indicating when the action was logged. formatdate-time Link to this property type: optional string A short string that describes the action that was performed. Link to this property

Link to this property

actor: optional object {id, context, email, 4 more } Provides details about the actor who performed the action.

id: optional string The ID of the actor who performed the action. If a user performed the action, this will be their User ID. Link to this property

context: optional "api"or "api\_key"or "api\_token"or 3 more The context in which the action was initiated. - api: The action was performed through the API. The specific credential type was not recorded. - api_key: The action was authenticated with a Cloudflare Global API Key. - api_token: The action was authenticated with an API token. - dash: The action was performed through the Cloudflare dashboard. - oauth: The action was authenticated with an OAuth token. - origin_ca_key: The action was authenticated with an Origin CA key.

One of the following: "api" Link to this property "api\_key" Link to this property "api\_token" Link to this property "dash" Link to this property "oauth" Link to this property "origin\_ca\_key" Link to this property

Link to this property email: optional string The email of the actor who performed the action. formatemail Link to this property ip\_address: optional string The IP address of the request that performed the action. Link to this property token\_id: optional string The API token ID when the actor context is an api\_token or oauth. Link to this property token\_name: optional string The API token name when the actor context is an api\_token or oauth. Link to this property

type: optional "cloudflare\_admin"or "system"or "user" The type of actor.

One of the following: "cloudflare\_admin" Link to this property "system" Link to this property "user" Link to this property

Link to this property

organization: optional object {id } Contains organization related information.

id: optional string A unique identifier for the organization. Link to this property

Link to this property

raw: optional object {cf\_ray\_id, method, status\_code, 2 more } Provides raw information about the request and response.

cf\_ray\_id: optional string The Cloudflare Ray ID for the request. Link to this property method: optional string The HTTP method of the request. Link to this property status\_code: optional number The HTTP response status code returned by the API. Link to this property uri: optional string The URI of the request. Link to this property user\_agent: optional string The client’s user agent string sent with the request. Link to this property

Link to this property

resource: optional object {id, product, request, 3 more } Provides details about the affected resource.

id: optional string The unique identifier for the affected resource. Link to this property product: optional string The Cloudflare product associated with the resource. Link to this property request: optional unknown Link to this property response: optional unknown Link to this property scope: optional unknown The scope of the resource. Link to this property type: optional string The type of the resource. Link to this property

Link to this property

[Link to this property](<#(resource)%20organizations.logs.audit%20%3E%20(model)%20audit_list_response%20%3E%20(schema)>)

AuditHistoryResponse = array of object {id, action, actor, 3 more }

id: optional string A unique identifier for the audit log entry. maxLength32 Link to this property

action: optional object {description, result, time, type } Provides information about the action performed.

Link to this property

actor: optional object {id, context, email, 4 more } Provides details about the actor who performed the action.

id: optional string The ID of the actor who performed the action. If a user performed the action, this will be their User ID. Link to this property

type: optional "cloudflare\_admin"or "system"or "user" The type of actor.

One of the following: "cloudflare\_admin" Link to this property "system" Link to this property "user" Link to this property

Link to this property

organization: optional object {id } Contains organization related information.

id: optional string A unique identifier for the organization. Link to this property

Link to this property

raw: optional object {cf\_ray\_id, method, status\_code, 2 more } Provides raw information about the request and response.

Link to this property

resource: optional object {id, product, request, 3 more } Provides details about the affected resource.

Link to this property

[Link to this property](<#(resource)%20organizations.logs.audit%20%3E%20(model)%20audit_history_response%20%3E%20(schema)>)