--- title: Get user audit logs --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api) [User](https://developers.cloudflare.com/api/resources/user) [Audit Logs](https://developers.cloudflare.com/api/resources/user/subresources/audit_logs) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Get user audit logs GET/user/audit\_logs Gets a list of audit logs for a user account. Can be filtered by who made the change, on which zone, and the timeframe of the change. ##### Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token. **Example:**Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**X-Auth-Email: user@example.com The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

##### Accepted Permissions (at least one required) `Account Settings Write``Account Settings Read` ##### Q uery ParametersExpand Collapse id: optional string Finds a specific log by its ID. [Link to this property](<#(resource)%20user.audit_logs%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20id%20%3E%20(schema)>)

action: optional object {type }

type: optional string Filters by the action type. Link to this property

[Link to this property](<#(resource)%20user.audit_logs%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20action%20%3E%20(schema)>)

actor: optional object {email, ip }

email: optional string Filters by the email address of the actor that made the change. formatemail Link to this property ip: optional string Filters by the IP address of the request that made the change by specific IP address or valid CIDR Range. Link to this property

[Link to this property](<#(resource)%20user.audit_logs%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20actor%20%3E%20(schema)>)

before: optional stringor string Limits the returned results to logs older than the specified date. A full-date that conforms to RFC3339.

One of the following: FullDate = string Limits the returned results to logs older than the specified date. A full-date that conforms to RFC3339. Link to this property DateTime = string Limits the returned results to logs older than the specified date. A date-time that conforms to RFC3339. Link to this property

[Link to this property](<#(resource)%20user.audit_logs%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20before%20%3E%20(schema)>)

direction: optional "desc"or "asc" Changes the direction of the chronological sorting.

One of the following: "desc" Link to this property "asc" Link to this property

[Link to this property](<#(resource)%20user.audit_logs%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20direction%20%3E%20(schema)>) export: optional boolean Indicates that this request is an export of logs in CSV format. [Link to this property](<#(resource)%20user.audit_logs%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20export%20%3E%20(schema)>) hide\_user\_logs: optional boolean Indicates whether or not to hide user level audit logs. [Link to this property](<#(resource)%20user.audit_logs%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20hide_user_logs%20%3E%20(schema)>) page: optional number Defines which page of results to return. minimum1 [Link to this property](<#(resource)%20user.audit_logs%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20page%20%3E%20(schema)>) per\_page: optional number Sets the number of results to return per page. maximum1000 minimum1 [Link to this property](<#(resource)%20user.audit_logs%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20per_page%20%3E%20(schema)>)

since: optional stringor string Limits the returned results to logs newer than the specified date. A full-date that conforms to RFC3339.

One of the following: FullDate = string Limits the returned results to logs newer than the specified date. A full-date that conforms to RFC3339. Link to this property DateTime = string Limits the returned results to logs newer than the specified date. A date-time that conforms to RFC3339. Link to this property

[Link to this property](<#(resource)%20user.audit_logs%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20since%20%3E%20(schema)>)

zone: optional object {name }

name: optional string Filters by the name of the zone associated to the change. Link to this property

[Link to this property](<#(resource)%20user.audit_logs%20%3E%20(method)%20list%20%3E%20(params)%20default%20%3E%20(param)%20zone%20%3E%20(schema)>) ##### ReturnsExpand Collapse

object {errors, messages, result, success }

errors: optional array of ResponseInfo { code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

messages: optional array of ResponseInfo { code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

result: optional array of AuditLog { id, action, actor, 7 more }

id: optional string A string that uniquely identifies the audit log. Link to this property

action: optional object {result, type }

result: optional boolean A boolean that indicates if the action attempted was successful. Link to this property type: optional string A short string that describes the action that was performed. Link to this property

Link to this property

actor: optional object {id, email, ip, type }

id: optional string The ID of the actor that performed the action. If a user performed the action, this will be their User ID. Link to this property email: optional string The email of the user that performed the action. formatemail Link to this property ip: optional string The IP address of the request that performed the action. Link to this property

type: optional "user"or "admin"or "Cloudflare" The type of actor, whether a User, Cloudflare Admin, or an Automated System.

One of the following: "user" Link to this property "admin" Link to this property "Cloudflare" Link to this property

Link to this property

Link to this property interface: optional string The source of the event. Link to this property metadata: optional unknown An object which can lend more context to the action being logged. This is a flexible value and varies between different actions. Link to this property newValue: optional string The new value of the resource that was modified. Link to this property oldValue: optional string The value of the resource before it was modified. Link to this property

owner: optional object {id }

id: optional string Identifier maxLength32 Link to this property

Link to this property

resource: optional object {id, type }

id: optional string An identifier for the resource that was affected by the action. Link to this property type: optional string A short string that describes the resource that was affected by the action. Link to this property

Link to this property when: optional string A UTC RFC3339 timestamp that specifies when the action being logged occured. formatdate-time Link to this property

Link to this property success: optional boolean Link to this property

[Link to this property](<#(resource)%20user.audit_logs%20%3E%20(method)%20list%20%3E%20(network%20schema)%20%3E%20(variant)%200>)

AaaAPIResponseCommon object {errors, messages, success }

errors: array of ResponseInfo { code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

messages: array of ResponseInfo { code, message, documentation\_url, source }

code: number minimum1000 Link to this property message: string Link to this property documentation\_url: optional string Link to this property

source: optional object {pointer }

pointer: optional string Link to this property

Link to this property

Link to this property success: true Whether the API call was successful Link to this property

[Link to this property](<#(resource)%20user.audit_logs%20%3E%20(method)%20list%20%3E%20(network%20schema)%20%3E%20(variant)%201>) ### Get user audit logs HTTP HTTPTypeScriptPythonGoTerraform ``` curl https://api.cloudflare.com/client/v4/user/audit_logs \ -H "Authorization: Bearer $CLOUDFLARE_API_TOKEN" ``` 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "id": "d5b0f326-1232-4452-8858-1089bd7168ef", "action": { "result": true, "type": "change_setting" }, "actor": { "id": "f6b5de0326bb5182b8a4840ee01ec774", "email": "michelle@example.com", "ip": "198.41.129.166", "type": "user" }, "interface": "API", "metadata": { "name": "security_level", "type": "firewall", "value": "high", "zone_name": "example.com" }, "newValue": "low", "oldValue": "high", "owner": { "id": "023e105f4ecef8ad9ca31a8372d0c353" }, "resource": { "id": "023e105f4ecef8ad9ca31a8372d0c353", "type": "zone" }, "when": "2017-04-26T17:31:07Z" } ], "success": true } ``` ##### Returns Examples 200 example ``` { "errors": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "messages": [ { "code": 1000, "message": "message", "documentation_url": "documentation_url", "source": { "pointer": "pointer" } } ], "result": [ { "id": "d5b0f326-1232-4452-8858-1089bd7168ef", "action": { "result": true, "type": "change_setting" }, "actor": { "id": "f6b5de0326bb5182b8a4840ee01ec774", "email": "michelle@example.com", "ip": "198.41.129.166", "type": "user" }, "interface": "API", "metadata": { "name": "security_level", "type": "firewall", "value": "high", "zone_name": "example.com" }, "newValue": "low", "oldValue": "high", "owner": { "id": "023e105f4ecef8ad9ca31a8372d0c353" }, "resource": { "id": "023e105f4ecef8ad9ca31a8372d0c353", "type": "zone" }, "when": "2017-04-26T17:31:07Z" } ], "success": true } ```