> For the complete documentation index, see [llms.txt](https://fusionauth.io/docs/llms.txt)

# Search the Audit Log

API documentation for the FusionAuth Search the Audit Log API.

# Search the Audit Log

This API allows you to search and paginate through the Audit Logs.

## Request

[!API Key Authentication](https://fusionauth.io/docs/apis/authentication.md#api-key-authentication)

Searches the Audit Logs using the given search criteria

GET/api/system/audit-log/search?message={message}&start={start}&end={end}&user={user}

When calling the API using a `GET` request you will send the search criteria on the URL using request parameters. In order to simplify the example URL above, not every possible parameter is shown, however using the provided pattern you may add any of the documented request parameters to the URL.

### Request Parameters

`end`Longoptional

The end [instant](https://fusionauth.io/docs/reference/data-types.md#instants) of the date/time range to search within.

`message`Stringoptional

The string to search in the Audit Log message for. This can contain wildcards using the asterisk character (`*`). If no wildcards are present, this parameter value will be interpreted as `*value*`.

`newValue`StringoptionalAvailable since 1.30.0

The string to search for in the **Audit Log** field for **newValue**. Note, that not all audit log entries will contain this field, it is primarily used for Audit Logs for updates to existing objects.

`numberOfResults`IntegeroptionalDefaults to 25

The number of results to return from the search.

`oldValue`StringoptionalAvailable since 1.30.0

The string to search for in the **Audit Log** field for **oldValue**. Note, that not all audit log entries will contain this field, it is primarily used for Audit Logs for updates to existing objects.

`orderBy`StringoptionalDefaults to insertInstant DESC

The database column to order the search results on plus the order direction.

The possible values are:

*   `insertInstant` - the [instant](https://fusionauth.io/docs/reference/data-types.md#instants) when the Audit Log was created
*   `insertUser` - the user that created the Audit Log
*   `message` - the message of the Audit Log
*   `tenant` - the Tenant Name associated with the Audit Log (nullable) Available since 1.65.0

For example, to order the results by the insert instant in a descending order, the value would be provided as `insertInstant DESC`. The final string is optional and can be set to `ASC` or `DESC`.

`reason`StringoptionalAvailable since 1.30.0

The string to search for in the **Audit Log** field for **reason**. Note, that not all audit log entries will contain this field.

`start`Longoptional

The start [instant](https://fusionauth.io/docs/reference/data-types.md#instants) of the date/time range to search within.

`startRow`IntegeroptionalDefaults to 0

The offset row to return results from. If the search has 200 records in it and this is 50, it starts with row 50.

`tenantId`UUIDoptionalAvailable since 1.65.0

Restricts the results to Audit Logs belonging to the given Tenant. This parameter will be overridden if the request contains an `X-FusionAuth-TenantId` header, or if the supplied API key is scoped to a specific Tenant.

`user`Stringoptional

The string to search in the Audit Log user for. This can contain wildcards using the asterisk character (`*`). If no wildcards are present, this parameter value will be interpreted as `*value*`.

[!API Key Authentication](https://fusionauth.io/docs/apis/authentication.md#api-key-authentication)

Searches the Audit Logs using the given search criteria

POST/api/system/audit-log/search

OpenAPI Spec

When calling the API using a `POST` request you will send the search criteria in a JSON request body.

### Request Body

`search.end`Longoptional

The end [instant](https://fusionauth.io/docs/reference/data-types.md#instants) of the date/time range to search within.

`search.message`Stringoptional

The string to search in the Audit Log message for. This can contain wildcards using the asterisk character (`*`). If no wildcards are present, this parameter value will be interpreted as `*value*`.

`search.newValue`StringoptionalAvailable since 1.30.0

The string to search for in the **Audit Log** field for **newValue**. Note, that not all audit log entries will contain this field, it is primarily used for Audit Logs for updates to existing objects.

In versions >= 1.49.0 sensitive values may be masked.

`search.numberOfResults`IntegeroptionalDefaults to 25

The number of results to return from the search.

`search.oldValue`StringoptionalAvailable since 1.30.0

The string to search for in the **Audit Log** field for **oldValue**. Note, that not all audit log entries will contain this field, it is primarily used for Audit Logs for updates to existing objects.

In versions >= 1.49.0 sensitive values may be masked.

`search.orderBy`StringoptionalDefaults to insertInstant DESC

The database column to order the search results on plus the order direction.

The possible values are:

*   `insertInstant` - the [instant](https://fusionauth.io/docs/reference/data-types.md#instants) when the Audit Log was created
*   `insertUser` - the user that created the Audit Log
*   `message` - the message of the Audit Log
*   `tenant` - the Tenant Id associated with the Audit Log (nullable) Available since 1.65.0

For example, to order the results by the insert instant in a descending order, the value would be provided as `insertInstant DESC`. The final string is optional and can be set to `ASC` or `DESC`.

`search.reason`StringoptionalAvailable since 1.30.0

The string to search for in the **Audit Log** field for **reason**. Note, that not all audit log entries will contain this field.

`search.start`Longoptional

The start [instant](https://fusionauth.io/docs/reference/data-types.md#instants) of the date/time range to search within.

`search.startRow`IntegeroptionalDefaults to 0

The offset row to return results from. If the search has 200 records in it and this is 50, it starts with row 50.

`search.tenantId`UUIDoptionalAvailable since 1.65.0

Restricts the results to Audit Logs belonging to the given Tenant. This parameter will be overridden if the request contains an `X-FusionAuth-TenantId` header, or if the supplied API key is scoped to a specific Tenant.

`search.user`Stringoptional

The string to search in the Audit Log user for. This can contain wildcards using the asterisk character (`*`). If no wildcards are present, this parameter value will be interpreted as `*value*`.

## Response

The response for this API contains the Audit Logs matching the search criteria in paginated format.

*Response Codes*

| Code | Description |
| --- | --- |
| 200 | The request was successful. The response will contain a JSON body. |
| 400 | The request was invalid and/or malformed. The response will contain an [Errors](https://fusionauth.io/docs/apis/errors.md) JSON Object with the specific errors. This status will also be returned if a paid FusionAuth license is required and is not present. |
| 401 | You did not supply a valid Authorization header. The header was omitted or your API key was not valid. The response will be empty. See [Authentication](https://fusionauth.io/docs/apis/authentication.md). |
| 404 | The object you requested doesn't exist. The response will be empty. |
| 500 | There was an internal error. A stack trace is provided and logged in the FusionAuth log files. The response will be empty. |
| 503 | The search index is not available or encountered an exception so the request cannot be completed. The response will contain a JSON body. |

### Response Body

`auditLogs`Array

The list of Audit Logs returned by the search.

`auditLogs[x].data`Object

Additional details of an audit log.

`auditLogs[x].data.newValue`String

The new value of a changed object.

In versions >= 1.49.0 sensitive values may be masked.

`auditLogs[x].data.oldValue`String

The previous value of a changed object.

In versions >= 1.49.0 sensitive values may be masked.

`auditLogs[x].data.reason`String

The reason why the audit log was created.

`auditLogs[x].tenantId`UUIDAvailable since 1.65.0

The Id of the Tenant associated with this Audit Log. This field will be null for instance-scoped audit logs.

`auditLogs[x].id`Long

The Audit Log unique Id.

`auditLogs[x].insertInstant`Long

The [instant](https://fusionauth.io/docs/reference/data-types.md#instants) when the Audit Log was created.

`auditLogs[x].insertUser`String

The user that created the Audit Log.

`auditLogs[x].message`String

The message of the Audit Log.

`total`Integer

The total number of Audit Logs matching the search criteria. Use this value along with the **numberOfResults** and **startRow** in the Search request to perform pagination.

*Example JSON Response*

```json
{
  "auditLogs": [
    {
      "id": 1,
      "insertInstant": 1471786483322,
      "insertUser": "user@fusionauth.io",
      "message": "Audit Log 1"
    },
    {
      "id": 2,
      "insertInstant": 1471786489322,
      "insertUser": "user@fusionauth.io",
      "message": "Audit Log 2"
    },
    {
      "data": {
        "externalId": "_applicationA"
      },
      "newValue:": "{\"name\": \"bar\"}",
      "oldValue": "{\"name\": \"foo\"}",
      "reason": "Because I like to change things.",
      "id": 3,
      "insertInstant": 1471796483322,
      "insertUser": "user@fusionauth.io",
      "message": "Changed Application"
    }
  ],
  "total": 100
}
```