Skip to content
Cloudflare API
Start here
API Reference
Zero Trust
Access
Logs
Access Requests

Get Access authentication logs

zero_trust.access.logs.access_requests.list(AccessRequestListParams**kwargs) -> AccessRequestListResponse
GET/accounts/{account_id}/access/logs/access_requests

Gets a list of Access authentication audit logs for an account.

Security

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key.

Example:X-Auth-Email: user@example.com

The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys.

Example:X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194
Accepted Permissions (at least one required)
Access: Audit Logs Read
ParametersExpand Collapse
account_id: str

Identifier.

maxLength32
allowed_op: Optional[Literal["eq", "neq"]]

Operator for the allowed filter.

One of the following:
"eq"
"neq"
app_type_op: Optional[Literal["eq", "neq"]]

Operator for the app_type filter.

One of the following:
"eq"
"neq"
app_uid_op: Optional[Literal["eq", "neq"]]

Operator for the app_uid filter.

One of the following:
"eq"
"neq"
country_code_op: Optional[Literal["eq", "neq"]]

Operator for the country_code filter.

One of the following:
"eq"
"neq"
direction: Optional[Literal["desc", "asc"]]

The chronological sorting order for the logs.

One of the following:
"desc"
"asc"
email: Optional[str]

Filter by user email. Defaults to substring matching. To force exact matching, set email_exact=true. Example (default): email=@example.com returns all events with that domain. Example (exact): email=user@example.com&email_exact=true returns only that user.

formatemail
email_exact: Optional[bool]

When true, email is matched exactly instead of substring matching.

email_op: Optional[Literal["eq", "neq"]]

Operator for the email filter.

One of the following:
"eq"
"neq"
fields: Optional[str]

Comma-separated list of fields to include in the response. When omitted, all fields are returned.

idp_op: Optional[Literal["eq", "neq"]]

Operator for the idp filter.

One of the following:
"eq"
"neq"
limit: Optional[int]

The maximum number of log entries to retrieve.

non_identity_op: Optional[Literal["eq", "neq"]]

Operator for the non_identity filter.

One of the following:
"eq"
"neq"
page: Optional[int]

Page number of results.

per_page: Optional[int]

Number of results per page.

rayid_op: Optional[Literal["eq", "neq"]]

Operator for the ray_id filter.

One of the following:
"eq"
"neq"
since: Optional[Union[str, datetime]]

The earliest event timestamp to query.

formatdate-time
until: Optional[Union[str, datetime]]

The latest event timestamp to query.

formatdate-time
user_id: Optional[str]

Filter by user UUID.

formatuuid
user_id_op: Optional[Literal["eq", "neq"]]

Operator for the user_id filter.

One of the following:
"eq"
"neq"
ReturnsExpand Collapse
action: Optional[str]

The event that occurred, such as a login attempt.

allowed: Optional[bool]

The result of the authentication event.

app_domain: Optional[str]

The URL of the Access application.

app_uid: Optional[str]

The unique identifier for the Access application.

connection: Optional[str]

The IdP used to authenticate.

created_at: Optional[datetime]
formatdate-time
ip_address: Optional[str]

The IP address of the authenticating user.

rayid: Optional[str]

The unique identifier for the request to Cloudflare.

maxLength16
user_email: Optional[str]

The email address of the authenticating user.

formatemail

Get Access authentication logs

import os
from cloudflare import Cloudflare

client = Cloudflare(
    api_email=os.environ.get("CLOUDFLARE_EMAIL"),  # This is the default and can be omitted
    api_key=os.environ.get("CLOUDFLARE_API_KEY"),  # This is the default and can be omitted
)
access_requests = client.zero_trust.access.logs.access_requests.list(
    account_id="023e105f4ecef8ad9ca31a8372d0c353",
)
print(access_requests)
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "action": "login",
      "allowed": true,
      "app_domain": "test.example.com/admin",
      "app_uid": "df7e2w5f-02b7-4d9d-af26-8d1988fca630",
      "connection": "saml",
      "created_at": "2014-01-01T05:20:00.12345Z",
      "ip_address": "198.41.129.166",
      "ray_id": "187d944c61940c77",
      "user_email": "user@example.com"
    }
  ]
}
Returns Examples
{
  "errors": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "messages": [
    {
      "code": 1000,
      "message": "message",
      "documentation_url": "documentation_url",
      "source": {
        "pointer": "pointer"
      }
    }
  ],
  "success": true,
  "result": [
    {
      "action": "login",
      "allowed": true,
      "app_domain": "test.example.com/admin",
      "app_uid": "df7e2w5f-02b7-4d9d-af26-8d1988fca630",
      "connection": "saml",
      "created_at": "2014-01-01T05:20:00.12345Z",
      "ip_address": "198.41.129.166",
      "ray_id": "187d944c61940c77",
      "user_email": "user@example.com"
    }
  ]
}