--- title: Get account audit logs (Version 2) --- [Skip to content](#_top) [API Reference](https://developers.cloudflare.com/api/typescript) [Accounts](https://developers.cloudflare.com/api/typescript/resources/accounts) [Logs](https://developers.cloudflare.com/api/typescript/resources/accounts/subresources/logs) [Audit](https://developers.cloudflare.com/api/typescript/resources/accounts/subresources/logs/subresources/audit) Copy Markdown Open in **Claude**Open in **ChatGPT**Open in **Cursor** --- **Copy Markdown****View as Markdown** # Get account audit logs (Version 2) client.accounts.logs.audit.list(AuditListParams {account\_id, before, since, 26 more } params, RequestOptionsoptions?): CursorPaginationAfter< [AuditListResponse]() {id, account, action, 4 more } > GET/accounts/{account\_id}/logs/audit Gets a list of audit logs for an account. ##### Security

API Token

The preferred authorization scheme for interacting with the Cloudflare API. Create a token. **Example:**Authorization: Bearer Sn3lZJTBX6kkg7OdcBUAxOO963GEIyGQqnFTOFYY

API Email + API Key

The previous authorization scheme for interacting with the Cloudflare API, used in conjunction with a Global API key. **Example:**X-Auth-Email: user@example.com The previous authorization scheme for interacting with the Cloudflare API. When possible, use API tokens instead of Global API keys. **Example:**X-Auth-Key: 144c9defac04969c7bfad8efaa8ea194

##### Accepted Permissions (at least one required) `Account Settings Write``Account Settings Read` ##### ParametersExpand Collapse

params: AuditListParams {account\_id, before, since, 26 more }

account\_id: string Path param: The unique id that identifies the account. Link to this property before: string Query param: Limits the returned results to logs older than the specified date. This can be a date string 2019-04-30 (interpreted in UTC) or an absolute timestamp that conforms to RFC3339. formatdate Link to this property since: string Query param: Limits the returned results to logs newer than the specified date. This can be a date string 2019-04-30 (interpreted in UTC) or an absolute timestamp that conforms to RFC3339. formatdate Link to this property

id?: ID Query param

not?: Array<string> Filters out audit logs by their IDs. Link to this property

Link to this property

account\_name?: AccountName Query param

not?: Array<string> Filters out audit logs by the account name. Link to this property

Link to this property

action\_result?: ActionResult Query param

not?: Array<"success"| "failure"> Filters out audit logs by whether the action was successful or not.

One of the following: "success" Link to this property "failure" Link to this property

Link to this property

action\_type?: ActionType Query param

not?: Array<"create"| "delete"| "view"| "update"> Filters out audit logs by the action type.

One of the following: "create" Link to this property "delete" Link to this property "view" Link to this property "update" Link to this property

Link to this property

actor\_context?: ActorContext Query param

not?: Array<"api"| "api\_key"| "api\_token"| 3 more> Filters out audit logs by the actor context. - api: The action was performed through the API. The specific credential type was not recorded. - api_key: The action was authenticated with a Cloudflare Global API Key. - api_token: The action was authenticated with an API token. - dash: The action was performed through the Cloudflare dashboard. - oauth: The action was authenticated with an OAuth token. - origin_ca_key: The action was authenticated with an Origin CA key.

One of the following: "api" Link to this property "api\_key" Link to this property "api\_token" Link to this property "dash" Link to this property "oauth" Link to this property "origin\_ca\_key" Link to this property

Link to this property

actor\_email?: ActorEmail Query param

not?: Array<string> Filters out audit logs by the actor’s email address. Link to this property

Link to this property

actor\_id?: ActorID Query param

not?: Array<string> Filters out audit logs by the actor ID. This can be either the Account ID or User ID. Link to this property

Link to this property

actor\_ip\_address?: ActorIPAddress Query param

not?: Array<string> Filters out audit logs IP address where the action was initiated. Link to this property

Link to this property

actor\_token\_id?: ActorTokenID Query param

not?: Array<string> Filters out audit logs by the API token ID when the actor context is an api\_token or oauth. Link to this property

Link to this property

actor\_token\_name?: ActorTokenName Query param

not?: Array<string> Filters out audit logs by the API token name when the actor context is an api\_token or oauth. Link to this property

Link to this property

actor\_type?: ActorType Query param

not?: Array<"account"| "cloudflare\_admin"| "delegated\_service"| 2 more> Filters out audit logs by the actor type.

One of the following: "account" Link to this property "cloudflare\_admin" Link to this property "delegated\_service" Link to this property "system" Link to this property "user" Link to this property

Link to this property

audit\_log\_id?: AuditLogID Query param

Deprecatednot?: Array<string> Filters out audit logs by their IDs. Link to this property

Link to this property cursor?: string Query param: The cursor is an opaque token used to paginate through large sets of records. It indicates the position from which to continue when requesting the next set of records. A valid cursor value can be obtained from the cursor object in the result\_info structure of a previous response. Link to this property

direction?: "desc"| "asc" Query param: Sets sorting order.

One of the following: "desc" Link to this property "asc" Link to this property

Link to this property limit?: number Query param: The number limits the objects to return. The cursor attribute may be used to iterate over the next batch of objects if there are more than the limit. maximum1000 minimum1 Link to this property product\_category?: Array<string> Query param: Filters audit logs by one or more predefined product categories. Each product category expands into a curated set of resource\_product values and is unioned with any explicit resource\_product filter. Matched case-insensitively; unknown product categories return 400. Repeatable. Use the audit log product categories endpoint to discover the available values. Link to this property

raw\_cf\_ray\_id?: RawCfRayID Query param

not?: Array<string> Filters out audit logs by the response CF Ray ID. Link to this property

Link to this property

raw\_method?: RawMethod Query param

not?: Array<string> Filters out audit logs by the HTTP method for the API call. Link to this property

Link to this property

raw\_status\_code?: RawStatusCode Query param

not?: Array<number> Filters out audit logs by the response status code that was returned. Link to this property

Link to this property

raw\_uri?: RawURI Query param

not?: Array<string> Filters out audit logs by the request URI. Link to this property

Link to this property

resource\_id?: ResourceID Query param

not?: Array<string> Filters out audit logs by the resource ID. Link to this property

Link to this property

resource\_product?: ResourceProduct Query param

not?: Array<string> Filters out audit logs by the Cloudflare product associated with the changed resource. Link to this property

Link to this property

resource\_scope?: ResourceScope Query param

not?: Array<"accounts"| "user"| "zones"| "memberships"> Filters out audit logs by the resource scope, specifying whether the resource is associated with an user, an account, a zone, or a membership.

One of the following: "accounts" Link to this property "user" Link to this property "zones" Link to this property "memberships" Link to this property

Link to this property

resource\_type?: ResourceType Query param

not?: Array<string> Filters out audit logs based on the unique type of resource changed by the action. Link to this property

Link to this property

zone\_id?: ZoneID Query param

not?: Array<string> Filters out audit logs by the zone ID. Link to this property

Link to this property

zone\_name?: ZoneName Query param

not?: Array<string> Filters out audit logs by the zone name associated with the change. Link to this property

Link to this property

[Link to this property](<#(resource)%20accounts.logs.audit%20%3E%20(method)%20list%20%3E%20(params)%20default>) ##### ReturnsExpand Collapse

AuditListResponse {id, account, action, 4 more }

id?: string A unique identifier for the audit log entry. maxLength32 Link to this property

account?: Account {id, name } Contains account related information.

id?: string A unique identifier for the account. Link to this property name?: string A string that identifies the account name. Link to this property

Link to this property

action?: Action {description, result, time, type } Provides information about the action performed.

description?: string A short description of the action performed. Link to this property result?: string The result of the action, indicating success or failure. Link to this property time?: string A timestamp indicating when the action was logged. formatdate-time Link to this property type?: string A short string that describes the action that was performed. Link to this property

Link to this property

actor?: Actor {id, context, email, 4 more } Provides details about the actor who performed the action.

id?: string The ID of the actor who performed the action. If a user performed the action, this will be their User ID. Link to this property

context?: "api"| "api\_key"| "api\_token"| 3 more The context in which the action was initiated. - api: The action was performed through the API. The specific credential type was not recorded. - api_key: The action was authenticated with a Cloudflare Global API Key. - api_token: The action was authenticated with an API token. - dash: The action was performed through the Cloudflare dashboard. - oauth: The action was authenticated with an OAuth token. - origin_ca_key: The action was authenticated with an Origin CA key.

Link to this property email?: string The email of the actor who performed the action. formatemail Link to this property ip\_address?: string The IP address of the request that performed the action. Link to this property token\_id?: string The API token ID when the actor context is an api\_token or oauth. Link to this property token\_name?: string The API token name when the actor context is an api\_token or oauth. Link to this property

type?: "account"| "cloudflare\_admin"| "delegated\_service"| 2 more The type of actor.

One of the following: "account" Link to this property "cloudflare\_admin" Link to this property "delegated\_service" Link to this property "system" Link to this property "user" Link to this property

Link to this property

raw?: Raw {cf\_ray\_id, method, status\_code, 2 more } Provides raw information about the request and response.

cf\_ray\_id?: string The Cloudflare Ray ID for the request. Link to this property method?: string The HTTP method of the request. Link to this property status\_code?: number The HTTP response status code returned by the API. Link to this property uri?: string The URI of the request. Link to this property user\_agent?: string The client’s user agent string sent with the request. Link to this property

Link to this property

resource?: Resource {id, product, request, 3 more } Provides details about the affected resource.

id?: string The unique identifier for the affected resource. Link to this property product?: string The Cloudflare product associated with the resource. Link to this property request?: unknown Link to this property response?: unknown Link to this property scope?: unknown The scope of the resource. Link to this property type?: string The type of the resource. Link to this property

Link to this property

zone?: Zone {id, name } Provides details about the zone affected by the action.

id?: string A string that identifies the zone id. Link to this property name?: string A string that identifies the zone name. Link to this property

Link to this property

[Link to this property](<#(resource)%20accounts.logs.audit%20%3E%20(model)%20audit_list_response%20%3E%20(schema)>) ### Get account audit logs (Version 2) TypeScript HTTPTypeScriptPythonGoTerraform ``` import Cloudflare from 'cloudflare'; const client = new Cloudflare({ apiToken: process.env['CLOUDFLARE_API_TOKEN'], // This is the default and can be omitted }); // Automatically fetches more pages as needed. for await (const auditListResponse of client.accounts.logs.audit.list({ account_id: 'a67e14daa5f8dceeb91fe5449ba496ef', before: '2024-10-31', since: '2024-10-30', })) { console.log(auditListResponse.id); } ``` 200 example ``` { "errors": [ { "message": "message" } ], "result": [ { "id": "023e105f4ecef8ad9ca31a8372d0c353", "account": { "id": "4bb334f7c94c4a29a045f03944f072e5", "name": "Example Account" }, "action": { "description": "Add Member", "result": "success", "time": "2024-04-26T17:31:07Z", "type": "create" }, "actor": { "id": "f6b5de0326bb5182b8a4840ee01ec774", "context": "dash", "email": "alice@example.com", "ip_address": "198.41.129.166", "token_id": "token_id", "token_name": "token_name", "type": "user" }, "raw": { "cf_ray_id": "8e9b1c60ef9e1c9a", "method": "POST", "status_code": 200, "uri": "/accounts/4bb334f7c94c4a29a045f03944f072e5/members", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Safari/605.1.15" }, "resource": { "id": "id", "product": "members", "request": {}, "response": {}, "scope": {}, "type": "type" }, "zone": { "id": "id", "name": "example.com" } } ], "result_info": { "count": "1", "cursor": "ASqdKd7dKgxh-aZ8bm0mZos1BtW4BdEqifCzNkEeGRzi_5SN_-362Y8sF-C1TRn60_6rd3z2dIajf9EAPyQ_NmIeAMkacmaJPXipqvP7PLU4t72wyqBeJfjmjdE=" }, "success": true } ``` ##### Returns Examples 200 example ``` { "errors": [ { "message": "message" } ], "result": [ { "id": "023e105f4ecef8ad9ca31a8372d0c353", "account": { "id": "4bb334f7c94c4a29a045f03944f072e5", "name": "Example Account" }, "action": { "description": "Add Member", "result": "success", "time": "2024-04-26T17:31:07Z", "type": "create" }, "actor": { "id": "f6b5de0326bb5182b8a4840ee01ec774", "context": "dash", "email": "alice@example.com", "ip_address": "198.41.129.166", "token_id": "token_id", "token_name": "token_name", "type": "user" }, "raw": { "cf_ray_id": "8e9b1c60ef9e1c9a", "method": "POST", "status_code": 200, "uri": "/accounts/4bb334f7c94c4a29a045f03944f072e5/members", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Safari/605.1.15" }, "resource": { "id": "id", "product": "members", "request": {}, "response": {}, "scope": {}, "type": "type" }, "zone": { "id": "id", "name": "example.com" } } ], "result_info": { "count": "1", "cursor": "ASqdKd7dKgxh-aZ8bm0mZos1BtW4BdEqifCzNkEeGRzi_5SN_-362Y8sF-C1TRn60_6rd3z2dIajf9EAPyQ_NmIeAMkacmaJPXipqvP7PLU4t72wyqBeJfjmjdE=" }, "success": true } ```