Logs

LogsAudit

Get organization audit logs (Version 2)

client.organizations.logs.audit.list(, , ?): CursorPaginationAfter<AuditListResponse { id, action, actor, 3 more } >

GET/organizations/{organization_id}/logs/audit

Get resource change history from an organization audit log entry (Version 2)

client.organizations.logs.audit.history(, , ?): AuditHistoryResponse { id, action, actor, 3 more }

GET/organizations/{organization_id}/logs/audit/{id}/history

ModelsExpand Collapse

AuditListResponse { id, action, actor, 3 more }

id?: string

A unique identifier for the audit log entry.

maxLength32

action?: Action { description, result, time, type }

Provides information about the action performed.

description?: string

A short description of the action performed.

result?: string

The result of the action, indicating success or failure.

time?: string

A timestamp indicating when the action was logged.

formatdate-time

type?: string

A short string that describes the action that was performed.

actor?: Actor { id, context, email, 4 more }

Provides details about the actor who performed the action.

id?: string

The ID of the actor who performed the action. If a user performed the action, this will be their User ID.

context?: "api" | "api_key" | "api_token" | 3 more

The context in which the action was initiated.

api: The action was performed through the API. The specific credential type was not recorded.
api_key: The action was authenticated with a Cloudflare Global API Key.
api_token: The action was authenticated with an API token.
dash: The action was performed through the Cloudflare dashboard.
oauth: The action was authenticated with an OAuth token.
origin_ca_key: The action was authenticated with an Origin CA key.

One of the following:

"api"

"api_key"

"api_token"

"dash"

"oauth"

"origin_ca_key"

email?: string

The email of the actor who performed the action.

formatemail

ip_address?: string

The IP address of the request that performed the action.

token_id?: string

The API token ID when the actor context is an api_token or oauth.

token_name?: string

The API token name when the actor context is an api_token or oauth.

type?: "cloudflare_admin" | "system" | "user"

The type of actor.

One of the following:

"cloudflare_admin"

"system"

"user"

organization?: Organization { id }

Contains organization related information.

id?: string

A unique identifier for the organization.

raw?: Raw { cf_ray_id, method, status_code, 2 more }

Provides raw information about the request and response.

cf_ray_id?: string

The Cloudflare Ray ID for the request.

method?: string

The HTTP method of the request.

status_code?: number

The HTTP response status code returned by the API.

uri?: string

The URI of the request.

user_agent?: string

The client’s user agent string sent with the request.

resource?: Resource { id, product, request, 3 more }

Provides details about the affected resource.

id?: string

The unique identifier for the affected resource.

product?: string

The Cloudflare product associated with the resource.

request?: unknown

response?: unknown

scope?: unknown

The scope of the resource.

type?: string

The type of the resource.

AuditHistoryResponse = Array<AuditHistoryResponseItem>

id?: string

A unique identifier for the audit log entry.

maxLength32

action?: Action { description, result, time, type }

Provides information about the action performed.

description?: string

A short description of the action performed.

result?: string

The result of the action, indicating success or failure.

time?: string

A timestamp indicating when the action was logged.

formatdate-time

type?: string

A short string that describes the action that was performed.

actor?: Actor { id, context, email, 4 more }

Provides details about the actor who performed the action.

id?: string

The ID of the actor who performed the action. If a user performed the action, this will be their User ID.

context?: "api" | "api_key" | "api_token" | 3 more

The context in which the action was initiated.

api: The action was performed through the API. The specific credential type was not recorded.
api_key: The action was authenticated with a Cloudflare Global API Key.
api_token: The action was authenticated with an API token.
dash: The action was performed through the Cloudflare dashboard.
oauth: The action was authenticated with an OAuth token.
origin_ca_key: The action was authenticated with an Origin CA key.

One of the following:

"api"

"api_key"

"api_token"

"dash"

"oauth"

"origin_ca_key"

email?: string

The email of the actor who performed the action.

formatemail

ip_address?: string

The IP address of the request that performed the action.

token_id?: string

The API token ID when the actor context is an api_token or oauth.

token_name?: string

The API token name when the actor context is an api_token or oauth.

type?: "cloudflare_admin" | "system" | "user"

The type of actor.

One of the following:

"cloudflare_admin"

"system"

"user"

organization?: Organization { id }

Contains organization related information.

id?: string

A unique identifier for the organization.

raw?: Raw { cf_ray_id, method, status_code, 2 more }

Provides raw information about the request and response.

cf_ray_id?: string

The Cloudflare Ray ID for the request.

method?: string

The HTTP method of the request.

status_code?: number

The HTTP response status code returned by the API.

uri?: string

The URI of the request.

user_agent?: string

The client’s user agent string sent with the request.

resource?: Resource { id, product, request, 3 more }

Provides details about the affected resource.

id?: string

The unique identifier for the affected resource.

product?: string

The Cloudflare product associated with the resource.

request?: unknown

response?: unknown

scope?: unknown

The scope of the resource.

type?: string

The type of the resource.