Skip to content
Authrim

List admin audit log entries

GET
/api/admin/admin-audit-log
Code sample: Shell / cURL 
curl --request GET \
  --url 'https://auth.example.com/api/admin/admin-audit-log?page=1&limit=50&result=success&severity=debug' \
  --header 'Authorization: Bearer <token>'

Lists admin audit log entries from the authorized Iceberg view with pagination and filters for actor, action, resource type, result, severity, and date range. Retained whole-row archives are included in supported log queries. A bounded query that cannot read its required rows returns log_query_incomplete instead of partial statistics or an empty success.

Authorizations

Section titled “Authorizations ”

Parameters

Section titled “ Parameters ”

Query Parameters

Section titled “Query Parameters ”
page
integer
default: 1 >= 1

Page number.

limit
integer
default: 50 >= 1 <= 100

Page size.

admin_user_id
string

Filter by admin user id.

action
string

Filter by action.

resource_type
string

Filter by resource type.

result
string
Allowed values: success failure

Filter by result.

severity
string
Allowed values: debug info warn error critical

Filter by severity.

start_date
string

Inclusive start date or timestamp.

end_date
string

Inclusive end date or timestamp.

cursor
string
<= 4096 characters

Cursor returned by a previous response for this tenant and these filters. Start with page 1; log lists use cursors instead of page numbers.

resource_id
string

Filter by the exact resource ID together with resource_type.

Responses

Section titled “ Responses ”

200

Section titled “200 ”

Successful JSON response.

Media type application/json
One of:
object
coverage
object
consistency
required
string
Allowed values: snapshot eventual local_hot_only
pending_deliveries
required

Null for self-service subjects that cannot inspect tenant delivery counts.

integer | null
complete
required

Pipeline and local staging-only views remain false even when no pending deliveries are known.

boolean
key
additional properties
items
required
Array<object>
object
id
string
tenant_id
string
admin_user_id
string
admin_email
string
admin_user_name
string | null
actor_type
string
actor_id
string
actor_display_name
string
action
string
resource_type
string
resource_id
string
result
string
Allowed values: success failure
severity
string
Allowed values: debug info warn error critical
metadata
object
key
additional properties
before
object
key
additional properties
after
object
key
additional properties
created_at
integer
key
additional properties
total
required
integer
page
required
integer
limit
required
integer
totalPages
required
integer
key
additional properties
Example 
{
  "items": [
    {
      "id": "audit_123",
      "tenant_id": "tenant_123",
      "admin_user_id": "admin_123",
      "admin_email": "admin@example.com",
      "action": "admin_policy.create",
      "resource_type": "admin_policy",
      "resource_id": "policy_123",
      "result": "success",
      "severity": "info",
      "metadata": {},
      "created_at": 1770000000000,
      "admin_user_name": "Admin User",
      "actor_type": "admin_user",
      "actor_id": "admin_123",
      "actor_display_name": "Admin User"
    }
  ],
  "total": 1,
  "page": 1,
  "limit": 50,
  "totalPages": 1
}

Headers

Section titled “Headers ”
X-Authrim-Log-Consistency
string
Allowed values: snapshot eventual local_hot_only

Snapshot for the remote scheduled view; eventual when Pipeline visibility can lag ingestion; local_hot_only for local scheduled staging without a remote Catalog.

X-Authrim-Log-Pending-Deliveries
integer

Tenant deliveries not yet confirmed visible. Omitted for self-service subjects. Zero does not guarantee immediate Pipeline visibility.

X-Authrim-Log-Complete
boolean

True only for a complete bounded snapshot query. Pipeline responses remain false; incomplete reads return 503.

400

Section titled “400 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

401

Section titled “401 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

403

Section titled “403 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

500

Section titled “500 ”

Error response.

Media type application/json
object
error
string
message
string
error_description
string
key
additional properties
Example generated
{
  "error": "example",
  "message": "example",
  "error_description": "example"
}

503

Section titled “503 ”

The retained log query is incomplete. No partial entries or statistics are returned as a successful result. Narrow the period or retry.

Media type application/json
object
error
required
string
Allowed value: log_query_incomplete
error_description
required
string
complete
required
boolean
key
additional properties
Example 
{
  "error": "log_query_incomplete",
  "complete": false
}