> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threetone.in/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Workspace Audit Logs

> Returns the audit log for the workspace. Requires enterprise tier and the audit_log_read permission.



## OpenAPI

````yaml /api-reference/openapi.json get /v1/workspace/audit-logs
openapi: 3.1.0
info:
  title: Threetone API Documentation
  description: >-
    This is the documentation for the Threetone API. You can use this API to use
    our service programmatically with API keys sent in the x-api-key header. You
    can create and manage API keys in the dashboard at
    https://threetone.in/app/developers/api-keys.
  version: '1.0'
servers:
  - url: https://api.threetone.in
    description: Production
security: []
paths:
  /v1/workspace/audit-logs:
    get:
      tags:
        - workspace
      summary: Get Workspace Audit Logs
      description: >-
        Returns the audit log for the workspace. Requires enterprise tier and
        the audit_log_read permission.
      operationId: get_workspace_audit_logs
      parameters:
        - name: limit
          in: query
          required: false
          schema:
            type: integer
            maximum: 100
            minimum: 1
            description: Maximum number of entries per page
            default: 50
            title: Limit
          description: Maximum number of entries per page
        - name: cursor
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Cursor for the next page (from previous response)
            title: Cursor
          description: Cursor for the next page (from previous response)
        - name: time_from_unix_ms
          in: query
          required: false
          schema:
            anyOf:
              - type: integer
              - type: 'null'
            description: Only include entries at or after this time (ms since epoch)
            title: Time From Unix Ms
          description: Only include entries at or after this time (ms since epoch)
        - name: time_to_unix_ms
          in: query
          required: false
          schema:
            anyOf:
              - type: integer
              - type: 'null'
            description: Only include entries at or before this time (ms since epoch)
            title: Time To Unix Ms
          description: Only include entries at or before this time (ms since epoch)
        - name: actor_uid
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Filter by actor user ID
            title: Actor Uid
          description: Filter by actor user ID
        - name: class_name
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Filter by OCSF event class name (e.g. Account Change)
            title: Class Name
          description: Filter by OCSF event class name (e.g. Account Change)
        - name: activity_name
          in: query
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: Filter by audit activity name (e.g. Subscription Creation)
            title: Activity Name
          description: Filter by audit activity name (e.g. Subscription Creation)
        - name: x-api-key
          in: header
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            description: >-
              Your API key for programmatic access. Send it in the x-api-key
              header; you can create and manage keys from the Developers page.
            title: X-Api-Key
          description: >-
            Your API key for programmatic access. Send it in the x-api-key
            header; you can create and manage keys from the Developers page.
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WorkspaceAuditLogsPageResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    WorkspaceAuditLogsPageResponse:
      properties:
        entries:
          items:
            $ref: '#/components/schemas/WorkspaceAuditLogEntryResponse'
          type: array
          title: Entries
        has_more:
          type: boolean
          title: Has More
        next_cursor:
          anyOf:
            - type: string
            - type: 'null'
          title: Next Cursor
      type: object
      required:
        - entries
        - has_more
        - next_cursor
      title: WorkspaceAuditLogsPageResponse
      description: Paginated workspace audit log response.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    WorkspaceAuditLogEntryResponse:
      properties:
        metadata:
          additionalProperties: true
          type: object
          title: Metadata
          description: Event metadata
        time:
          type: integer
          title: Time
          description: Event time in milliseconds since epoch
        activity_id:
          anyOf:
            - $ref: '#/components/schemas/AccountChangeActivityId'
            - $ref: '#/components/schemas/AuthenticationActivityId'
            - $ref: '#/components/schemas/EntityManagementActivityId'
            - $ref: '#/components/schemas/UserAccessManagementActivityId'
            - $ref: '#/components/schemas/GroupManagementActivityId'
          title: Activity Id
          description: Activity ID
        activity_name:
          type: string
          title: Activity Name
          description: Activity name
        category_name:
          type: string
          title: Category Name
          description: Event category
          default: Identity & Access Management
        category_uid:
          type: integer
          title: Category Uid
          description: Category UID for IAM
          default: 3
        class_name:
          type: string
          title: Class Name
          description: Event class name
          default: ''
        class_uid:
          type: integer
          title: Class Uid
          description: Event class UID
          default: 0
        severity_id:
          $ref: '#/components/schemas/SeverityId'
          description: Severity level
          default: 1
        status_id:
          $ref: '#/components/schemas/StatusId'
          description: Status of the action
        actor:
          $ref: '#/components/schemas/ActorModel'
          description: Actor performing the action
        device:
          anyOf:
            - $ref: '#/components/schemas/DeviceModel'
            - type: 'null'
          description: Device information
        http_request:
          anyOf:
            - $ref: '#/components/schemas/HttpRequestModel'
            - type: 'null'
          description: HTTP request details
        message:
          type: string
          title: Message
          description: Human-readable event description
        unmapped:
          additionalProperties: true
          type: object
          title: Unmapped
          description: Attributes not mapped to OCSF
        id:
          type: string
          title: Id
          description: Firestore document ID
        time_dt:
          type: string
          title: Time Dt
          description: Event time in human-readable RFC 3339 format, derived from 'time'.
          readOnly: true
        type_uid:
          type: integer
          title: Type Uid
          description: OCSF type_uid is class_uid * 100 + activity_id.
          readOnly: true
        type_name:
          type: string
          title: Type Name
          description: OCSF type_name combines class_name and activity_name.
          readOnly: true
      type: object
      required:
        - activity_id
        - activity_name
        - status_id
        - actor
        - message
        - id
        - time_dt
        - type_uid
        - type_name
      title: WorkspaceAuditLogEntryResponse
      description: Audit log entry with Firestore document ID for API responses.
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
    AccountChangeActivityId:
      type: integer
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 7
        - 8
        - 9
        - 10
        - 11
        - 12
        - 99
      title: AccountChangeActivityId
      description: |-
        OCSF Activity IDs for Account Change [3001] events.

        Spec: https://schema.ocsf.io/1.6.0/classes/account_change
    AuthenticationActivityId:
      type: integer
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 7
        - 99
      title: AuthenticationActivityId
      description: |-
        OCSF Activity IDs for Authentication [3002] events.

        Spec: https://schema.ocsf.io/1.6.0/classes/authentication
    EntityManagementActivityId:
      type: integer
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 7
        - 8
        - 9
        - 10
        - 11
        - 12
        - 13
        - 99
      title: EntityManagementActivityId
      description: |-
        OCSF Activity IDs for Entity Management [3004] events.

        Spec: https://schema.ocsf.io/1.6.0/classes/entity_management
    UserAccessManagementActivityId:
      type: integer
      enum:
        - 0
        - 1
        - 2
        - 99
      title: UserAccessManagementActivityId
      description: |-
        OCSF Activity IDs for User Access Management [3005] events.

        Spec: https://schema.ocsf.io/1.6.0/classes/user_access_management
    GroupManagementActivityId:
      type: integer
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 7
        - 8
        - 9
        - 99
      title: GroupManagementActivityId
      description: |-
        OCSF Activity IDs for Group Management [3006] events.

        Spec: https://schema.ocsf.io/1.6.0/classes/group_management
    SeverityId:
      type: integer
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 5
        - 6
        - 99
      title: SeverityId
      description: |-
        OCSF Severity levels.

        Spec: https://schema.ocsf.io/1.6.0/objects/severity_id
    StatusId:
      type: integer
      enum:
        - 0
        - 1
        - 2
        - 99
      title: StatusId
      description: |-
        OCSF Status levels.

        Spec: https://schema.ocsf.io/1.6.0/objects/status_id
    ActorModel:
      properties:
        user:
          $ref: '#/components/schemas/UserModel'
          description: User who performed the action
        app_name:
          anyOf:
            - type: string
            - type: 'null'
          title: App Name
          description: Client application or service name
        app_uid:
          anyOf:
            - type: string
            - type: 'null'
          title: App Uid
          description: Client application unique identifier
        session:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Session
          description: Session information
      additionalProperties: false
      type: object
      required:
        - user
      title: ActorModel
      description: |-
        OCSF Actor object - describes the entity that performed the action.

        Spec: https://schema.ocsf.io/1.6.0/objects/actor
    DeviceModel:
      properties:
        ip:
          anyOf:
            - type: string
            - type: 'null'
          title: Ip
          description: IP address
        hostname:
          anyOf:
            - type: string
            - type: 'null'
          title: Hostname
          description: Device hostname
        type_id:
          type: integer
          title: Type Id
          description: Device type ID (99 = Unknown)
          default: 99
      additionalProperties: false
      type: object
      title: DeviceModel
      description: |-
        Device information.

        Spec: https://schema.ocsf.io/1.6.0/objects/device
    HttpRequestModel:
      properties:
        http_method:
          type: string
          title: Http Method
          description: HTTP method (GET, POST, etc.)
        url:
          $ref: '#/components/schemas/UrlModel'
          description: Request URL object
        user_agent:
          anyOf:
            - type: string
            - type: 'null'
          title: User Agent
          description: User agent string
        x_forwarded_for:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: X Forwarded For
          description: X-Forwarded-For header as a list
      additionalProperties: false
      type: object
      required:
        - http_method
        - url
      title: HttpRequestModel
      description: |-
        HTTP request details.

        Spec: https://schema.ocsf.io/1.6.0/objects/http_request
    UserModel:
      properties:
        name:
          anyOf:
            - type: string
            - type: 'null'
          title: Name
          description: Username
        uid:
          anyOf:
            - type: string
            - type: 'null'
          title: Uid
          description: Unique user identifier
        type_id:
          $ref: '#/components/schemas/UserTypeId'
          description: Account type identifier
          default: 1
        type:
          anyOf:
            - type: string
            - type: 'null'
          title: Type
          description: Account type description
        email_addr:
          anyOf:
            - type: string
            - type: 'null'
          title: Email Addr
          description: User email address
        full_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Full Name
          description: Full name of the user
        domain:
          anyOf:
            - type: string
            - type: 'null'
          title: Domain
          description: User's domain
      additionalProperties: false
      type: object
      title: UserModel
      description: |-
        OCSF User object.

        Spec: https://schema.ocsf.io/1.6.0/objects/user
    UrlModel:
      properties:
        url_string:
          anyOf:
            - type: string
            - type: 'null'
          title: Url String
          description: Full URL string
        scheme:
          anyOf:
            - type: string
            - type: 'null'
          title: Scheme
          description: URL scheme (e.g., https)
        hostname:
          anyOf:
            - type: string
            - type: 'null'
          title: Hostname
          description: URL hostname
        port:
          anyOf:
            - type: integer
            - type: 'null'
          title: Port
          description: URL port
        path:
          anyOf:
            - type: string
            - type: 'null'
          title: Path
          description: URL path
        query_string:
          anyOf:
            - type: string
            - type: 'null'
          title: Query String
          description: URL query string
      additionalProperties: false
      type: object
      title: UrlModel
      description: |-
        OCSF URL object.

        Spec: https://schema.ocsf.io/1.6.0/objects/url
    UserTypeId:
      type: integer
      enum:
        - 0
        - 1
        - 2
        - 3
        - 4
        - 99
      title: UserTypeId
      description: |-
        OCSF User type IDs.

        Spec: https://schema.ocsf.io/1.6.0/objects/user

````