Skip to main content
GET
Retrieve audit logs

Authorizations

Authorization
string
header
required

All requests to the Cortex API need to provide an Authorization: Bearer <token> header, where <token> is an API key created in the Settings page of your workspace.

Query Parameters

startTime
string<date-time>
endTime
string<date-time>
page
integer<int32>
default:0
required

Page number to return, 0-indexed. Default 0.

pageSize
integer<int32>
default:250
required

Number of results to return per page, between 1 and 1000. Default 250.

actions
enum<string>[]
Available options:
CREATE,
READ,
UPDATE,
DELETE
objectIdentifiers
string[]
objectTypes
enum<string>

Filter by Cortex object types (CATALOG, SERVICE, TEAM, SCORECARD, etc), integration configurations (AWS_CONFIGURATION, BITBUCKET_CONFIGURATION, etc), and more.

Available options:
ACCOUNT_FLAG,
ACTIVE_DIRECTORY_CONFIGURATION,
ALLOW_LIST_ENTRY,
API_KEY,
APIIRO_CONFIGURATION,
ARGOCD_CONFIGURATION,
ATLASSIAN_CONFIGURATION,
AWS_CLOUD_CONTROL_TYPE_CONFIGURATION,
AWS_CONFIGURATION,
AZURE_DEVOPS_CONFIGURATION,
AZURE_RESOURCES_CONFIGURATION,
BAMBOO_HR_CONFIGURATION,
BITBUCKET_CONFIGURATION,
BITBUCKET_OAUTH_CONFIGURATION,
BITBUCKET_OAUTH_REGISTRATION,
BITBUCKET_ONPREM_CONFIGURATION,
BITBUCKET_ONPREM_WEBHOOK_SECRET,
BITBUCKET_PERSONAL_CONFIGURATION,
BITBUCKET_WORKSPACE_ACCESS_TOKEN_CONFIGURATION,
BUGSNAG_CONFIGURATION,
BUILDKITE_CONFIGURATION,
CATALOG,
CATALOG_FILTER,
CHECKMARX_SAST_CONFIGURATION,
CIRCLE_CI_CONFIGURATION,
CLICKUP_CONFIGURATION,
CODECOV_CONFIGURATION,
CORALOGIX_CONFIGURATION,
CORTEX_TEAM_ROLES,
CORTEX_USER,
CORTEX_USER_ROLES,
CUSTOM_DATA,
CUSTOM_EVENT,
CUSTOM_METRICS_CONFIGURATION,
CUSTOM_METRICS_DATA,
CUSTOM_ROLE,
CUSTOM_ROLE_PERMISSIONS,
DATADOG_CONFIGURATION,
DEPENDENCY,
DOMAIN,
DYNATRACE_CONFIGURATION,
ENGINTEL_SAVED_MODULE,
ENTITY_SIDEBAR_CONFIGURATION,
ENTITY_TYPE_DEFINITION,
ENTITY_VERIFICATION,
FIREHYDRANT_CONFIGURATION,
GITHUB_APP_CONFIGURATION,
GITHUB_APP_INSTALLATION,
GITHUB_PERSONAL_TOKEN,
GITHUB_WEBHOOK_SECRET,
GITLAB_CONFIGURATION,
GOOGLE_CONFIGURATION,
IDENTITY_MAPPING,
INCIDENT_IO_CONFIGURATION,
INITIATIVE,
INSTANA_CONFIGURATION,
INTEGRATION_INSTANCE,
JENKINS_CONFIGURATION,
JIRA_BASIC_CONFIGURATION,
JIRA_CLOUD_SCOPED_CONFIGURATION,
JIRA_CONFIGURATION,
JIRA_OAUTH_CONFIGURATION,
JIRA_OAUTH_REGISTRATION,
JIRA_ONPREM_CONFIGURATION,
LAUNCHDARKLY_CONFIGURATION,
LIGHTSTEP_CONFIGURATION,
MEND_SAST_CONFIGURATION,
MEND_SCA_CONFIGURATION,
MICROSOFT_TEAMS_CONFIGURATION,
NEWRELIC_CONFIGURATION,
OAUTH_CONFIGURATION,
OKTA_CONFIGURATION,
OPENAPI_DEFINITION,
OPSGENIE_CONFIGURATION,
PAGERDUTY_CONFIGURATION,
PERSONAL_API_KEY,
PLUGIN,
PROMETHEUS_CONFIGURATION,
RELATIONSHIP_TYPE,
RELAY_CONFIGURATION,
RESOURCE,
ROLLBAR_CONFIGURATION,
SCORECARD,
SCORECARD_FILTER,
SCORECARD_RULE,
SCORECARD_RULE_FILTER,
SECRET,
SECRET_GROUP,
SEMGREP_CONFIGURATION,
SENTRY_CONFIGURATION,
SERVICE,
SERVICENOW_CONFIGURATION,
SIGNALFX_CONFIGURATION,
SLACK_CONFIGURATION,
SNYK_CONFIGURATION,
SONARQUBE_CONFIGURATION,
SUMOLOGIC_CONFIGURATION,
TEAM,
USER_LABEL_KEY,
VERACODE_CONFIGURATION,
VERIFICATION_PERIOD,
VICTOROPS_CONFIGURATION,
WEBHOOK_CONFIGURATION,
WIZ_CONFIGURATION,
WORKDAY_CONFIGURATION,
WORKFLOW,
XMATTERS_CONFIGURATION
actorTypes
enum<string>[]
Available options:
API_KEY,
PERSONAL_API_KEY,
OAUTH2,
BACKSTAGE,
ANONYMOUS,
WORKFLOW_ACTION,
USER,
SYSTEM
actorApiKeyIdentifiers
string[]
actorEmails
string[]
actorIpAddresses
string[]
actorRequestTypes
enum<string>
Available options:
API_KEY_ENTITY,
ATLASSIAN_WEBHOOK,
SCORECARD_BADGES,
SLACK_COMMAND

Response

Successfully retrieved audit logs

logs
object[]
required
page
integer<int32>
required

Current page number, 0-indexed

total
integer<int32>
required

Total number of results

totalPages
integer<int32>
required

Total number of pages

Last modified on September 29, 2026