Audit log

Search audit log entries

For the complete documentation index, see llms.txt. For the full documentation snapshot, see llms-full.txt.

Search your audit log entries. The query parameters let you restrict the results that return by date ranges, or a full-text search query. The request body lets you restrict the results that return by resource specifiers.

LaunchDarkly uses a resource specifier syntax to name resources or collections of resources. To learn more, read About the resource specifier syntax.

POST

api

auditlog

Search audit log entries

curl --request POST \
  --url https://app.launchdarkly.com/api/v2/auditlog \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '
[
  {
    "effect": "allow",
    "resources": [
      "proj/*:env/*:flag/*;testing-tag"
    ],
    "notResources": [
      "<string>"
    ],
    "actions": [
      "*"
    ],
    "notActions": [
      "<string>"
    ]
  }
]
'

import requests

url = "https://app.launchdarkly.com/api/v2/auditlog"

payload = [
    {
        "effect": "allow",
        "resources": ["proj/*:env/*:flag/*;testing-tag"],
        "notResources": ["<string>"],
        "actions": ["*"],
        "notActions": ["<string>"]
    }
]
headers = {
    "Authorization": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify([
    {
      effect: 'allow',
      resources: ['proj/*:env/*:flag/*;testing-tag'],
      notResources: ['<string>'],
      actions: ['*'],
      notActions: ['<string>']
    }
  ])
};

fetch('https://app.launchdarkly.com/api/v2/auditlog', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.launchdarkly.com/api/v2/auditlog",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    [
        'effect' => 'allow',
        'resources' => [
                'proj/*:env/*:flag/*;testing-tag'
        ],
        'notResources' => [
                '<string>'
        ],
        'actions' => [
                '*'
        ],
        'notActions' => [
                '<string>'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.launchdarkly.com/api/v2/auditlog"

	payload := strings.NewReader("[\n  {\n    \"effect\": \"allow\",\n    \"resources\": [\n      \"proj/*:env/*:flag/*;testing-tag\"\n    ],\n    \"notResources\": [\n      \"<string>\"\n    ],\n    \"actions\": [\n      \"*\"\n    ],\n    \"notActions\": [\n      \"<string>\"\n    ]\n  }\n]")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://app.launchdarkly.com/api/v2/auditlog")
  .header("Authorization", "<api-key>")
  .header("Content-Type", "application/json")
  .body("[\n  {\n    \"effect\": \"allow\",\n    \"resources\": [\n      \"proj/*:env/*:flag/*;testing-tag\"\n    ],\n    \"notResources\": [\n      \"<string>\"\n    ],\n    \"actions\": [\n      \"*\"\n    ],\n    \"notActions\": [\n      \"<string>\"\n    ]\n  }\n]")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.launchdarkly.com/api/v2/auditlog")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "[\n  {\n    \"effect\": \"allow\",\n    \"resources\": [\n      \"proj/*:env/*:flag/*;testing-tag\"\n    ],\n    \"notResources\": [\n      \"<string>\"\n    ],\n    \"actions\": [\n      \"*\"\n    ],\n    \"notActions\": [\n      \"<string>\"\n    ]\n  }\n]"

response = http.request(request)
puts response.read_body

{
  "items": [
    {
      "_links": {},
      "_id": "1234a56b7c89d012345e678f",
      "_accountId": "1234a56b7c89d012345e678f",
      "date": "1654104600000",
      "accesses": [
        {
          "action": "<string>",
          "resource": "<string>"
        }
      ],
      "kind": "flag",
      "name": "Example feature flag",
      "description": "Example, turning on the flag for testing",
      "shortDescription": "Example, turning on the flag",
      "comment": "This is an automated test",
      "subject": {
        "_links": {},
        "name": "<string>",
        "avatarUrl": "<string>"
      },
      "member": {
        "_links": {},
        "_id": "507f1f77bcf86cd799439011",
        "email": "ariel@acme.com",
        "firstName": "Ariel",
        "lastName": "Flores"
      },
      "token": {
        "_links": {},
        "_id": "<string>",
        "name": "DevOps token",
        "ending": "2345",
        "serviceToken": false
      },
      "app": {
        "_links": {},
        "_id": "<string>",
        "isScim": true,
        "name": "<string>",
        "maintainerName": "<string>"
      },
      "titleVerb": "turned on the flag",
      "title": "<string>",
      "target": "[Ariel Flores](mailto:ariel@acme.com) turned on the flag [example-flag](https://app.launchdarkly.com/example-project/production/features/example-flag) in Production",
      "parent": {
        "_links": {},
        "name": "<string>",
        "resource": "<string>"
      }
    }
  ],
  "_links": {}
}

{
  "code": "invalid_request",
  "message": "Invalid request body"
}

{
  "code": "unauthorized",
  "message": "Invalid access token"
}

{
  "code": "forbidden",
  "message": "Forbidden. Access to the requested resource was denied."
}

{
  "code": "rate_limited",
  "message": "You've exceeded the API rate limit. Try again later."
}

Authorizations

Authorization

string

header

required

Query Parameters

before

integer<int64>

A timestamp filter, expressed as a Unix epoch time in milliseconds. All entries returned occurred before the timestamp.

after

integer<int64>

A timestamp filter, expressed as a Unix epoch time in milliseconds. All entries returned occurred after the timestamp.

string<string>

Text to search for. You can search for the full or partial name of the resource.

limit

integer<int64>

A limit on the number of audit log entries that return. Set between 1 and 20. The default is 10.

Body

application/json

effect

enum<string>

required

Whether this statement should allow or deny actions on the resources.

Available options:

allow,

deny

Example:

"allow"

resources

string[]

Resource specifier strings

Example:

["proj/*:env/*:flag/*;testing-tag"]

notResources

string[]

Targeted resources are the resources NOT in this list. The resources field must be empty to use this field.

actions

string[]

Actions to perform on a resource

Example:

["*"]

notActions

string[]

Targeted actions are the actions NOT in this list. The actions field must be empty to use this field.

Response

Audit log entries response

items

object[]

required

An array of audit log entries

Show child attributes

_links

object

required

The location and content type of related resources

Show child attributes

⌘I

Search audit log entries

curl --request POST \
  --url https://app.launchdarkly.com/api/v2/auditlog \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '
[
  {
    "effect": "allow",
    "resources": [
      "proj/*:env/*:flag/*;testing-tag"
    ],
    "notResources": [
      "<string>"
    ],
    "actions": [
      "*"
    ],
    "notActions": [
      "<string>"
    ]
  }
]
'

import requests

url = "https://app.launchdarkly.com/api/v2/auditlog"

payload = [
    {
        "effect": "allow",
        "resources": ["proj/*:env/*:flag/*;testing-tag"],
        "notResources": ["<string>"],
        "actions": ["*"],
        "notActions": ["<string>"]
    }
]
headers = {
    "Authorization": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify([
    {
      effect: 'allow',
      resources: ['proj/*:env/*:flag/*;testing-tag'],
      notResources: ['<string>'],
      actions: ['*'],
      notActions: ['<string>']
    }
  ])
};

fetch('https://app.launchdarkly.com/api/v2/auditlog', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://app.launchdarkly.com/api/v2/auditlog",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    [
        'effect' => 'allow',
        'resources' => [
                'proj/*:env/*:flag/*;testing-tag'
        ],
        'notResources' => [
                '<string>'
        ],
        'actions' => [
                '*'
        ],
        'notActions' => [
                '<string>'
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: <api-key>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://app.launchdarkly.com/api/v2/auditlog"

	payload := strings.NewReader("[\n  {\n    \"effect\": \"allow\",\n    \"resources\": [\n      \"proj/*:env/*:flag/*;testing-tag\"\n    ],\n    \"notResources\": [\n      \"<string>\"\n    ],\n    \"actions\": [\n      \"*\"\n    ],\n    \"notActions\": [\n      \"<string>\"\n    ]\n  }\n]")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://app.launchdarkly.com/api/v2/auditlog")
  .header("Authorization", "<api-key>")
  .header("Content-Type", "application/json")
  .body("[\n  {\n    \"effect\": \"allow\",\n    \"resources\": [\n      \"proj/*:env/*:flag/*;testing-tag\"\n    ],\n    \"notResources\": [\n      \"<string>\"\n    ],\n    \"actions\": [\n      \"*\"\n    ],\n    \"notActions\": [\n      \"<string>\"\n    ]\n  }\n]")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://app.launchdarkly.com/api/v2/auditlog")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "[\n  {\n    \"effect\": \"allow\",\n    \"resources\": [\n      \"proj/*:env/*:flag/*;testing-tag\"\n    ],\n    \"notResources\": [\n      \"<string>\"\n    ],\n    \"actions\": [\n      \"*\"\n    ],\n    \"notActions\": [\n      \"<string>\"\n    ]\n  }\n]"

response = http.request(request)
puts response.read_body

{
  "items": [
    {
      "_links": {},
      "_id": "1234a56b7c89d012345e678f",
      "_accountId": "1234a56b7c89d012345e678f",
      "date": "1654104600000",
      "accesses": [
        {
          "action": "<string>",
          "resource": "<string>"
        }
      ],
      "kind": "flag",
      "name": "Example feature flag",
      "description": "Example, turning on the flag for testing",
      "shortDescription": "Example, turning on the flag",
      "comment": "This is an automated test",
      "subject": {
        "_links": {},
        "name": "<string>",
        "avatarUrl": "<string>"
      },
      "member": {
        "_links": {},
        "_id": "507f1f77bcf86cd799439011",
        "email": "ariel@acme.com",
        "firstName": "Ariel",
        "lastName": "Flores"
      },
      "token": {
        "_links": {},
        "_id": "<string>",
        "name": "DevOps token",
        "ending": "2345",
        "serviceToken": false
      },
      "app": {
        "_links": {},
        "_id": "<string>",
        "isScim": true,
        "name": "<string>",
        "maintainerName": "<string>"
      },
      "titleVerb": "turned on the flag",
      "title": "<string>",
      "target": "[Ariel Flores](mailto:ariel@acme.com) turned on the flag [example-flag](https://app.launchdarkly.com/example-project/production/features/example-flag) in Production",
      "parent": {
        "_links": {},
        "name": "<string>",
        "resource": "<string>"
      }
    }
  ],
  "_links": {}
}

{
  "code": "invalid_request",
  "message": "Invalid request body"
}

{
  "code": "unauthorized",
  "message": "Invalid access token"
}

{
  "code": "forbidden",
  "message": "Forbidden. Access to the requested resource was denied."
}

{
  "code": "rate_limited",
  "message": "You've exceeded the API rate limit. Try again later."
}