Search audit log entries

For the complete documentation index, see llms.txt. For the full documentation snapshot, see llms-full.txt.

Search your audit log entries. The query parameters let you restrict the results that return by date ranges, or a full-text search query. The request body lets you restrict the results that return by resource specifiers.

LaunchDarkly uses a resource specifier syntax to name resources or collections of resources. To learn more, read About the resource specifier syntax.

POST /api/v2/auditlog

Search audit log entries

cURL

curl --request POST \
  --url https://app.launchdarkly.com/api/v2/auditlog \
  --header 'Authorization: <api-key>' \
  --header 'Content-Type: application/json' \
  --data '
[
  {
    "effect": "allow",
    "resources": [
      "proj/*:env/*:flag/*;testing-tag"
    ],
    "notResources": [
      "<string>"
    ],
    "actions": [
      "*"
    ],
    "notActions": [
      "<string>"
    ]
  }
]
'

200

{
  "items": [
    {
      "_links": {},
      "_id": "1234a56b7c89d012345e678f",
      "_accountId": "1234a56b7c89d012345e678f",
      "date": "1654104600000",
      "accesses": [
        {
          "action": "<string>",
          "resource": "<string>"
        }
      ],
      "kind": "flag",
      "name": "Example feature flag",
      "description": "Example, turning on the flag for testing",
      "shortDescription": "Example, turning on the flag",
      "comment": "This is an automated test",
      "subject": {
        "_links": {},
        "name": "<string>",
        "avatarUrl": "<string>"
      },
      "member": {
        "_links": {},
        "_id": "507f1f77bcf86cd799439011",
        "email": "[e-mail]",
        "firstName": "Ariel",
        "lastName": "Flores"
      },
      "token": {
        "_links": {},
        "_id": "<string>",
        "name": "DevOps token",
        "ending": "2345",
        "serviceToken": false
      },
      "app": {
        "_links": {},
        "_id": "<string>",
        "isScim": true,
        "name": "<string>",
        "maintainerName": "<string>"
      },
      "titleVerb": "turned on the flag",
      "title": "<string>",
      "target": "[Ariel Flores](mailto:[e-mail]) turned on the flag [example-flag](https://app.launchdarkly.com/example-project/production/features/example-flag) in Production",
      "parent": {
        "_links": {},
        "name": "<string>",
        "resource": "<string>"
      }
    }
  ],
  "_links": {}
}

Authorizations

Authorization · string · header · required

Query Parameters

before · integer<int64>

A timestamp filter, expressed as a Unix epoch time in milliseconds. All entries returned occurred before the timestamp.

after · integer<int64>

A timestamp filter, expressed as a Unix epoch time in milliseconds. All entries returned occurred after the timestamp.

q · string<string>

Text to search for. You can search for the full or partial name of the resource.

limit · integer<int64>

A limit on the number of audit log entries that return. Set between 1 and 20. The default is 10.

Body

application/json

effect · enum<string> · required

Whether this statement should allow or deny actions on the resources.

Available options: allow, deny

Example:

"allow"

resources · string[]

Resource specifier strings

Example:

["proj/*:env/*:flag/*;testing-tag"]

notResources · string[]

Targeted resources are the resources NOT in this list. The resources field must be empty to use this field.

actions · string[]

Actions to perform on a resource

Example:

["*"]

notActions · string[]

Targeted actions are the actions NOT in this list. The actions field must be empty to use this field.

Response

200

application/json

Audit log entries response

items · object[] · required

An array of audit log entries

Show child attributes

_links · object · required

The location and content type of related resources

Show child attributes