> This page is for Agent Handler. > For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://docs.merge.dev/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server. # List audit log events GET https://ah-api.merge.dev/api/v1/audit-log/ Retrieves a paginated list of audit log events for the organization. Events are ordered by creation time, with the most recent first. Reference: https://docs.merge.dev/merge-agent-handler/agent-handler/audit-log/audit-log-list ## Authentication - `Authorization` header (bearer token, required) — Token-based authentication with required prefix "Bearer" ## Request ### Query parameters - `created_after` (datetime, optional) — Filter events created on or after this date (ISO 8601) - `created_before` (datetime, optional) — Filter events created on or before this date (ISO 8601) - `event_type` (enum, optional) — Filter by event type - Allowed values: `ALLOWED_CALLBACK_ORIGIN_CREATED`, `ALLOWED_CALLBACK_ORIGIN_DELETED`, `API_LOGS_SEARCHED`, `API_LOG_DETAIL_VIEWED`, `APPLICATION_CREDENTIAL_CREATED`, `APPLICATION_CREDENTIAL_DELETED`, `APPLICATION_CREDENTIAL_UPDATED`, `AUDIT_LOG_EXPORTED`, `BILLING_PAYMENT_METHOD_ADDED`, `BILLING_PAYMENT_METHOD_UPDATED`, `BILLING_PLAN_CHANGED`, `BILLING_SUBSCRIPTION_CANCELLED`, `BILLING_USER_SNAPSHOT_SUBMITTED`, `CHAT_SESSION_CREATED`, `CHAT_SESSION_ENDED`, `CONNECTOR_AUTH_SCOPE_RULE_CREATED`, `CONNECTOR_AUTH_SCOPE_RULE_DELETED`, `CONNECTOR_AUTH_SCOPE_RULE_UPDATED`, `CONNECTOR_DELETED`, `CONNECTOR_IMPORTED`, `CONNECTOR_UPDATED`, `COPILOT_INTEGRATION_BOUND`, `COPILOT_INTEGRATION_REBOUND`, `COPILOT_INTEGRATION_UNBOUND`, `CREDENTIAL_CREATED`, `CREDENTIAL_DELETED`, `CREDENTIAL_EXPORTED`, `CREDENTIAL_EXPORT_FAILED`, `CREDENTIAL_EXPORT_KEY_REGISTERED`, `CREDENTIAL_EXPORT_KEY_REVOKED`, `CREDENTIAL_UPDATED`, `DEFAULT_RESOURCES_CREATED`, `DESKTOP_DEVICE_ENROLLED`, `DESKTOP_DEVICE_IDENTITY_RESOLVED`, `DESKTOP_DEVICE_RE_ENROLLED`, `DESKTOP_GATEWAY_CREDENTIAL_ISSUED`, `DESKTOP_PANEL_CONFIGURED`, `DESKTOP_TOOL_AUTH_STARTED`, `INBOUND_WEBHOOK_SETTINGS_UPDATED`, `INSIGHT_ACTION_DISMISSED`, `INSIGHT_ACTION_EXECUTED`, `LINK_CONFIGURATION_UPDATED`, `LOGIN_FAILED`, `LOGIN_SUCCESS`, `LOGOUT`, `MFA_ADMIN_RESET`, `MFA_DEVICE_CHANGED`, `MFA_DISABLED`, `MFA_ENABLED`, `MFA_REQUIRED_DISABLED`, `MFA_REQUIRED_ENABLED`, `MFA_VERIFICATION_FAILED`, `ORGANIZATION_SKILLS_SETTING_UPDATED`, `ORG_SWITCHED_TO_EMPLOYEES_PRO`, `OUTBOUND_WEBHOOK_CREATED`, `OUTBOUND_WEBHOOK_DELETED`, `OUTBOUND_WEBHOOK_UPDATED`, `OUTBOUND_WEBHOOK_VERIFICATION_KEY_REFRESHED`, `PERSONAL_ACCESS_TOKEN_GENERATED`, `PERSONAL_ACCESS_TOKEN_REVOKED`, `PERSONAL_ACCESS_TOKEN_ROTATED`, `PRODUCTION_API_KEY_CREATED`, `PRODUCTION_API_KEY_REGENERATED`, `PRODUCTION_API_KEY_REVOKED`, `REGISTERED_USER_CREATED`, `REGISTERED_USER_DELETED`, `ROLE_CREATED`, `ROLE_DELETED`, `ROLE_UPDATED`, `SCIM_DEFAULT_ACCESS_UPDATED`, `SCIM_GROUP_ACCESS_UPDATED`, `SCIM_GROUP_CREATED`, `SCIM_GROUP_DELETED`, `SCIM_GROUP_UPDATED`, `SCIM_TOKEN_CREATED`, `SCIM_TOKEN_REVOKED`, `SCIM_TOOL_ACCESS_REQUEST_APPROVED`, `SCIM_TOOL_ACCESS_REQUEST_CANCELED`, `SCIM_TOOL_ACCESS_REQUEST_CREATED`, `SCIM_TOOL_ACCESS_REQUEST_DENIED`, `SCIM_TOOL_ACCESS_REQUEST_REVOKED`, `SCIM_USER_ACCESS_UPDATED`, `SCIM_USER_DEPROVISIONED`, `SCIM_USER_PROVISIONED`, `SCIM_USER_REACTIVATED`, `SCIM_USER_UPDATED`, `SECURITY_RULE_CREATED`, `SECURITY_RULE_DELETED`, `SECURITY_RULE_UPDATED`, `SKILL_APPROVED`, `SKILL_ATTACHED_TO_TOOL_PACK`, `SKILL_DELETED`, `SKILL_DETACHED_FROM_TOOL_PACK`, `SKILL_DISABLED`, `SKILL_DRAFTED`, `SKILL_EDITED`, `SKILL_ENABLED`, `SKILL_GRANTED_TO_USER`, `SKILL_PUBLISHED`, `SKILL_REJECTED`, `SKILL_REPUBLISHED`, `SKILL_RETRIEVED`, `SKILL_REVOKED_FROM_USER`, `SKILL_SUBMITTED`, `SKILL_UNPUBLISHED`, `SKILL_VERSION_DELETED`, `SKILL_VERSION_PROMOTED`, `SSO_LOGIN_NOT_REQUIRED`, `SSO_LOGIN_REQUIRED`, `SSO_LOGIN_REQUIRED_OFF`, `SSO_LOGIN_REQUIRED_ON`, `SSO_PROVIDER_CREATED`, `SSO_PROVIDER_DELETED`, `SSO_PROVIDER_UPDATED`, `SYNCED_KNOWLEDGE_SOURCE_CONNECTED`, `SYNCED_KNOWLEDGE_SOURCE_DISCONNECTED`, `TEST_API_KEY_CREATED`, `TEST_API_KEY_DELETED`, `TEST_API_KEY_REGENERATED`, `TEST_API_KEY_REVOKED`, `TOOL_CALL_LOGS_SEARCHED`, `TOOL_CALL_LOG_DETAIL_VIEWED`, `TOOL_PACK_CREATED`, `TOOL_PACK_DELETED`, `TOOL_PACK_UPDATED`, `USER_CREATED`, `USER_DISABLED`, `USER_ENABLED`, `USER_INVITATION_ACCEPTED`, `USER_INVITATION_CANCELLED`, `USER_INVITED`, `USER_PASSWORD_RESET`, `USER_UPDATED` - `page` (integer, optional) — A page number within the paginated result set. - `page_size` (integer, optional) — Number of results to return per page. - `user_id` (string, optional) — Filter by user ID ## Response ### 200 - `count` (integer, required) - `results` (list of AuditLogEventPublic, required) - `next` (string, optional, nullable) - `previous` (string, optional, nullable) ## Types ### AuditLogEventPublic - `id` (string, required) — Unique identifier for the audit log event - `user_name` (string, required) — Name of the user who performed the action - `user_email` (string, required) — Email of the user who performed the action - `role` (string, required, nullable) — Role of the user at the time of the action - `ip_address` (string, required) — IP address from which the action was performed - `event_type` (string, required) — Type of audit event (e.g., TOOL_PACK_CREATED, USER_UPDATED) - `event_description` (string, required) — Human-readable description of the event - `created_at` (datetime, required) — Timestamp when the event occurred ## Examples **Response** ```json { "count": 123, "results": [ { "id": "b5ceea2a-7171-47ce-8090-165cfce5572c", "user_name": "Gil Feig", "user_email": "hello@merge.dev", "role": "Admin", "ip_address": "192.0.2.123", "event_type": "TOOL_PACK_CREATED", "event_description": "Created Tool Pack 'Customer Support Pack'", "created_at": "2024-01-15T10:30:00Z" } ], "next": "https://ah-api.merge.dev/api/v1/audit-log/?page=4", "previous": "https://ah-api.merge.dev/api/v1/audit-log/?page=2" } ``` **SDK Code** ```python Audit Log Event Response import requests url = "https://ah-api.merge.dev/api/v1/audit-log/" headers = {"Authorization": "Bearer "} response = requests.get(url, headers=headers) print(response.json()) ``` ```javascript Audit Log Event Response const url = 'https://ah-api.merge.dev/api/v1/audit-log/'; const options = {method: 'GET', headers: {Authorization: 'Bearer '}}; try { const response = await fetch(url, options); const data = await response.json(); console.log(data); } catch (error) { console.error(error); } ``` ```go Audit Log Event Response package main import ( "fmt" "net/http" "io" ) func main() { url := "https://ah-api.merge.dev/api/v1/audit-log/" req, _ := http.NewRequest("GET", url, nil) req.Header.Add("Authorization", "Bearer ") res, _ := http.DefaultClient.Do(req) defer res.Body.Close() body, _ := io.ReadAll(res.Body) fmt.Println(res) fmt.Println(string(body)) } ``` ```ruby Audit Log Event Response require 'uri' require 'net/http' url = URI("https://ah-api.merge.dev/api/v1/audit-log/") http = Net::HTTP.new(url.host, url.port) http.use_ssl = true request = Net::HTTP::Get.new(url) request["Authorization"] = 'Bearer ' response = http.request(request) puts response.read_body ``` ```java Audit Log Event Response import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.Unirest; HttpResponse response = Unirest.get("https://ah-api.merge.dev/api/v1/audit-log/") .header("Authorization", "Bearer ") .asString(); ``` ```php Audit Log Event Response request('GET', 'https://ah-api.merge.dev/api/v1/audit-log/', [ 'headers' => [ 'Authorization' => 'Bearer ', ], ]); echo $response->getBody(); ``` ```csharp Audit Log Event Response using RestSharp; var client = new RestClient("https://ah-api.merge.dev/api/v1/audit-log/"); var request = new RestRequest(Method.GET); request.AddHeader("Authorization", "Bearer "); IRestResponse response = client.Execute(request); ``` ```swift Audit Log Event Response import Foundation let headers = ["Authorization": "Bearer "] let request = NSMutableURLRequest(url: NSURL(string: "https://ah-api.merge.dev/api/v1/audit-log/")! as URL, cachePolicy: .useProtocolCachePolicy, timeoutInterval: 10.0) request.httpMethod = "GET" request.allHTTPHeaderFields = headers let session = URLSession.shared let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in if (error != nil) { print(error as Any) } else { let httpResponse = response as? HTTPURLResponse print(httpResponse) } }) dataTask.resume() ```