API Reference

Admin

Organization

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Audit Logs

List user actions and configuration changes within this organization.

List audit logs

admin.organization.audit_logs.list(**kwargs) -> ConversationCursorPage<AuditLogListResponse { id, effective_at, type, 49 more } >

GET/organization/audit_logs

ModelsExpand Collapse

class AuditLogListResponse { id, effective_at, type, 49 more }

A log of a user action or configuration change within this organization.

id: String

The ID of this log.

effective_at: Integer

The Unix timestamp (in seconds) of the event.

formatunixtime

type: :"api_key.created" | :"api_key.updated" | :"api_key.deleted" | 48 more

The event type.

One of the following:

:"api_key.created"

:"api_key.updated"

:"api_key.deleted"

:"certificate.created"

:"certificate.updated"

:"certificate.deleted"

:"certificates.activated"

:"certificates.deactivated"

:"checkpoint.permission.created"

:"checkpoint.permission.deleted"

:"external_key.registered"

:"external_key.removed"

:"group.created"

:"group.updated"

:"group.deleted"

:"invite.sent"

:"invite.accepted"

:"invite.deleted"

:"ip_allowlist.created"

:"ip_allowlist.updated"

:"ip_allowlist.deleted"

:"ip_allowlist.config.activated"

:"ip_allowlist.config.deactivated"

:"login.succeeded"

:"login.failed"

:"logout.succeeded"

:"logout.failed"

:"organization.updated"

:"project.created"

:"project.updated"

:"project.archived"

:"project.deleted"

:"rate_limit.updated"

:"rate_limit.deleted"

:"resource.deleted"

:"tunnel.created"

:"tunnel.updated"

:"tunnel.deleted"

:"role.created"

:"role.updated"

:"role.deleted"

:"role.assignment.created"

:"role.assignment.deleted"

:"scim.enabled"

:"scim.disabled"

:"service_account.created"

:"service_account.updated"

:"service_account.deleted"

:"user.added"

:"user.updated"

:"user.deleted"

actor: Actor{ api_key, session, type}

The actor who performed the audit logged action.

api_key: APIKey{ id, service_account, type, user}

The API Key used to perform the audit logged action.

id: String

The tracking id of the API key.

service_account: ServiceAccount{ id}

The service account that performed the audit logged action.

id: String

The service account id.

type: :user | :service_account

The type of API key. Can be either user or service_account.

One of the following:

:user

:service_account

user: User{ id, email}

The user who performed the audit logged action.

id: String

The user id.

email: String

The user email.

session: Session{ ip_address, user}

The session in which the audit logged action was performed.

ip_address: String

The IP address from which the action was performed.

user: User{ id, email}

The user who performed the audit logged action.

id: String

The user id.

email: String

The user email.

type: :session | :api_key

The type of actor. Is either session or api_key.

One of the following:

:session

:api_key

api_key_created: APIKeyCreated{ id, data}

The details for events with this type.

id: String

The tracking ID of the API key.

data: Data{ scopes}

The payload used to create the API key.

scopes: Array[String]

A list of scopes allowed for the API key, e.g. ["api.model.request"]

api_key_deleted: APIKeyDeleted{ id}

The details for events with this type.

id: String

The tracking ID of the API key.

api_key_updated: APIKeyUpdated{ id, changes_requested}

The details for events with this type.

id: String

The tracking ID of the API key.

changes_requested: ChangesRequested{ scopes}

The payload used to update the API key.

scopes: Array[String]

A list of scopes allowed for the API key, e.g. ["api.model.request"]

certificate_created: CertificateCreated{ id, name}

The details for events with this type.

id: String

The certificate ID.

name: String

The name of the certificate.

certificate_deleted: CertificateDeleted{ id, certificate, name}

The details for events with this type.

id: String

The certificate ID.

certificate: String

The certificate content in PEM format.

name: String

The name of the certificate.

certificate_updated: CertificateUpdated{ id, name}

The details for events with this type.

id: String

The certificate ID.

name: String

The name of the certificate.

certificates_activated: CertificatesActivated{ certificates}

The details for events with this type.

certificates: Array[Certificate{ id, name}]

id: String

The certificate ID.

name: String

The name of the certificate.

certificates_deactivated: CertificatesDeactivated{ certificates}

The details for events with this type.

certificates: Array[Certificate{ id, name}]

id: String

The certificate ID.

name: String

The name of the certificate.

checkpoint_permission_created: CheckpointPermissionCreated{ id, data}

The project and fine-tuned model checkpoint that the checkpoint permission was created for.

id: String

The ID of the checkpoint permission.

data: Data{ fine_tuned_model_checkpoint, project_id}

The payload used to create the checkpoint permission.

fine_tuned_model_checkpoint: String

The ID of the fine-tuned model checkpoint.

project_id: String

The ID of the project that the checkpoint permission was created for.

checkpoint_permission_deleted: CheckpointPermissionDeleted{ id}

The details for events with this type.

id: String

The ID of the checkpoint permission.

external_key_registered: ExternalKeyRegistered{ id, data}

The details for events with this type.

id: String

The ID of the external key configuration.

data: untyped

The configuration for the external key.

external_key_removed: ExternalKeyRemoved{ id}

The details for events with this type.

id: String

The ID of the external key configuration.

group_created: GroupCreated{ id, data}

The details for events with this type.

id: String

The ID of the group.

data: Data{ group_name}

Information about the created group.

group_name: String

The group name.

group_deleted: GroupDeleted{ id}

The details for events with this type.

id: String

The ID of the group.

group_updated: GroupUpdated{ id, changes_requested}

The details for events with this type.

id: String

The ID of the group.

changes_requested: ChangesRequested{ group_name}

The payload used to update the group.

group_name: String

The updated group name.

invite_accepted: InviteAccepted{ id}

The details for events with this type.

id: String

The ID of the invite.

invite_deleted: InviteDeleted{ id}

The details for events with this type.

id: String

The ID of the invite.

invite_sent: InviteSent{ id, data}

The details for events with this type.

id: String

The ID of the invite.

data: Data{ email, role}

The payload used to create the invite.

email: String

The email invited to the organization.

role: String

The role the email was invited to be. Is either owner or member.

ip_allowlist_config_activated: IPAllowlistConfigActivated{ configs}

The details for events with this type.

configs: Array[Config{ id, name}]

The configurations that were activated.

id: String

The ID of the IP allowlist configuration.

name: String

The name of the IP allowlist configuration.

ip_allowlist_config_deactivated: IPAllowlistConfigDeactivated{ configs}

The details for events with this type.

configs: Array[Config{ id, name}]

The configurations that were deactivated.

id: String

The ID of the IP allowlist configuration.

name: String

The name of the IP allowlist configuration.

ip_allowlist_created: IPAllowlistCreated{ id, allowed_ips, name}

The details for events with this type.

id: String

The ID of the IP allowlist configuration.

allowed_ips: Array[String]

The IP addresses or CIDR ranges included in the configuration.

name: String

The name of the IP allowlist configuration.

ip_allowlist_deleted: IPAllowlistDeleted{ id, allowed_ips, name}

The details for events with this type.

id: String

The ID of the IP allowlist configuration.

allowed_ips: Array[String]

The IP addresses or CIDR ranges that were in the configuration.

name: String

The name of the IP allowlist configuration.

ip_allowlist_updated: IPAllowlistUpdated{ id, allowed_ips}

The details for events with this type.

id: String

The ID of the IP allowlist configuration.

allowed_ips: Array[String]

The updated set of IP addresses or CIDR ranges in the configuration.

login_failed: LoginFailed{ error_code, error_message}

The details for events with this type.

error_code: String

The error code of the failure.

error_message: String

The error message of the failure.

login_succeeded: untyped

This event has no additional fields beyond the standard audit log attributes.

logout_failed: LogoutFailed{ error_code, error_message}

The details for events with this type.

error_code: String

The error code of the failure.

error_message: String

The error message of the failure.

logout_succeeded: untyped

This event has no additional fields beyond the standard audit log attributes.

organization_updated: OrganizationUpdated{ id, changes_requested}

The details for events with this type.

id: String

The organization ID.

changes_requested: ChangesRequested{ api_call_logging, api_call_logging_project_ids, description, 4 more}

The payload used to update the organization settings.

api_call_logging: String

How your organization logs data from supported API calls. One of disabled, enabled_per_call, enabled_for_all_projects, or enabled_for_selected_projects

api_call_logging_project_ids: String

The list of project ids if api_call_logging is set to enabled_for_selected_projects

description: String

The organization description.

name: String

The organization name.

threads_ui_visibility: String

Visibility of the threads page which shows messages created with the Assistants API and Playground. One of ANY_ROLE, OWNERS, or NONE.

title: String

The organization title.

usage_dashboard_visibility: String

Visibility of the usage dashboard which shows activity and costs for your organization. One of ANY_ROLE or OWNERS.

project: Project{ id, name}

The project that the action was scoped to. Absent for actions not scoped to projects. Note that any admin actions taken via Admin API keys are associated with the default project.

id: String

The project ID.

name: String

The project title.

project_archived: ProjectArchived{ id}

The details for events with this type.

id: String

The project ID.

project_created: ProjectCreated{ id, data}

The details for events with this type.

id: String

The project ID.

data: Data{ name, title}

The payload used to create the project.

name: String

The project name.

title: String

The title of the project as seen on the dashboard.

project_deleted: ProjectDeleted{ id}

The details for events with this type.

id: String

The project ID.

project_updated: ProjectUpdated{ id, changes_requested}

The details for events with this type.

id: String

The project ID.

changes_requested: ChangesRequested{ title}

The payload used to update the project.

title: String

The title of the project as seen on the dashboard.

rate_limit_deleted: RateLimitDeleted{ id}

The details for events with this type.

id: String

The rate limit ID

rate_limit_updated: RateLimitUpdated{ id, changes_requested}

The details for events with this type.

id: String

The rate limit ID

changes_requested: ChangesRequested{ batch_1_day_max_input_tokens, max_audio_megabytes_per_1_minute, max_images_per_1_minute, 3 more}

The payload used to update the rate limits.

batch_1_day_max_input_tokens: Integer

The maximum batch input tokens per day. Only relevant for certain models.

max_audio_megabytes_per_1_minute: Integer

The maximum audio megabytes per minute. Only relevant for certain models.

max_images_per_1_minute: Integer

The maximum images per minute. Only relevant for certain models.

max_requests_per_1_day: Integer

The maximum requests per day. Only relevant for certain models.

max_requests_per_1_minute: Integer

The maximum requests per minute.

max_tokens_per_1_minute: Integer

The maximum tokens per minute.

role_assignment_created: RoleAssignmentCreated{ id, principal_id, principal_type, 2 more}

The details for events with this type.

id: String

The identifier of the role assignment.

principal_id: String

The principal (user or group) that received the role.

principal_type: String

The type of principal (user or group) that received the role.

resource_id: String

The resource the role assignment is scoped to.

resource_type: String

The type of resource the role assignment is scoped to.

role_assignment_deleted: RoleAssignmentDeleted{ id, principal_id, principal_type, 2 more}

The details for events with this type.

id: String

The identifier of the role assignment.

principal_id: String

The principal (user or group) that had the role removed.

principal_type: String

The type of principal (user or group) that had the role removed.

resource_id: String

The resource the role assignment was scoped to.

resource_type: String

The type of resource the role assignment was scoped to.

role_created: RoleCreated{ id, permissions, resource_id, 2 more}

The details for events with this type.

id: String

The role ID.

permissions: Array[String]

The permissions granted by the role.

resource_id: String

The resource the role is scoped to.

resource_type: String

The type of resource the role belongs to.

role_name: String

The name of the role.

role_deleted: RoleDeleted{ id}

The details for events with this type.

id: String

The role ID.

role_updated: RoleUpdated{ id, changes_requested}

The details for events with this type.

id: String

The role ID.

changes_requested: ChangesRequested{ description, metadata, permissions_added, 4 more}

The payload used to update the role.

description: String

The updated role description, when provided.

metadata: untyped

Additional metadata stored on the role.

permissions_added: Array[String]

The permissions added to the role.

permissions_removed: Array[String]

The permissions removed from the role.

resource_id: String

The resource the role is scoped to.

resource_type: String

The type of resource the role belongs to.

role_name: String

The updated role name, when provided.

scim_disabled: ScimDisabled{ id}

The details for events with this type.

id: String

The ID of the SCIM was disabled for.

scim_enabled: ScimEnabled{ id}

The details for events with this type.

id: String

The ID of the SCIM was enabled for.

service_account_created: ServiceAccountCreated{ id, data}

The details for events with this type.

id: String

The service account ID.

data: Data{ role}

The payload used to create the service account.

role: String

The role of the service account. Is either owner or member.

service_account_deleted: ServiceAccountDeleted{ id}

The details for events with this type.

id: String

The service account ID.

service_account_updated: ServiceAccountUpdated{ id, changes_requested}

The details for events with this type.

id: String

The service account ID.

changes_requested: ChangesRequested{ role}

The payload used to updated the service account.

role: String

The role of the service account. Is either owner or member.

user_added: UserAdded{ id, data}

The details for events with this type.

id: String

The user ID.

data: Data{ role}

The payload used to add the user to the project.

role: String

The role of the user. Is either owner or member.

user_deleted: UserDeleted{ id}

The details for events with this type.

id: String

The user ID.

user_updated: UserUpdated{ id, changes_requested}

The details for events with this type.

id: String

The project ID.

changes_requested: ChangesRequested{ role}

The payload used to update the user.

role: String

The role of the user. Is either owner or member.