List audit logs with filters

List audit logs with structured filters for actor, module, and event type ### Filtering Use the `filters` field to narrow results. Pass an empty array or omit the field to retrieve all records. Each filter object has the following fields: | Field | Type | Description | |---|---|---| | `attribute` | string | The field to filter on (see Supported attributes below) | | `operator` | string | Comparison operator (see Available operators below) | | `values` | array | One or more `{ "value": <scalar> }` objects | **Supported attributes** | Attribute | Typical operator | Description | |---|---|---| | `event_at` | `IS_BETWEEN` | Event timestamp. Requires exactly **two** values: `[start, end]` (both inclusive). Accepts ISO 8601 (`2024-01-01T00:00:00Z`) or date-only (`2024-01-01` — end date is automatically extended to `T23:59:59Z`). On export, defaults to the last 6 months if omitted. | | `actor_id` | `IS_ANY_OF` | Numeric user ID of the person who performed the action (the `id` field from `GET /api/v1/users`). | | `module` | `IS_ANY_OF` | Module **integer ID** (not the name). See the Module IDs reference table below. | | `event_type` | `IS_ANY_OF` | Event type **integer ID** (not the name). See the Event Type IDs reference table below. Not every event type is valid for every module — unsupported combinations return zero results. | **Available operators** | Operator | Meaning | |---|---| | `EQUALS` | Exact match | | `NOT_EQUALS` | Exclude exact match | | `IN` / `IS_ANY_OF` | Match any value in the list | | `IS_NOT_ANY_OF` | Exclude all listed values | | `IS_BETWEEN` | Inclusive range — pass exactly two values: `[start, end]` | | `IS_ON_OR_BEFORE` / `IS_ON_OR_AFTER` | Date/time boundary comparisons | | `CONTAINS` / `TEXT_CONTAINS` | Substring or set membership | | `IS_NULL` / `IS_NOT_NULL` | Null checks — `values` array can be empty | | `STARTS_WITH` / `ENDS_WITH` | String prefix/suffix match | **Module IDs** (use with `attribute: "module"`) | ID | Module | What it covers | |---|---|---| | `0` | APPS | Third-party app connections (connect / disconnect / update) | | `1` | USERS | User creation and profile updates | | `2` | WORKFLOWS | Automation workflow changes | | `3` | SERVICE_CATALOG | Service catalog items | | `4` | SECURITY | Login, logout, API key creation / deletion | | `5` | SKILL | AI skill changes | | `6` | WORKSPACES | Workspace settings changes | | `7` | TENANT_MIGRATION | Sandbox import / export | | `8` | AGENT_GROUPS | Agent group changes | | `9` | ACCESS_MANAGEMENT | Role and access control changes | | `10` | AI_AGENTS | AI agent changes | | `11` | AGENT_AVAILABILITY | Agent availability updates | | `12` | CUSTOM_OBJECTS | Custom object type changes | **Event Type IDs** (use with `attribute: "event_type"`) | ID | Event Type | |---|---| | `0` | CONNECTED | | `1` | DISCONNECTED | | `2` | CREATED | | `3` | UPDATED | | `4` | ENABLED | | `5` | DISABLED | | `6` | DELETED | | `7` | IMPORT | | `8` | EXPORT | | `9` | RESTORED | | `10` | LOGIN | | `12` | LOGOUT | **Module → valid event types** | Module | Valid event type IDs | |---|---| | APPS (0) | 0 (CONNECTED), 1 (DISCONNECTED), 3 (UPDATED) | | USERS (1) | 2 (CREATED), 3 (UPDATED) | | WORKFLOWS (2) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | | SERVICE_CATALOG (3) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | | SECURITY (4) | 2 (CREATED), 6 (DELETED), 10 (LOGIN), 12 (LOGOUT) | | SKILL (5) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | | WORKSPACES (6) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | | TENANT_MIGRATION (7) | 7 (IMPORT), 8 (EXPORT) | | AGENT_GROUPS (8) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | | ACCESS_MANAGEMENT (9) | 2 (CREATED), 3 (UPDATED), 6 (DELETED), 9 (RESTORED) | | AI_AGENTS (10) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | | AGENT_AVAILABILITY (11) | 3 (UPDATED) | | CUSTOM_OBJECTS (12) | 2 (CREATED), 3 (UPDATED), 6 (DELETED) | **Example** ```json [ { "attribute": "event_at", "operator": "IS_BETWEEN", "values": [ { "value": "2024-01-01T00:00:00Z" }, { "value": "2024-12-31T23:59:59Z" } ] }, { "attribute": "module", "operator": "IS_ANY_OF", "values": [ { "value": 1 }, { "value": 9 } ] }, { "attribute": "event_type", "operator": "IS_ANY_OF", "values": [ { "value": 2 }, { "value": 3 } ] }, { "attribute": "actor_id", "operator": "IS_ANY_OF", "values": [ { "value": 123 } ] } ] ```