> ## Documentation Index > Fetch the complete documentation index at: https://docs.orq.ai/llms.txt > Use this file to discover all available pages before exploring further. # Query audit logs > Queries audit logs from your workspace with filters, sorting, and cursor pagination. ## OpenAPI ````yaml post /v2/audit-logs/query openapi: 3.1.0 info: title: orq.ai API version: '2.0' description: orq.ai API documentation servers: - url: https://my.orq.ai security: - ApiKey: [] tags: - name: Chunking description: Split text into smaller chunks for retrieval and generation workflows. - name: File Systems description: >- Create and manage persistent file systems that agents and MCP clients read from and write to. - name: Knowledge Bases description: Create and manage knowledge bases used by agents and retrieval workflows. - name: Memory Stores description: Create and manage memory stores, memories, and memory documents. - name: Evals description: Run an evaluator against a conversation and its result - name: Logs description: >- OpenTelemetry log query API. Search, filter, aggregate, and facet log records ingested via OTLP. - name: Reporting description: >- GenAI reporting API over canonical analytics rollups. Accepts a metric name, time range, grain, group-by, and filters; returns a typed time series and optional totals. - name: Traces description: >- Query and inspect ingested trace data: search trace summaries, aggregate metrics, and read individual traces and their spans. - description: List models available through the AI Router. name: Models - name: Policies - name: Alerts description: >- Alerts evaluate a Reporting API metric on a fixed interval and fire notifications through notifiers when the value breaches a threshold. Each breach opens a trigger that tracks the incident until the value recovers. - name: Annotation Queues description: Annotation queues collect spans for human review. - name: API keys description: >- API keys authenticate programmatic access to the workspace. They expose opaque tokens, per-domain access grants, and budget and rate-limit constraints. - name: Audit Logs description: Audit logs record workspace entity changes and access-relevant events. - name: Budgets description: >- Budgets govern spend, token usage, and request rate across six scopes: workspace, project, identity, API key, provider, and model. Every applicable budget is enforced, and the most restrictive limit applies per dimension. - name: Files description: File upload and retrieval operations. - name: Guardrail Rules description: >- Guardrail Rules conditionally enforce evaluators and plugins for AI Gateway traffic. Rules may be scoped to a project or the whole workspace. - name: Hub description: Hub items are reusable templates available to a workspace. - name: Identities description: >- Identities represent end users from your system for usage and engagement tracking. - name: Management keys description: >- Management keys are workspace-scoped credentials that authenticate programmatic access to workspace administration surfaces (API keys, budgets). Unlike project-scoped API keys, a management key always operates at the workspace level. - name: MCP Gateway description: >- Register upstream MCP servers, discover and sync their tools, and assemble gateways that expose a curated tool surface to MCP clients. - name: Model Catalog description: >- Browse the orq.ai model catalog: every model orq offers, across every provider, with pricing, capabilities and benchmark data. List endpoints only return models that are not deprecated. This API is public, requires no authentication, and is rate limited to 120 requests per minute per IP. Responses carry a 5-minute cache-control max-age. - name: Notifiers description: Notifier destinations used to send delivery and workflow notifications. - name: Projects description: Projects organize resources within a workspace - name: Routing Rules description: >- Routing Rules conditionally select models and enforce request plugins for AI Gateway traffic. Rules are evaluated by ascending priority and may be scoped to a project or the whole workspace. - name: Threads description: Threads group related trace invocations and their aggregate usage - name: Skills description: >- Skills are modular instructions you can use to codify processes and conventions - name: Smart Routers description: >- Create and manage workspace Smart Routers. A Smart Router selects a model from an eligible pool for each request according to a quality, balanced, or cost profile. - name: Webhooks description: >- Create and manage webhooks that deliver workspace events to external HTTPS endpoints. - name: Workspaces description: >- A workspace is the tenant. Create is a user-session onboarding RPC; Get, List, and Update are the public management surface. - name: Workspace Security description: >- Workspace-level domain verification and IP allowlist controls. These operations are restricted to workspace administrators. - name: Workspace Settings description: >- Workspace-level settings managed with a workspace credential. A workspace is the tenant, so these settings are a singleton — there is nothing to create or delete, only read and update. - name: Responses - description: Run agents on a cron cadence. Minimum firing interval is 1 hour. name: Agent Schedules - name: Embeddings - name: Telemetry description: >- Unified query envelope for traces, metrics, and logs (ADR 0004). One request shape, one filter dialect, and one response shape per source, validated by a per-source registry. externalDocs: url: https://docs.orq.ai description: orq.ai Documentation paths: /v2/audit-logs/query: post: tags: - Audit Logs summary: Query audit logs description: >- Queries audit logs from your workspace with filters, sorting, and cursor pagination. operationId: AuditLogQuery requestBody: content: application/json: schema: $ref: '#/components/schemas/QueryAuditLogsRequest' required: true responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/QueryAuditLogsResponse' x-code-samples: - lang: curl label: cURL source: | curl --request POST \ --url https://my.orq.ai/v2/audit-logs/query \ --header "Authorization: Bearer $ORQ_API_KEY" \ --header "Content-Type: application/json" \ --data '{ "filters": { "operator": "and", "filters": [ { "type": "string", "path": "entity_type", "operator": "is", "value": "skill" } ] }, "pagination": { "limit": 20 }, "sorting": [ { "key": "created_at", "direction": "desc" } ] }' - lang: typescript label: TypeScript source: | const auditLogs = await client.auditLogs.query({ filters: { operator: "and", filters: [ { type: "string", path: "entity_type", operator: "is", value: "skill", }, ], }, pagination: { limit: 20, }, sorting: [ { key: "created_at", direction: "desc", }, ], }); components: schemas: QueryAuditLogsRequest: example: filters: operator: and filters: - type: string path: entity_type operator: is value: skill pagination: limit: 20 sorting: - key: created_at direction: desc required: - filters - pagination type: object properties: filters: $ref: '#/components/schemas/AuditLogFilterQuery' pagination: $ref: '#/components/schemas/AuditLogPagination' sorting: type: array items: $ref: '#/components/schemas/AuditLogSort' description: Sort expressions. Defaults to audit_log_id descending when omitted. description: Request body for querying audit logs in the authenticated workspace. QueryAuditLogsResponse: example: audit_logs: - audit_log_id: audit_log_01JZ9QMB6AEH7B8XH0ZQ9ZPQEY project_id: proj_01JZ9QMB6AEH7B8XH0ZQ9ZPQEY entity_id: skill_01JZ9QMB6AEH7B8XH0ZQ9ZPQEY entity_type: skill action: updated actor_id: usr_01JZ9QMB6AEH7B8XH0ZQ9ZPQEY actor_ip: 203.0.113.10 created_at: '2026-06-15T12:30:00Z' metadata: display_name: Production skill overall_total: 1 has_more: false required: - audit_logs - overall_total - has_more type: object properties: audit_logs: type: array items: $ref: '#/components/schemas/AuditLog' description: Audit logs matching the query. overall_total: example: 42 type: string description: >- Total number of audit logs matching the query before cursor pagination. has_more: example: false type: boolean description: Whether another page exists after the returned audit logs. description: Paginated audit log query result. AuditLogFilterQuery: required: - operator - filters type: object properties: search: example: Production skill type: string description: Optional text search applied to supported display fields. operator: example: and type: string description: Logical operator used to combine filters. filters: type: array items: $ref: '#/components/schemas/AuditLogFilter' description: Advanced filters applied to the query. description: Search and advanced filters for querying audit logs. AuditLogPagination: type: object properties: limit: example: 20 type: integer description: Maximum number of audit logs to return. Defaults to 50 when omitted. format: int32 starting_after: example: audit_log_01JZ9QMB6AEH7B8XH0ZQ9ZPQEY type: string description: >- Cursor for the next page. Use the last audit_log_id from the previous page. ending_before: example: audit_log_01JZ9QMB6AEH7B8XH0ZQ9ZPQEY type: string description: >- Cursor for the previous page. Use the first audit_log_id from the current page. description: Cursor pagination settings for audit log queries. AuditLogSort: required: - key type: object properties: key: example: created_at type: string description: >- Audit log field to sort by. Supported keys include _id, created_at, entity_type, entity_id, action, and actor_id. direction: example: desc type: string description: Sort direction. Defaults to desc when omitted or invalid. description: A sort expression for audit log queries. AuditLog: required: - audit_log_id - entity_id - entity_type - action - created_at type: object properties: audit_log_id: example: audit_log_01JZ9QMB6AEH7B8XH0ZQ9ZPQEY type: string description: Unique identifier for the audit log entry. project_id: example: proj_01JZ9QMB6AEH7B8XH0ZQ9ZPQEY type: string description: >- Project associated with the event, when the audited entity belongs to a project. entity_id: example: skill_01JZ9QMB6AEH7B8XH0ZQ9ZPQEY type: string description: Identifier of the entity that changed. entity_type: $ref: '#/components/schemas/Value' example: skill description: Type of entity that changed. action: $ref: '#/components/schemas/Value' example: updated description: Action recorded for the entity event. actor_id: example: usr_01JZ9QMB6AEH7B8XH0ZQ9ZPQEY type: string description: User or system actor that caused the event, when available. actor_ip: example: 203.0.113.10 type: string description: IP address observed for the actor, when available. actor_type: $ref: '#/components/schemas/Value' example: user description: Kind of actor behind the action. Omitted when unknown. actor_display: example: kevin@orq.ai type: string description: Human readable actor name captured when the action happened. origin: $ref: '#/components/schemas/Value' example: api description: Surface the action came from. Omitted when unknown. request_id: example: req_01JZ9QMB6AEH7B8XH0ZQ9ZPQEY type: string description: Correlates the entry with the originating request. created_at: example: '2026-06-15T12:30:00Z' type: string description: Time when the audit log entry was created. format: date-time metadata: example: display_name: Production skill type: object description: >- Additional event metadata. The exact shape depends on entity_type and action. description: An audit log entry for an entity event in the authenticated workspace. AuditLogFilter: required: - type - path - operator - value type: object properties: type: example: string type: string description: Filter value type, such as string, date, number, boolean, or array. path: example: entity_type type: string description: >- Audit log field path to filter on. Supported paths include created_at, entity_id, entity_type, action, actor_id, origin, and metadata.display_name. operator: example: is type: string description: Filter operator supported by the selected field type. value: $ref: '#/components/schemas/GoogleProtobufValue' description: A single advanced filter applied to audit logs. Value: type: string enum: - ORIGIN_UNSPECIFIED - ui - api - scim - system - router - mcp - automation - internal GoogleProtobufValue: description: >- Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values. securitySchemes: ApiKey: type: http scheme: bearer bearerFormat: JWT ````