List Audit Logs
curl --request GET \
--url https://api.devin.ai/v3/enterprise/audit-logs \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.devin.ai/v3/enterprise/audit-logs"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.devin.ai/v3/enterprise/audit-logs', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.devin.ai/v3/enterprise/audit-logs",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.devin.ai/v3/enterprise/audit-logs"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.devin.ai/v3/enterprise/audit-logs")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.devin.ai/v3/enterprise/audit-logs")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"items": [
{
"action": "login",
"audit_log_id": "<string>",
"created_at": 123,
"data": {},
"org_id": "<string>",
"service_user_id": "<string>",
"service_user_name": "<string>",
"user_email": "<string>",
"user_id": "<string>"
}
],
"end_cursor": "<string>",
"has_next_page": false,
"total": 123
}{
"status": 123,
"title": "<string>",
"detail": "<string>",
"errors": [
{}
],
"instance": "<string>",
"type": "about:blank"
}{
"status": 123,
"title": "<string>",
"detail": "<string>",
"errors": [
{}
],
"instance": "<string>",
"type": "about:blank"
}{
"status": 123,
"title": "<string>",
"detail": "<string>",
"errors": [
{}
],
"instance": "<string>",
"type": "about:blank"
}{
"status": 123,
"title": "<string>",
"detail": "<string>",
"errors": [
{}
],
"instance": "<string>",
"type": "about:blank"
}{
"status": 123,
"title": "<string>",
"detail": "<string>",
"errors": [
{}
],
"instance": "<string>",
"type": "about:blank"
}{
"status": 123,
"title": "<string>",
"detail": "<string>",
"errors": [
{}
],
"instance": "<string>",
"type": "about:blank"
}Audit Logs (Enterprise)
List Audit Logs
List audit logs for the enterprise.
GET
/
v3
/
enterprise
/
audit-logs
List Audit Logs
curl --request GET \
--url https://api.devin.ai/v3/enterprise/audit-logs \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.devin.ai/v3/enterprise/audit-logs"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.devin.ai/v3/enterprise/audit-logs', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.devin.ai/v3/enterprise/audit-logs",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.devin.ai/v3/enterprise/audit-logs"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.devin.ai/v3/enterprise/audit-logs")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.devin.ai/v3/enterprise/audit-logs")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"items": [
{
"action": "login",
"audit_log_id": "<string>",
"created_at": 123,
"data": {},
"org_id": "<string>",
"service_user_id": "<string>",
"service_user_name": "<string>",
"user_email": "<string>",
"user_id": "<string>"
}
],
"end_cursor": "<string>",
"has_next_page": false,
"total": 123
}{
"status": 123,
"title": "<string>",
"detail": "<string>",
"errors": [
{}
],
"instance": "<string>",
"type": "about:blank"
}{
"status": 123,
"title": "<string>",
"detail": "<string>",
"errors": [
{}
],
"instance": "<string>",
"type": "about:blank"
}{
"status": 123,
"title": "<string>",
"detail": "<string>",
"errors": [
{}
],
"instance": "<string>",
"type": "about:blank"
}{
"status": 123,
"title": "<string>",
"detail": "<string>",
"errors": [
{}
],
"instance": "<string>",
"type": "about:blank"
}{
"status": 123,
"title": "<string>",
"detail": "<string>",
"errors": [
{}
],
"instance": "<string>",
"type": "about:blank"
}{
"status": 123,
"title": "<string>",
"detail": "<string>",
"errors": [
{}
],
"instance": "<string>",
"type": "about:blank"
}Audit logs include the
ai_guardrail_violation action, recorded when a guardrail is triggered. See the AI Guardrails feature guide for details on configuring guardrails.
Permissions
Requires a service user with theManageEnterpriseSettings permission at the enterprise level.
Time filters
This endpoint supports optional time filters using thetime_after and time_before query parameters.
- Both
time_afterandtime_beforeare Unix timestamps in seconds, interpreted as UTC. - If you provide
time_before, you must also providetime_after. - The time range between
time_afterandtime_beforemust be 100 days or less. - If no time filters are provided, the API returns audit logs for the full available history (subject to pagination).
Authorizations
Service User credential (prefix: cog_)
Query Parameters
Available options:
asc, desc Required range:
1 <= x <= 200Available options:
login, create_org, update_org, delete_org, revoke_all_enterprise_api_keys, add_enterprise_member, delete_member, add_member, assign_roles, update_role, create_role, delete_role, add_group_membership, update_group_membership, delete_group_membership, create_idp_group, update_idp_group, delete_idp_group, add_idp_group_member, remove_idp_group_member, create_scim_user, update_scim_user, delete_scim_user, create_knowledge, edit_knowledge, delete_knowledge, create_folder, update_folder, delete_folder, create_session, sleep_session, terminate_session, archive_session, unarchive_session, send_message, expose_port, request_local_tools_access, authorize_local_tools_access, revoke_local_tools_access, create_service_api_key, revoke_enterprise_api_key, create_gitlab_integration, update_gitlab_integration, reconnect_gitlab_integration, delete_gitlab_integration, create_perforce_integration, delete_perforce_integration, create_gitlab_app_config, delete_gitlab_app_config, install_gitlab_webhook, create_azure_devops_integration, reconnect_azure_devops_integration, delete_azure_devops_integration, remove_repo_from_devin, update_enterprise_hypervisor_settings, update_enterprise_settings, update_webhook_ip_access_list, update_org_settings, update_code_snippet_telemetry, update_local_controls, update_local_enterprise_config, update_local_org_config, ai_guardrail_violation, update_ai_guardrail, approve_deploy, approve_test_app, permission_response, search_query, create_org_api_key, create_user_api_key, view_org_api_key, view_user_api_key, create_secret, update_secret, delete_secret, create_playbook, update_playbook, delete_playbook, create_billing_tag, add_billing_tag_member, enable_persona, disable_persona, delete_persona, start_repo_setup, delete_repo_setup, finish_repo_setup, github_integration_deleted, create_github_integration, update_github_owned_public_repos_in_automations, delete_github_integration, refresh_github_integration, create_bitbucket_integration, delete_bitbucket_integration, mcp_server_install, mcp_server_update, mcp_server_enable, mcp_server_disable, mcp_server_delete, mcp_server_secret_link, mcp_server_secret_unlink, mcp_server_credential_set, mcp_server_credential_delete, mcp_server_oauth_initiate, mcp_server_oauth_tokens_granted, mcp_server_oauth_tokens_revoked, mcp_enterprise_server_targets_update, mcp_enterprise_server_credential_set, mcp_enterprise_server_credential_delete, customer_network_ca_bundle_set, customer_network_ca_bundle_delete, create_mcp_validation_session, mcp_server_tools_list_secrets_resolved, set_account_managed_plugins, set_org_managed_plugins, set_user_managed_plugins, set_managed_plugin_bundle, delete_managed_plugin_bundle, secure_mode_profile_created, secure_mode_profile_updated, secure_mode_binding_created, secure_mode_binding_updated, secure_mode_binding_deleted, create_service_user, update_service_user, delete_service_user, assign_service_user_role, remove_service_user_role, create_git_permission, delete_git_permission, update_git_permission, create_maintenance_task, update_maintenance_task, delete_maintenance_task, create_snapshot_script, schedule_snapshot_script, execute_snapshot_script, update_repo_setup_steering_knowledge, delete_repo_setup_steering_knowledge, set_org_group_limits, create_join_request, approve_join_request, automatic_join_event, reject_join_request, create_seat_request, approve_seat_request, decline_seat_request, create_service_user_api_key, revoke_service_user_api_key, rotate_service_user_api_key, create_pat, revoke_pat, rotate_pat, update_pat_policy, bulk_revoke_pats, policy_revoke_pat, create_pat_request, approve_pat_request, deny_pat_request, cancel_pat_request, complete_pat_request, create_blueprint, create_blueprint_version, rollback_blueprint_version, delete_blueprint, reorder_blueprints, create_enterprise_blueprint, create_enterprise_blueprint_version, rollback_enterprise_blueprint_version, delete_enterprise_blueprint, accept_skill_pr, trigger_blueprint_build, cancel_blueprint_build, upload_blueprint_file, delete_blueprint_file, sync_repo_blueprints, detach_blueprint_from_git, create_blueprint_pr, pin_build, unpin_build, delete_build, trigger_automation, create_automation, update_automation, delete_automation, reset_automation_monitor, update_automation_scratch, regenerate_automation_webhook_secret, acknowledge_session_hard_cap, create_audit_log_export, update_audit_log_export, delete_audit_log_export, start_code_scan, switch_code_scan_profile, create_code_scan_profile, update_code_scan_profile, create_outpost_pool, update_outpost_pool, delete_outpost_pool, claim_outpost_session, release_outpost_session, update_review_comment_language Response
Successful Response
Show child attributes
Show child attributes
Cursor to fetch the next page, or None if this is the last page.
Whether there are more items available after this page.
Optional total count (can be omitted for performance).

