> ## Documentation Index > Fetch the complete documentation index at: https://documentation.onesignal.com/llms.txt > Use this file to discover all available pages before exploring further. # List audit logs > Retrieve a paginated, time-scoped list of audit log events for an organization. Requires an Enterprise plan. Supports filtering by app, action, actor, target, and IP address. ## Overview The List audit logs API returns a record of actions taken within your organization — who did what, when, and from where. Use it to support compliance workflows, security investigations, and activity monitoring. This endpoint requires an Enterprise plan with the audit logs entitlement enabled. Contact your account manager to enable access. See [Audit logs](/docs/en/audit-logs) for a feature overview. *** ## How to use this API Authenticate with your [Organization API Key](/docs/en/keys-and-ids#organization-api-key). App-level API keys are not accepted. ### Time range Every initial request requires a `start_time`. Results are returned in ascending chronological order. * The maximum lookback window is **90 days**. * `start_time` must be an ISO 8601 timestamp within the last 90 days. * `end_time` is optional and defaults to the current time. * Historical data is only available from **2026-02-18T00:00:00Z** onward. ### Cursor-based pagination When a response contains more results than the requested `limit`, the response includes `has_more: true` and a `next_cursor` value. Pass `next_cursor` as the `cursor` parameter in the next request. When using a cursor, `start_time` and `end_time` are not required. When `app_ids` is set, org-level events (those not associated with any specific app) are always included in results alongside the filtered app events. ## OpenAPI ````yaml GET /organizations/{organization_id}/audit_logs openapi: 3.1.0 info: title: api.onesignal.com version: '11.6' servers: - url: https://api.onesignal.com security: - {} paths: /organizations/{organization_id}/audit_logs: get: summary: List audit logs description: >- Retrieve a paginated, time-scoped list of audit log events for an organization. Requires an Enterprise plan with the audit logs entitlement enabled. operationId: list-audit-logs parameters: - name: organization_id in: path description: >- The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key. required: true schema: type: string default: YOUR_ORG_ID - name: Authorization in: header description: >- Your Organization API key with prefix `Key `. See [Keys & IDs](/docs/en/keys-and-ids). required: true schema: type: string default: Key YOUR_ORGANIZATION_API_KEY - name: start_time in: query description: >- Start of the time range in ISO 8601 format (e.g. `2026-02-01T00:00:00Z`). Required unless `cursor` is provided. Must be within the last 90 days and no earlier than `2026-02-18T00:00:00Z`. schema: type: string - name: end_time in: query description: >- End of the time range in ISO 8601 format. Defaults to the current time. Must be after `start_time`. schema: type: string - name: cursor in: query description: >- Pagination cursor returned in a previous response as `next_cursor`. When provided, `start_time` and `end_time` are ignored. schema: type: string - name: limit in: query description: >- Maximum number of events to return per page. Minimum `1`, maximum `100`. Values outside this range are clamped automatically. schema: type: integer default: 100 minimum: 1 maximum: 100 - name: app_ids in: query description: >- Filter events by app UUID. Accepts up to 10 values. Org-level events are always included. Repeat the parameter for multiple values: `app_ids=uuid1&app_ids=uuid2`. style: form explode: true schema: type: array items: type: string maxItems: 10 - name: actions in: query description: >- Filter by action type (e.g. `notification.sent`, `segment.created`). Accepts up to 20 values. Repeat the parameter for multiple values: `actions=notification.sent&actions=segment.created`. style: form explode: true schema: type: array items: type: string maxItems: 20 - name: actor_ids in: query description: >- Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values. Repeat the parameter for multiple values: `actor_ids=uuid1&actor_ids=uuid2`. style: form explode: true schema: type: array items: type: string maxItems: 10 - name: actor_emails in: query description: >- Filter by actor email address. Accepts up to 10 values. Repeat the parameter for multiple values: `actor_emails=a@example.com&actor_emails=b@example.com`. style: form explode: true schema: type: array items: type: string maxItems: 10 - name: target_types in: query description: >- Filter by the type of resource the action was performed on (e.g. `notification`, `segment`, `journey`). Accepts up to 10 values. Repeat the parameter for multiple values: `target_types=notification&target_types=segment`. style: form explode: true schema: type: array items: type: string maxItems: 10 - name: target_ids in: query description: >- Filter by the UUID of the resource the action was performed on. Accepts up to 10 values. Repeat the parameter for multiple values: `target_ids=uuid1&target_ids=uuid2`. style: form explode: true schema: type: array items: type: string maxItems: 10 - name: ip_addresses in: query description: >- Filter by the IP address the action originated from. Accepts up to 10 values. Repeat the parameter for multiple values: `ip_addresses=203.0.113.1&ip_addresses=203.0.113.2`. style: form explode: true schema: type: array items: type: string maxItems: 10 responses: '200': description: '200' content: application/json: schema: type: object properties: audit_logs: type: array description: >- Array of audit log events, ordered by `occurred_at` ascending. items: type: object properties: id: type: string description: UUID of the audit log event. organization_id: type: string description: UUID of the organization the event belongs to. app_id: type: string description: >- UUID of the app the event is associated with. Absent for org-level events. action: type: string description: >- The action that was performed (e.g. `notification.sent`, `segment.created`, `member.invited`). occurred_at: type: string description: >- RFC 3339 timestamp of when the event occurred (e.g. `2026-02-18T12:34:56Z`). version: type: integer description: Schema version of the event payload. actor: type: object description: >- The user or service that performed the action. Absent if the actor is unknown. properties: type: type: string description: Actor type (e.g. `user`, `service`). id: type: string description: UUID of the actor. name: type: string description: >- Display name of the actor. Absent if unavailable. email: type: string description: >- Email address of the actor. Absent if unavailable. metadata: type: object description: Additional actor-specific data. targets: type: array description: >- The resources the action was performed on. May be empty for org-level events. items: type: object properties: type: type: string description: >- Resource type (e.g. `notification`, `segment`, `journey`, `app`). id: type: string description: UUID of the resource. name: type: string description: >- Display name of the resource. Absent if unavailable. metadata: type: object description: Additional resource-specific data. context: type: object description: >- Request context at the time of the event. Absent if context was not captured. properties: ip: type: string description: IP address the request originated from. user_agent: type: string description: User agent of the client that made the request. country: type: string description: Country code derived from the request IP. metadata: type: object description: Additional context-specific data. metadata: type: object description: >- Additional event-specific data that does not fit into the standard fields. has_more: type: boolean description: >- `true` if additional events exist beyond this page. Use `next_cursor` to fetch the next page. next_cursor: type: string description: >- Opaque cursor to pass as `cursor` in the next request. Only present when `has_more` is `true`. examples: Result: value: audit_logs: - id: a1b2c3d4-0000-0000-0000-000000000001 organization_id: YOUR_ORG_ID app_id: YOUR_APP_ID action: segment.created occurred_at: '2026-02-18T10:22:01Z' version: 1 actor: type: user id: u1b2c3d4-0000-0000-0000-000000000001 name: Jane Smith email: jane@example.com metadata: {} targets: - type: segment id: s1b2c3d4-0000-0000-0000-000000000001 name: High-value users metadata: {} context: ip: 203.0.113.42 user_agent: Mozilla/5.0 country: US metadata: {} metadata: {} has_more: true next_cursor: eyJv... '400': description: '400' content: application/json: examples: Result: value: {} schema: type: object properties: {} '403': description: '403' content: application/json: examples: Result: value: {} schema: type: object properties: {} '429': description: >- Rate limit exceeded. Wait the number of seconds in the `Retry-After` header before retrying. headers: Retry-After: description: >- Number of seconds to wait before retrying the request. Always emitted on 429 responses. schema: type: integer minimum: 0 content: application/json: schema: $ref: '#/components/schemas/BasicErrorResponse' example: errors: - API rate limit exceeded '503': description: >- Service temporarily unavailable. Retry after a short backoff. The body may be empty or non-JSON in some failure modes. headers: Retry-After: description: >- Number of seconds to wait before retrying the request. This header is optional and may be absent when a proxy or load balancer generates the 503. schema: type: integer minimum: 0 content: application/json: schema: $ref: '#/components/schemas/BasicErrorResponse' example: errors: - Service temporarily unavailable x-codeSamples: - lang: typescript label: Node.js SDK source: >- import Onesignal from '@onesignal/node-onesignal'; const configuration = Onesignal.createConfiguration({ organizationApiKey: 'YOUR_ORGANIZATION_API_KEY', }); const apiInstance = new Onesignal.DefaultApi(configuration); // string | The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key. const organizationId: string = "YOUR_ORG_ID"; // string | Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days. (optional) const startTime: string = "start_time_example"; // string | End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time. (optional) const endTime: string = "end_time_example"; // string | Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored. (optional) const cursor: string = "cursor_example"; // number | Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server. (optional) const limit: number = 1; // Array | Filter events by app UUID. Accepts up to 10 values. Org-level events are always included. (optional) const appIds: Onesignal.Array = [ "app_ids_example", ]; // Array | Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values. (optional) const actions: Onesignal.Array = [ "actions_example", ]; // Array | Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values. (optional) const actorIds: Onesignal.Array = [ "actor_ids_example", ]; // Array | Filter by actor email address. Accepts up to 10 values. (optional) const actorEmails: Onesignal.Array = [ "actor_emails_example", ]; // Array | Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values. (optional) const targetTypes: Onesignal.Array = [ "target_types_example", ]; // Array | Filter by the UUID of the resource the action was performed on. Accepts up to 10 values. (optional) const targetIds: Onesignal.Array = [ "target_ids_example", ]; // Array | Filter by the IP address the action originated from. Accepts up to 10 values. (optional) const ipAddresses: Onesignal.Array = [ "ip_addresses_example", ]; try { const response = await apiInstance.listAuditLogs(organizationId, startTime, endTime, cursor, limit, appIds, actions, actorIds, actorEmails, targetTypes, targetIds, ipAddresses); console.log(response); } catch (e) { if (e instanceof Onesignal.ApiException) { // `e.errorMessages` flattens any error-envelope shape to a `string[]`; // the raw parsed body remains on `e.body`. console.error("listAuditLogs failed: HTTP " + e.code, e.errorMessages); } else { throw e; } } - lang: python label: Python SDK source: >- import onesignal from onesignal.api import default_api from onesignal.models import * from pprint import pprint # See configuration.py for a list of all supported configuration parameters. # Some of the OneSignal endpoints require ORGANIZATION_API_KEY token for authorization, while others require REST_API_KEY. # We recommend adding both of them in the configuration page so that you will not need to figure it out yourself. configuration = onesignal.Configuration( rest_api_key = "YOUR_REST_API_KEY", # App REST API key required for most endpoints organization_api_key = "YOUR_ORGANIZATION_API_KEY" # Organization key is only required for creating new apps and other top-level endpoints ) # Enter a context with an instance of the API client with onesignal.ApiClient(configuration) as api_client: # Create an instance of the API class api_instance = default_api.DefaultApi(api_client) organization_id = "YOUR_ORG_ID" # The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key. start_time = "start_time_example" # Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days. (optional) end_time = "end_time_example" # End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time. (optional) cursor = "cursor_example" # Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored. (optional) limit = 1 # Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server. (optional) app_ids = [ "app_ids_example", ] # Filter events by app UUID. Accepts up to 10 values. Org-level events are always included. (optional) actions = [ "actions_example", ] # Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values. (optional) actor_ids = [ "actor_ids_example", ] # Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values. (optional) actor_emails = [ "actor_emails_example", ] # Filter by actor email address. Accepts up to 10 values. (optional) target_types = [ "target_types_example", ] # Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values. (optional) target_ids = [ "target_ids_example", ] # Filter by the UUID of the resource the action was performed on. Accepts up to 10 values. (optional) ip_addresses = [ "ip_addresses_example", ] # Filter by the IP address the action originated from. Accepts up to 10 values. (optional) try: # List audit logs api_response = api_instance.list_audit_logs(organization_id, start_time=start_time, end_time=end_time, cursor=cursor, limit=limit, app_ids=app_ids, actions=actions, actor_ids=actor_ids, actor_emails=actor_emails, target_types=target_types, target_ids=target_ids, ip_addresses=ip_addresses) pprint(api_response) except onesignal.ApiException as e: print("Exception when calling DefaultApi->list_audit_logs: %s\n" % e) print("Status Code: %s" % e.status) print("Response Body: %s" % e.body) - lang: php label: PHP SDK source: >- setRestApiKeyToken('YOUR_REST_API_KEY') ->setOrganizationApiKeyToken('YOUR_ORGANIZATION_API_KEY'); $apiInstance = new onesignal\client\Api\DefaultApi( // If you want use custom http client, pass your client which implements `GuzzleHttp\ClientInterface`. // This is optional, `GuzzleHttp\Client` will be used as default. new GuzzleHttp\Client(), $config ); $organization_id = 'YOUR_ORG_ID'; // string | The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key. $start_time = 'start_time_example'; // string | Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days. $end_time = 'end_time_example'; // string | End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time. $cursor = 'cursor_example'; // string | Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored. $limit = 56; // int | Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server. $app_ids = array('app_ids_example'); // string[] | Filter events by app UUID. Accepts up to 10 values. Org-level events are always included. $actions = array('actions_example'); // string[] | Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values. $actor_ids = array('actor_ids_example'); // string[] | Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values. $actor_emails = array('actor_emails_example'); // string[] | Filter by actor email address. Accepts up to 10 values. $target_types = array('target_types_example'); // string[] | Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values. $target_ids = array('target_ids_example'); // string[] | Filter by the UUID of the resource the action was performed on. Accepts up to 10 values. $ip_addresses = array('ip_addresses_example'); // string[] | Filter by the IP address the action originated from. Accepts up to 10 values. try { $result = $apiInstance->listAuditLogs($organization_id, $start_time, $end_time, $cursor, $limit, $app_ids, $actions, $actor_ids, $actor_emails, $target_types, $target_ids, $ip_addresses); print_r($result); } catch (\onesignal\client\ApiException $e) { echo 'Exception when calling DefaultApi->listAuditLogs: ', $e->getMessage(), PHP_EOL; echo 'Status Code: ', $e->getCode(), PHP_EOL; // getErrorMessages() flattens any error-envelope shape to a string[]; // the raw body remains on getResponseBody(). echo 'Error Messages: ', implode(', ', $e->getErrorMessages()), PHP_EOL; echo 'Response Body: ', $e->getResponseBody(), PHP_EOL; } catch (\Exception $e) { echo 'Exception when calling DefaultApi->listAuditLogs: ', $e->getMessage(), PHP_EOL; } - lang: go label: Go SDK source: |- package main import ( "context" "fmt" "os" "github.com/OneSignal/onesignal-go-api/v5" ) func main() { organizationId := "YOUR_ORG_ID" // string | The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key. startTime := "startTime_example" // string | Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days. (optional) endTime := "endTime_example" // string | End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time. (optional) cursor := "cursor_example" // string | Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored. (optional) limit := int32(56) // int32 | Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server. (optional) appIds := []string{"Inner_example"} // []string | Filter events by app UUID. Accepts up to 10 values. Org-level events are always included. (optional) actions := []string{"Inner_example"} // []string | Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values. (optional) actorIds := []string{"Inner_example"} // []string | Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values. (optional) actorEmails := []string{"Inner_example"} // []string | Filter by actor email address. Accepts up to 10 values. (optional) targetTypes := []string{"Inner_example"} // []string | Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values. (optional) targetIds := []string{"Inner_example"} // []string | Filter by the UUID of the resource the action was performed on. Accepts up to 10 values. (optional) ipAddresses := []string{"Inner_example"} // []string | Filter by the IP address the action originated from. Accepts up to 10 values. (optional) configuration := onesignal.NewConfiguration() apiClient := onesignal.NewAPIClient(configuration) orgAuth := context.WithValue(context.Background(), onesignal.OrganizationApiKey, "YOUR_ORGANIZATION_API_KEY") // Organization API key is only required for creating new apps and other top-level endpoints resp, r, err := apiClient.DefaultApi.ListAuditLogs(orgAuth, organizationId).StartTime(startTime).EndTime(endTime).Cursor(cursor).Limit(limit).AppIds(appIds).Actions(actions).ActorIds(actorIds).ActorEmails(actorEmails).TargetTypes(targetTypes).TargetIds(targetIds).IpAddresses(ipAddresses).Execute() if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `DefaultApi.ListAuditLogs``: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) if apiErr, ok := err.(*onesignal.GenericOpenAPIError); ok { // ErrorMessages() flattens any error-envelope shape to a []string; // the raw body remains on Body(). fmt.Fprintf(os.Stderr, "Error Messages: %v\n", apiErr.ErrorMessages()) fmt.Fprintf(os.Stderr, "Response Body: %s\n", apiErr.Body()) } } // response from `ListAuditLogs`: ListAuditLogsSuccessResponse fmt.Fprintf(os.Stdout, "Response from `DefaultApi.ListAuditLogs`: %v\n", resp) } - lang: ruby label: Ruby SDK source: >- require 'onesignal' # setup authorization OneSignal.configure do |config| # Configure Bearer authorization: organization_api_key config.organization_api_key = 'YOUR_ORGANIZATION_API_KEY' end api_instance = OneSignal::DefaultApi.new organization_id = 'YOUR_ORG_ID' # String | The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key. opts = { start_time: 'start_time_example', # String | Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days. end_time: 'end_time_example', # String | End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time. cursor: 'cursor_example', # String | Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored. limit: 56, # Integer | Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server. app_ids: ['inner_example'], # Array | Filter events by app UUID. Accepts up to 10 values. Org-level events are always included. actions: ['inner_example'], # Array | Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values. actor_ids: ['inner_example'], # Array | Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values. actor_emails: ['inner_example'], # Array | Filter by actor email address. Accepts up to 10 values. target_types: ['inner_example'], # Array | Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values. target_ids: ['inner_example'], # Array | Filter by the UUID of the resource the action was performed on. Accepts up to 10 values. ip_addresses: ['inner_example'] # Array | Filter by the IP address the action originated from. Accepts up to 10 values. } begin # List audit logs result = api_instance.list_audit_logs(organization_id, opts) p result rescue OneSignal::ApiError => e puts "Error when calling DefaultApi->list_audit_logs: #{e}" puts "Status Code: #{e.code}" # `e.error_messages` flattens any error-envelope shape to an Array; # the raw body remains on `e.response_body`. puts "Error Messages: #{e.error_messages}" puts "Response Body: #{e.response_body}" end - lang: java label: Java SDK source: |- // Import classes: import com.onesignal.client.ApiClient; import com.onesignal.client.ApiException; import com.onesignal.client.Configuration; import com.onesignal.client.auth.*; import com.onesignal.client.model.*; import com.onesignal.client.api.DefaultApi; public class Example { public static void main(String[] args) { ApiClient defaultClient = Configuration.getDefaultApiClient(); defaultClient.setBasePath("https://api.onesignal.com"); // Configure HTTP bearer authorization: organization_api_key HttpBearerAuth organization_api_key = (HttpBearerAuth) defaultClient.getAuthentication("organization_api_key"); organization_api_key.setBearerToken("YOUR_ORGANIZATION_API_KEY"); DefaultApi apiInstance = new DefaultApi(defaultClient); String organizationId = "YOUR_ORG_ID"; // String | The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key. String startTime = "startTime_example"; // String | Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days. String endTime = "endTime_example"; // String | End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time. String cursor = "cursor_example"; // String | Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored. Integer limit = 56; // Integer | Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server. List appIds = Arrays.asList(); // List | Filter events by app UUID. Accepts up to 10 values. Org-level events are always included. List actions = Arrays.asList(); // List | Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values. List actorIds = Arrays.asList(); // List | Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values. List actorEmails = Arrays.asList(); // List | Filter by actor email address. Accepts up to 10 values. List targetTypes = Arrays.asList(); // List | Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values. List targetIds = Arrays.asList(); // List | Filter by the UUID of the resource the action was performed on. Accepts up to 10 values. List ipAddresses = Arrays.asList(); // List | Filter by the IP address the action originated from. Accepts up to 10 values. try { ListAuditLogsSuccessResponse result = apiInstance.listAuditLogs(organizationId, startTime, endTime, cursor, limit, appIds, actions, actorIds, actorEmails, targetTypes, targetIds, ipAddresses); System.out.println(result); } catch (ApiException e) { System.err.println("Exception when calling DefaultApi#listAuditLogs"); System.err.println("Status code: " + e.getCode()); // getErrorMessages() flattens any error-envelope shape to a List; // the raw body remains on getResponseBody(). System.err.println("Error messages: " + e.getErrorMessages()); System.err.println("Reason: " + e.getResponseBody()); System.err.println("Response headers: " + e.getResponseHeaders()); e.printStackTrace(); } } } - lang: csharp label: C# SDK source: |- using System; using System.Collections.Generic; using System.Diagnostics; using OneSignalApi.Api; using OneSignalApi.Client; using OneSignalApi.Model; namespace Example { public class ListAuditLogsExample { public static void Main() { Configuration config = new Configuration(); config.BasePath = "https://api.onesignal.com"; // Configure Bearer token for authorization: organization_api_key config.AccessToken = "YOUR_ORGANIZATION_API_KEY"; var apiInstance = new DefaultApi(config); var organizationId = "YOUR_ORG_ID"; // string | The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key. var startTime = "startTime_example"; // string | Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days. (optional) var endTime = "endTime_example"; // string | End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time. (optional) var cursor = "cursor_example"; // string | Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored. (optional) var limit = 56; // int? | Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server. (optional) var appIds = new List(); // List | Filter events by app UUID. Accepts up to 10 values. Org-level events are always included. (optional) var actions = new List(); // List | Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values. (optional) var actorIds = new List(); // List | Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values. (optional) var actorEmails = new List(); // List | Filter by actor email address. Accepts up to 10 values. (optional) var targetTypes = new List(); // List | Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values. (optional) var targetIds = new List(); // List | Filter by the UUID of the resource the action was performed on. Accepts up to 10 values. (optional) var ipAddresses = new List(); // List | Filter by the IP address the action originated from. Accepts up to 10 values. (optional) try { // List audit logs ListAuditLogsSuccessResponse result = apiInstance.ListAuditLogs(organizationId, startTime, endTime, cursor, limit, appIds, actions, actorIds, actorEmails, targetTypes, targetIds, ipAddresses); Debug.WriteLine(result); } catch (ApiException e) { Debug.Print("Exception when calling DefaultApi.ListAuditLogs: " + e.Message ); Debug.Print("Status Code: "+ e.ErrorCode); // e.ErrorMessages flattens any error-envelope shape to an IReadOnlyList; // the raw body remains on e.ErrorContent. Debug.Print("Error Messages: " + string.Join(", ", e.ErrorMessages)); Debug.Print("Response Body: " + e.ErrorContent); Debug.Print(e.StackTrace); } } } } - lang: rust label: Rust SDK source: |- use onesignal_rust_api::apis::configuration::Configuration; use onesignal_rust_api::apis::default_api; #[tokio::main] async fn main() { let mut configuration = Configuration::new(); configuration.organization_api_key_token = Some("YOUR_ORGANIZATION_API_KEY".to_string()); // Realistic values are pulled from the spec's `example:` fields where present. let organization_id: &str = "YOUR_ORG_ID"; let start_time: Option<&str> = None; let end_time: Option<&str> = None; let cursor: Option<&str> = None; let limit: Option = None; let app_ids: Option> = None; let actions: Option> = None; let actor_ids: Option> = None; let actor_emails: Option> = None; let target_types: Option> = None; let target_ids: Option> = None; let ip_addresses: Option> = None; match default_api::list_audit_logs(&configuration, organization_id, start_time, end_time, cursor, limit, app_ids, actions, actor_ids, actor_emails, target_types, target_ids, ip_addresses).await { Ok(resp) => println!("{:?}", resp), Err(e @ onesignal_rust_api::apis::Error::ResponseError(_)) => { // `e.error_messages()` flattens any error-envelope shape to a Vec; // the raw response remains on the ResponseError variant. eprintln!("list_audit_logs failed: {:?}", e.error_messages()); } Err(e) => eprintln!("list_audit_logs failed: {:?}", e), } } components: schemas: BasicErrorResponse: type: object properties: errors: type: array items: type: string description: One or more human-readable error messages. success: type: boolean description: >- Present (and `false`) on some endpoints (notifications, templates, segments). Not emitted by every endpoint. reference: type: array items: type: string description: >- Documentation URL fragments related to the error. Only emitted by the API-key auth error helpers. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.