{"command":{"effect":"read","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Gets a list of audit logs for an organization.","properties":{"path":{"type":"object","properties":{"organization_id":{"description":"The unique id that identifies the organization.","type":"string","examples":["a67e14daa5f8dceeb91fe5449ba496ef"]}},"required":["organization_id"],"additionalProperties":false},"query":{"type":"object","properties":{"action_result":{"description":"Filters by whether the action was successful or not.","type":"array","items":{"enum":["success","failure"],"type":"string"},"examples":["success"]},"action_type":{"description":"Filters by the action type.","type":"array","items":{"enum":["create","delete","view","update"],"type":"string","examples":["create"]}},"actor_context":{"description":"Filters by the actor context.\n- `api`: The action was performed through the API. The specific credential type was not recorded.\n- `api_key`: The action was authenticated with a Cloudflare Global API Key.\n- `api_token`: The action was authenticated with an API token.\n- `dash`: The action was performed through the Cloudflare dashboard.\n- `oauth`: The action was authenticated with an OAuth token.\n- `origin_ca_key`: The action was authenticated with an Origin CA key.\n","type":"array","items":{"enum":["api","api_key","api_token","dash","oauth","origin_ca_key"],"type":"string","examples":["api_key"]}},"actor_email":{"description":"Filters by the actor's email address.","type":"array","items":{"format":"email","type":"string","examples":["alice@example.com"]}},"actor_id":{"description":"Filters by the actor's user ID.","type":"array","items":{"type":"string","examples":["1d20c3afe174f18b642710cec6298a9d"]}},"actor_ip_address":{"description":"The IP address where the action was initiated.","type":"array","items":{"type":"string","examples":["17.168.228.63"]}},"actor_token_id":{"description":"Filters by the API token ID when the actor context is an api_token or oauth.","type":"array","items":{"type":"string","examples":["144cdb2e39c55e203cf225d8d8208647"]}},"actor_token_name":{"description":"Filters by the API token name when the actor context is an api_token or oauth.","type":"array","items":{"type":"string","examples":["Test Token"]}},"actor_type":{"description":"Filters by the actor type.","type":"array","items":{"enum":["cloudflare_admin","system","user"],"type":"string","examples":["user"]}},"id":{"description":"Finds a specific log by its ID.","type":"array","items":{"type":"string","examples":["f174be97-19b1-40d6-954d-70cd5fbd52db"]}},"raw_cf_ray_id":{"description":"Filters by the response CF Ray ID.","type":"array","items":{"type":"string","examples":["8e8dd2156ef28414"]}},"raw_method":{"description":"The HTTP method for the API call.","type":"array","items":{"type":"string","examples":["GET"]}},"raw_status_code":{"description":"The response status code that was returned.","type":"array","items":{"type":"integer","examples":[200]}},"raw_uri":{"description":"Filters by the request URI.","type":"array","items":{"type":"string"}},"resource_id":{"description":"Filters by the resource ID.","type":"array","items":{"type":"string"}},"resource_product":{"description":"Filters audit logs by the Cloudflare product associated with the changed resource.","type":"array","items":{"type":"string","examples":["Stream"]}},"resource_type":{"description":"Filters audit logs based on the unique type of resource changed by the action.","type":"array","items":{"type":"string","examples":["Video"]}},"resource_scope":{"description":"Filters by the resource scope, specifying whether the resource is associated with an organization.","type":"array","items":{"enum":["organizations"],"type":"string","examples":["organizations"]}},"action_result.not":{"description":"Filters out audit logs by whether the action was successful or not.","type":"array","items":{"enum":["success","failure"],"type":"string"},"examples":["success"]},"action_type.not":{"description":"Filters out audit logs by the action type.","type":"array","items":{"enum":["create","delete","view","update"],"type":"string","examples":["create"]}},"actor_context.not":{"description":"Filters out audit logs by the actor context.\n- `api`: The action was performed through the API. The specific credential type was not recorded.\n- `api_key`: The action was authenticated with a Cloudflare Global API Key.\n- `api_token`: The action was authenticated with an API token.\n- `dash`: The action was performed through the Cloudflare dashboard.\n- `oauth`: The action was authenticated with an OAuth token.\n- `origin_ca_key`: The action was authenticated with an Origin CA key.\n","type":"array","items":{"enum":["api","api_key","api_token","dash","oauth","origin_ca_key"],"type":"string","examples":["api_key"]}},"actor_email.not":{"description":"Filters out audit logs by the actor's email address.","type":"array","items":{"format":"email","type":"string","examples":["alice@example.com"]}},"actor_id.not":{"description":"Filters out audit logs by the actor's user ID.","type":"array","items":{"type":"string","examples":["1d20c3afe174f18b642710cec6298a9d"]}},"actor_ip_address.not":{"description":"Filters out audit logs IP address where the action was initiated.","type":"array","items":{"type":"string","examples":["17.168.228.63"]}},"actor_token_id.not":{"description":"Filters out audit logs by the API token ID when the actor context is an api_token or oauth.","type":"array","items":{"type":"string","examples":["144cdb2e39c55e203cf225d8d8208647"]}},"actor_token_name.not":{"description":"Filters out audit logs by the API token name when the actor context is an api_token or oauth.","type":"array","items":{"type":"string","examples":["Test Token"]}},"actor_type.not":{"description":"Filters out audit logs by the actor type.","type":"array","items":{"enum":["cloudflare_admin","system","user"],"type":"string","examples":["user"]}},"id.not":{"description":"Filters out audit logs by their IDs.","type":"array","items":{"type":"string","examples":["f174be97-19b1-40d6-954d-70cd5fbd52db"]}},"raw_cf_ray_id.not":{"description":"Filters out audit logs by the response CF Ray ID.","type":"array","items":{"type":"string","examples":["8e8dd2156ef28414"]}},"raw_method.not":{"description":"Filters out audit logs by the HTTP method for the API call.","type":"array","items":{"type":"string","examples":["GET"]}},"raw_status_code.not":{"description":"Filters out audit logs by the response status code that was returned.","type":"array","items":{"type":"integer","examples":[200]}},"raw_uri.not":{"description":"Filters out audit logs by the request URI.","type":"array","items":{"type":"string"}},"resource_id.not":{"description":"Filters out audit logs by the resource ID.","type":"array","items":{"type":"string"}},"resource_product.not":{"description":"Filters out audit logs by the Cloudflare product associated with the changed resource.","type":"array","items":{"type":"string","examples":["Stream"]}},"resource_type.not":{"description":"Filters out audit logs based on the unique type of resource changed by the action.","type":"array","items":{"type":"string","examples":["Video"]}},"resource_scope.not":{"description":"Filters out audit logs by the resource scope, specifying whether the resource is associated with an organization.","type":"array","items":{"enum":["organizations"],"type":"string","examples":["organizations"]}},"since":{"type":"string","format":"date","examples":["2024-10-30"],"description":"Limits the returned results to logs newer than the specified date. This can be a date string 2019-04-30 (interpreted in UTC) or an absolute timestamp that conforms to RFC3339."},"before":{"type":"string","format":"date","examples":["2024-10-31"],"description":"Limits the returned results to logs older than the specified date. This can be a date string 2019-04-30 (interpreted in UTC) or an absolute timestamp that conforms to RFC3339."},"direction":{"description":"Sets sorting order.","type":"string","default":"desc","enum":["desc","asc"],"examples":["desc"]},"limit":{"description":"The number limits the objects to return. The cursor attribute may be used to iterate over the next batch of objects if there are more than the limit.","type":"number","default":100,"maximum":1000,"minimum":1,"examples":[25]},"cursor":{"description":"The cursor is an opaque token used to paginate through large sets of records. It indicates the position from which to continue when requesting the next set of records. A valid cursor value can be obtained from the cursor object in the result_info structure of a previous response.","type":"string","examples":["Q1buH-__DQqqig7SVYXT-SsMOTGY2Z3Y80W-fGgva7yaDdmPKveucH5ddOcHsJRhNb-xUK8agZQqkJSMAENGO8NU6g=="]}},"required":["since","before"],"additionalProperties":false}},"required":["path","query"],"additionalProperties":false},"name":"Get organization audit logs (Version 2)","id":"cloudflare.audit-logs-v2-get-organization-audit-logs","example":{"path":{"organization_id":"a67e14daa5f8dceeb91fe5449ba496ef"},"query":{"since":"2024-10-30","before":"2024-10-31"}},"maxRequests":1,"summary":false}}