curl --request GET \
  --url https://api.onesignal.com/organizations/{organization_id}/audit_logs \
  --header 'Authorization: <authorization>'

import Onesignal from '@onesignal/node-onesignal';

const configuration = Onesignal.createConfiguration({
    organizationApiKey: 'YOUR_ORGANIZATION_API_KEY',
});
const apiInstance = new Onesignal.DefaultApi(configuration);

// string | The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key.
const organizationId: string = "YOUR_ORG_ID";
// string | Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days. (optional)
const startTime: string = "start_time_example";
// string | End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time. (optional)
const endTime: string = "end_time_example";
// string | Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored. (optional)
const cursor: string = "cursor_example";
// number | Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server. (optional)
const limit: number = 1;
// Array<string> | Filter events by app UUID. Accepts up to 10 values. Org-level events are always included. (optional)
const appIds: Onesignal.Array<string> = [
    "app_ids_example",
  ];
// Array<string> | Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values. (optional)
const actions: Onesignal.Array<string> = [
    "actions_example",
  ];
// Array<string> | Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values. (optional)
const actorIds: Onesignal.Array<string> = [
    "actor_ids_example",
  ];
// Array<string> | Filter by actor email address. Accepts up to 10 values. (optional)
const actorEmails: Onesignal.Array<string> = [
    "actor_emails_example",
  ];
// Array<string> | Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values. (optional)
const targetTypes: Onesignal.Array<string> = [
    "target_types_example",
  ];
// Array<string> | Filter by the UUID of the resource the action was performed on. Accepts up to 10 values. (optional)
const targetIds: Onesignal.Array<string> = [
    "target_ids_example",
  ];
// Array<string> | Filter by the IP address the action originated from. Accepts up to 10 values. (optional)
const ipAddresses: Onesignal.Array<string> = [
    "ip_addresses_example",
  ];

try {
  const response = await apiInstance.listAuditLogs(organizationId, startTime, endTime, cursor, limit, appIds, actions, actorIds, actorEmails, targetTypes, targetIds, ipAddresses);
  console.log(response);
} catch (e) {
  if (e instanceof Onesignal.ApiException) {
    // `e.errorMessages` flattens any error-envelope shape to a `string[]`;
    // the raw parsed body remains on `e.body`.
    console.error("listAuditLogs failed: HTTP " + e.code, e.errorMessages);
  } else {
    throw e;
  }
}

import onesignal
from onesignal.api import default_api
from onesignal.models import *
from pprint import pprint

# See configuration.py for a list of all supported configuration parameters.
# Some of the OneSignal endpoints require ORGANIZATION_API_KEY token for authorization, while others require REST_API_KEY.
# We recommend adding both of them in the configuration page so that you will not need to figure it out yourself.
configuration = onesignal.Configuration(
    rest_api_key = "YOUR_REST_API_KEY", # App REST API key required for most endpoints
    organization_api_key = "YOUR_ORGANIZATION_API_KEY" # Organization key is only required for creating new apps and other top-level endpoints
)


# Enter a context with an instance of the API client
with onesignal.ApiClient(configuration) as api_client:
    # Create an instance of the API class
    api_instance = default_api.DefaultApi(api_client)
    organization_id = "YOUR_ORG_ID" # The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key. 
    start_time = "start_time_example"  # Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days. (optional) 
    end_time = "end_time_example"  # End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time. (optional) 
    cursor = "cursor_example"  # Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored. (optional) 
    limit = 1  # Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server. (optional) 
    app_ids = [
        "app_ids_example",
    ]  # Filter events by app UUID. Accepts up to 10 values. Org-level events are always included. (optional) 
    actions = [
        "actions_example",
    ]  # Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values. (optional) 
    actor_ids = [
        "actor_ids_example",
    ]  # Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values. (optional) 
    actor_emails = [
        "actor_emails_example",
    ]  # Filter by actor email address. Accepts up to 10 values. (optional) 
    target_types = [
        "target_types_example",
    ]  # Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values. (optional) 
    target_ids = [
        "target_ids_example",
    ]  # Filter by the UUID of the resource the action was performed on. Accepts up to 10 values. (optional) 
    ip_addresses = [
        "ip_addresses_example",
    ]  # Filter by the IP address the action originated from. Accepts up to 10 values. (optional) 

    try:
        # List audit logs
        api_response = api_instance.list_audit_logs(organization_id, start_time=start_time, end_time=end_time, cursor=cursor, limit=limit, app_ids=app_ids, actions=actions, actor_ids=actor_ids, actor_emails=actor_emails, target_types=target_types, target_ids=target_ids, ip_addresses=ip_addresses)
        pprint(api_response)
    except onesignal.ApiException as e:
        print("Exception when calling DefaultApi->list_audit_logs: %s\n" % e)
        print("Status Code: %s" % e.status)
        print("Response Body: %s" % e.body)

<?php
require_once(__DIR__ . '/vendor/autoload.php');


// Configure Bearer authorization: organization_api_key
$config = onesignal\client\Configuration::getDefaultConfiguration()
                                                ->setRestApiKeyToken('YOUR_REST_API_KEY')
                                                ->setOrganizationApiKeyToken('YOUR_ORGANIZATION_API_KEY');



$apiInstance = new onesignal\client\Api\DefaultApi(
    // If you want use custom http client, pass your client which implements `GuzzleHttp\ClientInterface`.
    // This is optional, `GuzzleHttp\Client` will be used as default.
    new GuzzleHttp\Client(),
    $config
);
$organization_id = 'YOUR_ORG_ID'; // string | The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key.
$start_time = 'start_time_example'; // string | Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days.
$end_time = 'end_time_example'; // string | End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time.
$cursor = 'cursor_example'; // string | Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored.
$limit = 56; // int | Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server.
$app_ids = array('app_ids_example'); // string[] | Filter events by app UUID. Accepts up to 10 values. Org-level events are always included.
$actions = array('actions_example'); // string[] | Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values.
$actor_ids = array('actor_ids_example'); // string[] | Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values.
$actor_emails = array('actor_emails_example'); // string[] | Filter by actor email address. Accepts up to 10 values.
$target_types = array('target_types_example'); // string[] | Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values.
$target_ids = array('target_ids_example'); // string[] | Filter by the UUID of the resource the action was performed on. Accepts up to 10 values.
$ip_addresses = array('ip_addresses_example'); // string[] | Filter by the IP address the action originated from. Accepts up to 10 values.

try {
    $result = $apiInstance->listAuditLogs($organization_id, $start_time, $end_time, $cursor, $limit, $app_ids, $actions, $actor_ids, $actor_emails, $target_types, $target_ids, $ip_addresses);
    print_r($result);
} catch (\onesignal\client\ApiException $e) {
    echo 'Exception when calling DefaultApi->listAuditLogs: ', $e->getMessage(), PHP_EOL;
    echo 'Status Code: ', $e->getCode(), PHP_EOL;
    // getErrorMessages() flattens any error-envelope shape to a string[];
    // the raw body remains on getResponseBody().
    echo 'Error Messages: ', implode(', ', $e->getErrorMessages()), PHP_EOL;
    echo 'Response Body: ', $e->getResponseBody(), PHP_EOL;
} catch (\Exception $e) {
    echo 'Exception when calling DefaultApi->listAuditLogs: ', $e->getMessage(), PHP_EOL;
}

package main

import (
    "context"
    "fmt"
    "os"

    "github.com/OneSignal/onesignal-go-api/v5"
)

func main() {
    organizationId := "YOUR_ORG_ID" // string | The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key.
    startTime := "startTime_example" // string | Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days. (optional)
    endTime := "endTime_example" // string | End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time. (optional)
    cursor := "cursor_example" // string | Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored. (optional)
    limit := int32(56) // int32 | Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server. (optional)
    appIds := []string{"Inner_example"} // []string | Filter events by app UUID. Accepts up to 10 values. Org-level events are always included. (optional)
    actions := []string{"Inner_example"} // []string | Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values. (optional)
    actorIds := []string{"Inner_example"} // []string | Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values. (optional)
    actorEmails := []string{"Inner_example"} // []string | Filter by actor email address. Accepts up to 10 values. (optional)
    targetTypes := []string{"Inner_example"} // []string | Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values. (optional)
    targetIds := []string{"Inner_example"} // []string | Filter by the UUID of the resource the action was performed on. Accepts up to 10 values. (optional)
    ipAddresses := []string{"Inner_example"} // []string | Filter by the IP address the action originated from. Accepts up to 10 values. (optional)

    configuration := onesignal.NewConfiguration()
    apiClient := onesignal.NewAPIClient(configuration)

    orgAuth := context.WithValue(context.Background(), onesignal.OrganizationApiKey, "YOUR_ORGANIZATION_API_KEY") // Organization API key is only required for creating new apps and other top-level endpoints

    resp, r, err := apiClient.DefaultApi.ListAuditLogs(orgAuth, organizationId).StartTime(startTime).EndTime(endTime).Cursor(cursor).Limit(limit).AppIds(appIds).Actions(actions).ActorIds(actorIds).ActorEmails(actorEmails).TargetTypes(targetTypes).TargetIds(targetIds).IpAddresses(ipAddresses).Execute()

    if err != nil {
        fmt.Fprintf(os.Stderr, "Error when calling `DefaultApi.ListAuditLogs``: %v\n", err)
        fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r)
        if apiErr, ok := err.(*onesignal.GenericOpenAPIError); ok {
            // ErrorMessages() flattens any error-envelope shape to a []string;
            // the raw body remains on Body().
            fmt.Fprintf(os.Stderr, "Error Messages: %v\n", apiErr.ErrorMessages())
            fmt.Fprintf(os.Stderr, "Response Body: %s\n", apiErr.Body())
        }
    }
    // response from `ListAuditLogs`: ListAuditLogsSuccessResponse
    fmt.Fprintf(os.Stdout, "Response from `DefaultApi.ListAuditLogs`: %v\n", resp)
}

require 'onesignal'
# setup authorization
OneSignal.configure do |config|
  # Configure Bearer authorization: organization_api_key
  config.organization_api_key = 'YOUR_ORGANIZATION_API_KEY'

end

api_instance = OneSignal::DefaultApi.new
organization_id = 'YOUR_ORG_ID' # String | The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key.
opts = {
  start_time: 'start_time_example', # String | Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days.
  end_time: 'end_time_example', # String | End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time.
  cursor: 'cursor_example', # String | Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored.
  limit: 56, # Integer | Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server.
  app_ids: ['inner_example'], # Array<String> | Filter events by app UUID. Accepts up to 10 values. Org-level events are always included.
  actions: ['inner_example'], # Array<String> | Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values.
  actor_ids: ['inner_example'], # Array<String> | Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values.
  actor_emails: ['inner_example'], # Array<String> | Filter by actor email address. Accepts up to 10 values.
  target_types: ['inner_example'], # Array<String> | Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values.
  target_ids: ['inner_example'], # Array<String> | Filter by the UUID of the resource the action was performed on. Accepts up to 10 values.
  ip_addresses: ['inner_example'] # Array<String> | Filter by the IP address the action originated from. Accepts up to 10 values.
}

begin
  # List audit logs
  result = api_instance.list_audit_logs(organization_id, opts)
  p result
rescue OneSignal::ApiError => e
  puts "Error when calling DefaultApi->list_audit_logs: #{e}"
  puts "Status Code: #{e.code}"
  # `e.error_messages` flattens any error-envelope shape to an Array<String>;
  # the raw body remains on `e.response_body`.
  puts "Error Messages: #{e.error_messages}"
  puts "Response Body: #{e.response_body}"
end

// Import classes:
import com.onesignal.client.ApiClient;
import com.onesignal.client.ApiException;
import com.onesignal.client.Configuration;
import com.onesignal.client.auth.*;
import com.onesignal.client.model.*;
import com.onesignal.client.api.DefaultApi;

public class Example {
  public static void main(String[] args) {
    ApiClient defaultClient = Configuration.getDefaultApiClient();
    defaultClient.setBasePath("https://api.onesignal.com");
    
    // Configure HTTP bearer authorization: organization_api_key
    HttpBearerAuth organization_api_key = (HttpBearerAuth) defaultClient.getAuthentication("organization_api_key");
    organization_api_key.setBearerToken("YOUR_ORGANIZATION_API_KEY");

    DefaultApi apiInstance = new DefaultApi(defaultClient);
    String organizationId = "YOUR_ORG_ID"; // String | The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key.
    String startTime = "startTime_example"; // String | Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days.
    String endTime = "endTime_example"; // String | End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time.
    String cursor = "cursor_example"; // String | Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored.
    Integer limit = 56; // Integer | Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server.
    List<String> appIds = Arrays.asList(); // List<String> | Filter events by app UUID. Accepts up to 10 values. Org-level events are always included.
    List<String> actions = Arrays.asList(); // List<String> | Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values.
    List<String> actorIds = Arrays.asList(); // List<String> | Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values.
    List<String> actorEmails = Arrays.asList(); // List<String> | Filter by actor email address. Accepts up to 10 values.
    List<String> targetTypes = Arrays.asList(); // List<String> | Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values.
    List<String> targetIds = Arrays.asList(); // List<String> | Filter by the UUID of the resource the action was performed on. Accepts up to 10 values.
    List<String> ipAddresses = Arrays.asList(); // List<String> | Filter by the IP address the action originated from. Accepts up to 10 values.
    try {
      ListAuditLogsSuccessResponse result = apiInstance.listAuditLogs(organizationId, startTime, endTime, cursor, limit, appIds, actions, actorIds, actorEmails, targetTypes, targetIds, ipAddresses);
      System.out.println(result);
    } catch (ApiException e) {
      System.err.println("Exception when calling DefaultApi#listAuditLogs");
      System.err.println("Status code: " + e.getCode());
      // getErrorMessages() flattens any error-envelope shape to a List<String>;
      // the raw body remains on getResponseBody().
      System.err.println("Error messages: " + e.getErrorMessages());
      System.err.println("Reason: " + e.getResponseBody());
      System.err.println("Response headers: " + e.getResponseHeaders());
      e.printStackTrace();
    }
  }
}

using System;
using System.Collections.Generic;
using System.Diagnostics;
using OneSignalApi.Api;
using OneSignalApi.Client;
using OneSignalApi.Model;

namespace Example
{
    public class ListAuditLogsExample
    {
        public static void Main()
        {
            Configuration config = new Configuration();
            config.BasePath = "https://api.onesignal.com";
            // Configure Bearer token for authorization: organization_api_key
            config.AccessToken = "YOUR_ORGANIZATION_API_KEY";

            var apiInstance = new DefaultApi(config);
            var organizationId = "YOUR_ORG_ID";  // string | The UUID of the organization to retrieve audit logs for. Must match the authenticated Organization API Key.
            var startTime = "startTime_example";  // string | Start of the time range in ISO 8601 format (e.g. 2026-02-01T00:00:00Z). Required unless cursor is provided. Must be within the last 90 days. (optional) 
            var endTime = "endTime_example";  // string | End of the time range in ISO 8601 format. Defaults to the current time. Must be after start_time. (optional) 
            var cursor = "cursor_example";  // string | Pagination cursor returned in a previous response as next_cursor. When provided, start_time and end_time are ignored. (optional) 
            var limit = 56;  // int? | Maximum number of events to return per page. Minimum 1, maximum 100. Values outside this range are clamped automatically by the server. (optional) 
            var appIds = new List<string>(); // List<string> | Filter events by app UUID. Accepts up to 10 values. Org-level events are always included. (optional) 
            var actions = new List<string>(); // List<string> | Filter by action type (e.g. notification.sent, segment.created). Accepts up to 20 values. (optional) 
            var actorIds = new List<string>(); // List<string> | Filter by actor UUID (the user or service that performed the action). Accepts up to 10 values. (optional) 
            var actorEmails = new List<string>(); // List<string> | Filter by actor email address. Accepts up to 10 values. (optional) 
            var targetTypes = new List<string>(); // List<string> | Filter by the type of resource the action was performed on (e.g. notification, segment, journey). Accepts up to 10 values. (optional) 
            var targetIds = new List<string>(); // List<string> | Filter by the UUID of the resource the action was performed on. Accepts up to 10 values. (optional) 
            var ipAddresses = new List<string>(); // List<string> | Filter by the IP address the action originated from. Accepts up to 10 values. (optional) 

            try
            {
                // List audit logs
                ListAuditLogsSuccessResponse result = apiInstance.ListAuditLogs(organizationId, startTime, endTime, cursor, limit, appIds, actions, actorIds, actorEmails, targetTypes, targetIds, ipAddresses);
                Debug.WriteLine(result);
            }
            catch (ApiException  e)
            {
                Debug.Print("Exception when calling DefaultApi.ListAuditLogs: " + e.Message );
                Debug.Print("Status Code: "+ e.ErrorCode);
                // e.ErrorMessages flattens any error-envelope shape to an IReadOnlyList<string>;
                // the raw body remains on e.ErrorContent.
                Debug.Print("Error Messages: " + string.Join(", ", e.ErrorMessages));
                Debug.Print("Response Body: " + e.ErrorContent);
                Debug.Print(e.StackTrace);
            }
        }
    }
}

use onesignal_rust_api::apis::configuration::Configuration;
use onesignal_rust_api::apis::default_api;


#[tokio::main]
async fn main() {
    let mut configuration = Configuration::new();
    configuration.organization_api_key_token = Some("YOUR_ORGANIZATION_API_KEY".to_string());


    // Realistic values are pulled from the spec's `example:` fields where present.
    let organization_id: &str = "YOUR_ORG_ID";
    let start_time: Option<&str> = None;
    let end_time: Option<&str> = None;
    let cursor: Option<&str> = None;
    let limit: Option<i32> = None;
    let app_ids: Option<Vec<String>> = None;
    let actions: Option<Vec<String>> = None;
    let actor_ids: Option<Vec<String>> = None;
    let actor_emails: Option<Vec<String>> = None;
    let target_types: Option<Vec<String>> = None;
    let target_ids: Option<Vec<String>> = None;
    let ip_addresses: Option<Vec<String>> = None;

    match default_api::list_audit_logs(&configuration, organization_id, start_time, end_time, cursor, limit, app_ids, actions, actor_ids, actor_emails, target_types, target_ids, ip_addresses).await {
        Ok(resp) => println!("{:?}", resp),
        Err(e @ onesignal_rust_api::apis::Error::ResponseError(_)) => {
            // `e.error_messages()` flattens any error-envelope shape to a Vec<String>;
            // the raw response remains on the ResponseError variant.
            eprintln!("list_audit_logs failed: {:?}", e.error_messages());
        }
        Err(e) => eprintln!("list_audit_logs failed: {:?}", e),
    }
}

{
  "audit_logs": [
    {
      "id": "a1b2c3d4-0000-0000-0000-000000000001",
      "organization_id": "YOUR_ORG_ID",
      "app_id": "YOUR_APP_ID",
      "action": "segment.created",
      "occurred_at": "2026-02-18T10:22:01Z",
      "version": 1,
      "actor": {
        "type": "user",
        "id": "u1b2c3d4-0000-0000-0000-000000000001",
        "name": "Jane Smith",
        "email": "jane@example.com",
        "metadata": {}
      },
      "targets": [
        {
          "type": "segment",
          "id": "s1b2c3d4-0000-0000-0000-000000000001",
          "name": "High-value users",
          "metadata": {}
        }
      ],
      "context": {
        "ip": "203.0.113.42",
        "user_agent": "Mozilla/5.0",
        "country": "US",
        "metadata": {}
      },
      "metadata": {}
    }
  ],
  "has_more": true,
  "next_cursor": "eyJv..."
}

{}

{}

{
  "errors": [
    "API rate limit exceeded"
  ]
}

{
  "errors": [
    "Service temporarily unavailable"
  ]
}