Audit Logs

The Audit Logs API returns a record of actions taken across your organization and workspaces: who did what, when, and to what. Use it for compliance reporting, security monitoring, and activity tracking.

To browse and filter audit logs in the Synthesia app instead of calling the API, see Audit logs.

Endpoints

Query audit log events

GET https://api.synthesia.io/v2/auditLogs/events

Simple query endpoint for retrieving paginated audit events.

Key behavior:

• Exactly one of workspaceId or organizationId must be provided.
• Multiple values for actions and actorIds are comma-separated.
• Dates are Unix timestamps (seconds since epoch).

Query parameters:

Response:

{
  "events": [
    {
      "id": "7d8307d2-63f3-4e86-85db-8feae494f7e2",
      "action": "workspace.license.consumed",
      "status": "success",
      "actor": {
        "type": "user",
        "id": "9a0840a7-a4be-42f7-9d2c-a6d96ccc6ba6",
        "name": "Jamie Rivera",
        "email": "jamie.rivera@example.com"
      },
      "target": {
        "type": "user",
        "id": "91f0be7b-055a-4766-8457-79dbeb1c351d",
        "name": "Alex Chen"
      },
      "context": {
        "workspaceId": "99ba788e-eaeb-4b0c-ae4e-901575d6f28c",
        "organizationId": "73a6bbf3-eed0-4d31-8dd9-16435fe2ee38",
        "ipAddress": null
      },
      "details": {
        "previousLicenseType": "free",
        "newLicenseType": "full",
        "targetUserEmail": "alex.chen@example.com",
        "targetUserId": "91f0be7b-055a-4766-8457-79dbeb1c351d",
        "source": "admin_action",
        "workspaceName": "Sales Workspace",
        "organizationName": "Example Org"
      },
      "metadata": {
        "createdAt": "2026-01-11T16:47:57.658000Z",
        "processedAt": "2026-01-11T16:47:58.324000Z"
      }
    }
  ],
  "nextCursor": "51332afa-4419-405f-9a85-fe437ce683aa",
  "hasMore": true
}

Search audit log events

POST https://api.synthesia.io/v2/auditLogs/events/search

Advanced search for complex filtering scenarios. Use this endpoint instead of GET /v2/auditLogs/events when:

• Filtering by 50 or more actions or actors.
• You need programmatic access with a JSON request body.
• Your filter combination is too complex for query parameters.

Request body:

{
  "organizationId": "73a6bbf3-eed0-4d31-8dd9-16435fe2ee38",
  "startDate": 1736524800,
  "endDate": 1736697600,
  "actions": ["billing.credits.consumed", "dubbing.project.created"],
  "actorIds": ["9a0840a7-a4be-42f7-9d2c-a6d96ccc6ba6", "91f0be7b-055a-4766-8457-79dbeb1c351d"],
  "cursor": null,
  "limit": 100
}

Response:

{
  "events": [
    {
      "id": "59fa0207-13d9-45fe-a54c-1799658ccc31",
      "action": "billing.credits.consumed",
      "status": "success",
      "actor": {
        "type": "system",
        "id": "billing_system",
        "name": "Billing System",
        "email": null
      },
      "target": {
        "type": "workspace",
        "id": "1f32e8d4-1594-43e2-8caa-1e0a48e00bcc",
        "name": "Enterprise Workspace"
      },
      "context": {
        "workspaceId": "1f32e8d4-1594-43e2-8caa-1e0a48e00bcc",
        "organizationId": "73a6bbf3-eed0-4d31-8dd9-16435fe2ee38",
        "ipAddress": "internal"
      },
      "details": {
        "feature": "DUBBING_DURATION",
        "amount": 5.845,
        "operationType": "credit"
      },
      "metadata": {
        "createdAt": "2026-01-11T16:49:00.051000Z",
        "processedAt": "2026-01-11T16:49:00.387000Z"
      }
    }
  ],
  "nextCursor": "b8d4c4ed-1682-4831-af22-3723f400119d",
  "hasMore": true
}

Export audit logs as CSV

POST https://api.synthesia.io/v2/auditLogs/export

Exports filtered audit logs as a downloadable CSV file. See CSV structure for the columns it contains.

Key behavior:

• Maximum of 10,000 events per export. If your filter matches more, the response is truncated and the filename includes a _TRUNCATED suffix.
• The response is binary CSV data (Content-Type: application/csv).

Request body:

{
  "organizationId": "73a6bbf3-eed0-4d31-8dd9-16435fe2ee38",
  "startDate": 1733932192,
  "endDate": 1736524192,
  "actions": ["billing.credits.consumed"],
  "actorIds": null,
  "targetId": null
}

Response: binary CSV file, with a Content-Disposition header containing the filename, for example audit_logs_export_20260111_165018.csv.

Exporting is itself an audited action. It generates its own event:

{
  "id": "2543a303-74f9-46a1-aba6-9c0538f92a3e",
  "action": "audit_logs.exported",
  "status": "success",
  "actor": {
    "type": "user",
    "id": "91f0be7b-055a-4766-8457-79dbeb1c351d",
    "name": "Jamie Rivera",
    "email": "jamie.rivera@example.com"
  },
  "target": {
    "type": "organization",
    "id": "73a6bbf3-eed0-4d31-8dd9-16435fe2ee38",
    "name": null
  },
  "context": {
    "workspaceId": null,
    "organizationId": "73a6bbf3-eed0-4d31-8dd9-16435fe2ee38",
    "ipAddress": null
  },
  "details": {
    "eventCount": 62,
    "truncated": false,
    "filename": "audit_logs_export_20260111_165018.csv",
    "filters": {
      "start_date": "2025-12-12T16:49:52+00:00",
      "end_date": "2026-01-11T16:49:52+00:00",
      "actor_ids": ["9a0840a7-a4be-42f7-9d2c-a6d96ccc6ba6", "91f0be7b-055a-4766-8457-79dbeb1c351d"]
    }
  },
  "metadata": {
    "createdAt": "2026-01-11T16:50:18.980000Z",
    "processedAt": "2026-01-11T16:50:18.983000Z"
  }
}

Pagination

The Audit Logs API uses cursor-based pagination, which stays stable even when new events are added between requests.

1. Make an initial request without a cursor parameter.
2. The response includes nextCursor and hasMore.
3. Pass nextCursor as the cursor parameter in your next request.
4. Repeat until hasMore is false.

Best practices:

• Check hasMore to decide whether to keep paginating, rather than only checking whether nextCursor is null.
• Keep filter parameters (startDate, endDate, actions, and so on) identical across all requests in a paginated sequence. Changing filters mid-sequence means starting over without a cursor.
• If events is empty but hasMore is true, keep paginating. There may be matching results further on.
• Treat cursors as opaque tokens. Don’t parse or modify them.
• Events are sorted by createdAt descending, then by id descending, for consistent ordering across pages.
• There’s no offset or page-number based pagination, only cursor-based.

Response codes

Data model reference

Actor types

Target types

CSV structure

Exported files are named audit_logs_export_<YYYYMMDD>_<HHMMSS>.csv. A single export is capped at 10,000 events—if your filtered result has more, the file is truncated and _TRUNCATED is appended to the filename. Narrow your date range or filters to get the rest.

Each row has these columns:

Event structure

Each event, whether from events, events/search, or a CSV row, records:

• id: a unique identifier for the event.
• action: what was done, in domain.resource.past_tense_verb format (for example, workspace.user.invited).
• status: whether the action succeeded.
• actor: who or what performed the action.
• target: what the action was performed on.
• context: the workspace, organization, and IP address the action occurred in.
• details: additional information specific to that action, such as what changed from and to.
• metadata: timestamps for when the event was created and processed.

Event types

Actions follow the domain.resource.past_tense_verb format shown throughout this reference. Each event’s Name is the label it appears under in the Synthesia app’s Events filter—see Audit logs for how to browse events there. A dash (—) means the event isn’t available in the list of filter options.

Authentication

User

Workspace

Organization

Billing

Email send cap

Content

Integrations

Covers HRIS and messaging integrations for the Learner Portal, and other external tool connections.

Audit logs

Learner Portal

The Learner Portal has its own set of events, covering Learner Groups, content assignment, and role entitlements. These are distinct from the core Admin/Member/Guest model—the Learner Portal has its own roles (Enablement Admin, Organization Admin, Manager, and Learner).