Search audit log events (Advanced)

Advanced search endpoint for audit log events with complex filter criteria.

For most use cases, use GET /v2/auditLogs/events instead.

Use this endpoint when:

• Filtering by 50+ actions or actors
• Complex query logic (future enhancement)
• Programmatic access requiring JSON request bodies

Exactly one of workspaceId or organizationId must be provided. Supports filtering by date range (Unix timestamps), multiple actions, multiple actor IDs, and target ID. Any combination of filters can be applied together.

Example request body for January 2024 user login events: { “workspaceId”: “12345678-1234-1234-1234-123456789abc”, “actions”: [“user.authentication.login”], “startDate”: 1704067200, “endDate”: 1706745599 }

This endpoint is rate-limited and usage is tracked against your API quota.