> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developers.synthesia.io/docs/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.synthesia.io/docs/_mcp/server.

# Search audit log events (Advanced)

POST https://api.synthesia.io/v2/auditLogs/events/search
Content-Type: application/json

Advanced search endpoint for audit log events with complex filter criteria.

**For most use cases, use GET /v2/auditLogs/events instead.**

Use this endpoint when:

* Filtering by 50+ actions or actors
* Complex query logic (future enhancement)
* Programmatic access requiring JSON request bodies

Exactly one of workspaceId or organizationId must be provided.
Supports filtering by date range (Unix timestamps), multiple actions, multiple actor IDs, and target ID.
Any combination of filters can be applied together.

Example request body for January 2024 user login events:
\{
"workspaceId": "12345678-1234-1234-1234-123456789abc",
"actions": \["user.authentication.login"],
"startDate": 1704067200,
"endDate": 1706745599
}

This endpoint is rate-limited and usage is tracked against your API quota.

Reference: https://developers.synthesia.io/docs/video-api-reference/audit-logs/search-audit-log-events

## Authentication

- `Authorization` header (required) — API Key authentication via header

## Request

### Body (application/json)

This endpoint expects an AuditLogsQueryRequest.

- `workspaceId` (string, optional, nullable)
- `organizationId` (string, optional, nullable)
- `startDate` (integer, optional, nullable)
- `endDate` (integer, optional, nullable)
- `actions` (list of string, optional, nullable)
- `actorIds` (list of string, optional, nullable)
- `targetId` (string, optional, nullable)
- `cursor` (string, optional, nullable)
- `limit` (integer, optional, default: 50)

## Response

### 200

Paginated list of audit events

- `events` (list of AuditLogEvent, required) — List of audit log events
- `hasMore` (boolean, required) — Whether there are more events to fetch
- `nextCursor` (string, optional, nullable) — Opaque cursor for fetching the next page. Pass as cursor parameter.

## Errors

### 400 Bad Request Error

Invalid query parameters

- `error` (string, required)
- `context` (string, optional)

### 403 Forbidden Error

Forbidden - Wrong API key or Public API access disabled

- `error` (string, required)
- `context` (string, optional)

### 404 Not Found Error

Workspace or organization not found

- `error` (string, required)
- `context` (string, optional)

### 429 Too Many Requests Error

Rate limit exceeded

- `error` (string, required)
- `context` (string, optional)

## Types

### AuditLogEvent

Single audit log event. Represents one audit event with full details including actor, target, context, and domain-specific details. Example response: \{ "id": "256eb609-72cb-4d42-a7a3-59a65d4e6726", "action": "user.authentication.login", "status": "success", "actor": \{ "type": "user", "id": "93d3f26c-8bb1-4759-b0c7-eef01cb0321b", "name": "local user", "email": "[dev\_user@synthesia.io](mailto:dev_user@synthesia.io)" }, "target": \{ "type": "user", "id": "93d3f26c-8bb1-4759-b0c7-eef01cb0321b", "name": "local user" }, "context": \{ "workspaceId": "b93d1427-06d8-412a-b158-6280e68b54d5", "organizationId": null, "ipAddress": null }, "details": \{ "authMethod": "username\_password", "isImpersonation": false, "emailVerified": true, "emailDomain": "synthesia.io", "company": "Synthesia" }, "metadata": \{ "createdAt": "2025-10-05T06:58:28.321Z", "processedAt": "2025-10-05T06:58:28.322Z" } }

- `id` (string, required)
- `action` (string, required)
- `status` (string, required)
- `actor` (Actor, required) — Actor (who performed the action) information.
- `target` (Target, required) — Target (what was acted upon) information.
- `context` (Context, required) — Event context (workspace, organization, IP address).
- `details` (AuditLogEventDetails, required)
- `metadata` (Metadata, required) — Event metadata (timestamps).

### Actor

Actor (who performed the action) information.

- `type` (enum, required) — Types of actors that can perform actions. USER: A human user (authenticated via username/password, social login, or SAML SSO) SYSTEM: An automated system process (e.g., "billing_system", "moderation_system") SERVICE: An internal service (e.g., "rendering_service", "dubbing_service")
  - Allowed values: `user`, `system`, `service`
- `id` (string, required)
- `name` (string, optional, nullable)
- `email` (string, optional, nullable)

### Target

Target (what was acted upon) information.

- `type` (enum, required) — Types of entities that can be acted upon. WORKSPACE: A workspace entity VIDEO: A video entity USER: A user entity (can be same as Actor in self-service actions like login/profile updates) ORGANIZATION: An organization entity ASSET: An asset entity (avatars, images, etc.)
  - Allowed values: `workspace`, `video`, `user`, `organization`, `asset`
- `id` (string, required)
- `name` (string, optional, nullable)

### Context

Event context (workspace, organization, IP address).

- `workspaceId` (string, optional, nullable)
- `organizationId` (string, optional, nullable)
- `ipAddress` (string, optional, nullable)

### AuditLogEventDetails

### Metadata

Event metadata (timestamps).

- `createdAt` (datetime, required)
- `processedAt` (datetime, optional, nullable)

## Examples

**Request**

```json
{}
```

**Response**

```json
{
  "events": [
    {
      "id": "string",
      "action": "string",
      "status": "string",
      "actor": {
        "type": "user",
        "id": "string",
        "name": "string",
        "email": "string"
      },
      "target": {
        "type": "workspace",
        "id": "string",
        "name": "string"
      },
      "context": {
        "workspaceId": "string",
        "organizationId": "string",
        "ipAddress": "string"
      },
      "details": {},
      "metadata": {
        "createdAt": "2024-01-15T09:30:00Z",
        "processedAt": "2024-01-15T09:30:00Z"
      }
    }
  ],
  "hasMore": true,
  "nextCursor": "string"
}
```

**SDK Code**

```python
import requests

url = "https://api.synthesia.io/v2/auditLogs/events/search"

payload = {}
headers = {
    "Authorization": "<apiKey>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://api.synthesia.io/v2/auditLogs/events/search';
const options = {
  method: 'POST',
  headers: {Authorization: '<apiKey>', 'Content-Type': 'application/json'},
  body: '{}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.synthesia.io/v2/auditLogs/events/search"

	payload := strings.NewReader("{}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "<apiKey>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://api.synthesia.io/v2/auditLogs/events/search")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = '<apiKey>'
request["Content-Type"] = 'application/json'
request.body = "{}"

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.post("https://api.synthesia.io/v2/auditLogs/events/search")
  .header("Authorization", "<apiKey>")
  .header("Content-Type", "application/json")
  .body("{}")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://api.synthesia.io/v2/auditLogs/events/search', [
  'body' => '{}',
  'headers' => [
    'Authorization' => '<apiKey>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://api.synthesia.io/v2/auditLogs/events/search");
var request = new RestRequest(Method.POST);
request.AddHeader("Authorization", "<apiKey>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = [
  "Authorization": "<apiKey>",
  "Content-Type": "application/json"
]
let parameters = [] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://api.synthesia.io/v2/auditLogs/events/search")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "POST"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```