> ## Documentation Index > Fetch the complete documentation index at: https://docs.traversal.com/llms.txt > Use this file to discover all available pages before exploring further. # List event logs > **Beta.** This endpoint is available under `/v0/event-logs` while we collect feedback. It may change before stabilizing at `/v1`. Returns audit events for your organization, newest first. **Admin role required.** Each row carries a `data` payload whose shape depends on `type` (e.g. `integrations.create` returns an integration snapshot; `sessions.update` returns a field-diff). Treat unknown `type` values gracefully — new values may be added over time. Rate-limited to 100 requests per minute. ## OpenAPI ````yaml /api/openapi.yaml get /v0/event-logs openapi: 3.1.0 info: title: Traversal API version: 1.0.0 description: | The Traversal V1 API lets you launch investigations, manage the customer-authored knowledge files that agents use, and read the organization audit trail. All endpoints require a Bearer token. The authenticated user must have at least the `member` role within the organization unless an endpoint states otherwise. To wait for an investigation without polling, connect to `GET /v1/sessions/{session_id}/events`. The Server-Sent Events stream sends session status snapshots and closes when the session reaches a terminal status. servers: - url: https://api.traversal.com description: Traversal API security: - bearerAuth: [] tags: - name: Sessions description: Create, list, retrieve, and continue investigation sessions. - name: Knowledge Files description: List, upload, download, and delete customer-authored agent knowledge. - name: Event Logs description: Read the organization's audit trail. Admin-only. paths: /v0/event-logs: get: tags: - Event Logs summary: List event logs description: | **Beta.** This endpoint is available under `/v0/event-logs` while we collect feedback. It may change before stabilizing at `/v1`. Returns audit events for your organization, newest first. **Admin role required.** Each row carries a `data` payload whose shape depends on `type` (e.g. `integrations.create` returns an integration snapshot; `sessions.update` returns a field-diff). Treat unknown `type` values gracefully — new values may be added over time. Rate-limited to 100 requests per minute. operationId: listEventLogs parameters: - name: type in: query required: false description: Filter by event type, e.g. `integrations.update`. schema: $ref: '#/components/schemas/EventLogType' - name: start_time in: query required: false description: Inclusive lower bound on the event timestamp (ISO-8601 UTC). schema: type: string format: date-time - name: end_time in: query required: false description: >- Exclusive upper bound on the event timestamp (ISO-8601 UTC). Must be greater than `start_time` if both are set. schema: type: string format: date-time - name: page in: query required: false description: Page number (1-indexed). schema: type: integer minimum: 1 - name: limit in: query required: false description: Number of events per page (max 100). schema: type: integer minimum: 1 maximum: 100 responses: '200': description: A page of event logs. content: application/json: schema: $ref: '#/components/schemas/EventLogList' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalServerError' components: schemas: EventLogType: type: string description: | Dotted `.` identifier for an event. New values may be added over time — clients should treat unknown values gracefully. enum: - integrations.create - integrations.update - integrations.delete - api_keys.create - api_keys.delete - users.invite_sent - users.invite_accepted - users.role_granted - users.archive - auth.login - auth.logout - sessions.create - sessions.update - sessions.delete EventLogList: type: object required: - event_logs - count - total properties: event_logs: type: array description: Events on the current page, ordered newest-first by `id`. items: $ref: '#/components/schemas/EventLog' count: type: integer description: Number of events on this page. prev: type: - integer - 'null' description: Previous page number. `null` if first page. next: type: - integer - 'null' description: Next page number. `null` if last page. total: type: integer description: Total events matching the filters across all pages. EventLog: type: object required: - id - time - type - user_id - user_email - data properties: id: type: integer description: Stable identifier for the event. example: 482913 time: type: string format: date-time description: UTC timestamp of the event. example: '2026-05-27T14:31:02Z' type: $ref: '#/components/schemas/EventLogType' user_id: type: - string - 'null' description: >- The user who triggered the event. `null` for system-driven events or when the user no longer exists. example: a9c2e3b0-7d6f-4a3c-9b21-e1a8d4d56f8e user_email: type: - string - 'null' description: >- Email of the acting user. May be `null` or a placeholder when the user no longer exists. example: alice@acme.com data: type: object additionalProperties: true description: | Payload whose shape depends on `type`: - **Lifecycle events** (everything except `.update`) — `data` is a snapshot of the resource at the time of the event. - **`.update` events** — `data` is a diff: a map of field names to `{ "old": , "new": }`. Only fields that actually changed are present. example: id: int-prod-datadog name: prod-datadog type: datadog created_by_user_id: a9c2e3b0-7d6f-4a3c-9b21-e1a8d4d56f8e created_by_user_email: alice@acme.com Error: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string enum: - conflict - internal - invalid_argument - not_found - payload_too_large - permission_denied - precondition_failed - resource_exhausted - unauthenticated - unavailable - unsupported_media_type description: Stable machine-readable error category. message: type: string description: Human-readable explanation of the error. retry_after: type: integer description: | Optional suggested seconds to wait before retrying. Present only when the server can recommend a delay, such as some `429` and `503` responses. When set, the response also includes a standard `Retry-After` HTTP header with the same value. responses: BadRequest: description: >- An invalid body, path, query parameter, or header value. The `message` identifies the failed validation. content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing, invalid, or revoked API key. headers: WWW-Authenticate: schema: type: string description: Authentication challenge (`Bearer`). content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: Insufficient role, ownership, permission, or endpoint-specific access. content: application/json: schema: $ref: '#/components/schemas/Error' TooManyRequests: description: >- Rate limit exceeded. Wait `retry_after` seconds (also surfaced as the standard `Retry-After` header) and retry. The exact limit depends on the endpoint — see the per-endpoint description. headers: Retry-After: schema: type: integer description: Suggested seconds to wait before retrying. content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: An unexpected error occurred on the server. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer description: | Bearer token in the `Authorization` header — for example, `Authorization: Bearer YOUR_API_KEY`. Personal keys act as their owner; the Sessions API also accepts organization-owned service-account keys. Knowledge Files endpoints currently require a personal key. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.