Query audit logs

Updated at:

Queries audit logs.

Note

The new Qoder CN documentation site is now available. Content on this site may not reflect the latest product features and changes. Visit docs.qoder.cn for the latest product documentation.

Audit logs are retained for at least 180 days by default. Logs that exceed the retention period are automatically deleted. Export any log data that you need to retain for a longer period.

Supported editions

Enterprise Dedicated Edition

Service endpoints

Get the service endpoint and replace {domain} in the API request syntax with your endpoint.

Authorization

Product

Resource

Required permission

organization settings

Audit log

Read-Only

Request syntax

GET https://{domain}/oapi/v1/platform/organizations/{organizationId}/auditLogs

Request

By time and organization

curl -X 'GET' \
  'https://test-domain-***.rdc.aliyuncs.com/oapi/v1/platform/organizations/c7655445*******71a21c5a5/auditLogs?actionTimeStart=2025-06-09T10%3A00%3A00Z' \
  -H 'Content-Type: application/json' \
  -H 'x-yunxiao-token: pt-0fh3****0fbG_35af****0484'

By member ID

curl -X 'GET' \
  'https://test-domain-***.rdc.aliyuncs.com/oapi/v1/platform/organizations/c7655445-1*******71a21c5a5/auditLogs?actionTimeStart=2025-06-09T10%3A00%3A00Z&userIds=0ef5448********75648d5387' \
  -H 'Content-Type: application/json' \
  -H 'x-yunxiao-token: pt-0fh3****0fbG_35af****0484'

Request headers

x-yunxiao-token string (Required)

The access token. See Access token for details.

Example: pt-0fh3****0fbG_35af****0484.

Request parameters

actionTimeStart string (Required)

The start of the time range to query.

The time must be in RFC3339 format, such as 2023-09-30T00:00:00.00Z.

organizationId string (Required)

The organization ID. This ID can be obtained from the basic information page in the organization management console. For more information, see how to obtain an organizationId.

userIds string (Optional)

One or more member IDs, separated by commas. To obtain member IDs, call the ListUsers - Query user list API operation.

appsstring (Optional)

A list of application identity values, separated by commas.

actionTimeEnd string (Optional)

The end of the time range to query. If this parameter is not specified, the current time is used.

The time must be in RFC3339 format, such as 2023-09-30T00:00:00.00Z.

perPage integer (Optional), default value: 100.

The number of data entries per page. The valid range is [1, 100].

nextToken string (Optional)

The token to retrieve the next page of results.

Response parameters

By time and organization

[
    {
        "id": "851135*************8ade025cce5",
        "organizationId": "fce5ff4*********14f-5021f82c6e51",
        "userId": "d4024e***********3f26b8689ae6",
        "appId": "a1775d**************ede54bef30f6",
        "organization": {
            "id": "fce5ff4**********21f82c6e51",
            "name": "Example"
        },
        "user": {
            "id": "d4024eb************3f26b8689ae6",
            "name": "lingma"
        },
        "app": {
            "identity": "lingma",
            "name": "Qoder CN"
        },
        "action": "Log in to AI coding assistant",
        "detail": "lingma-Dedicated Enterprise Edition logs in to the Qoder CN AI coding assistant",
        "targetType": "Developer Permission",
        "ip": "30.***.**.128",
        "scope": "SCOPE_ORG",
        "actionTime": "2025-06-11T07:32:01Z"
    }
]

By member ID

[
    {
        "id": "3348474*********cde1e56152",
        "organizationId": "c76554*********371a21c5a5",
        "userId": "0ef54*********75648d5387",
        "appId": "5d2749f*********19d4af43",
        "organization": {
            "id": "c765544*********1a21c5a5",
            "name": "Example Name"
        },
        "user": {
            "id": "0ef*********48d5387",
            "name": "Member Name"
        },
        "app": {
            "identity": "base",
            "name": "Organization settings"
        },
        "action": "Add member role",
        "detail": "The role Qoder CN Administrator was added to the member Member Name.",
        "targetId": "lingma_admin",
        "targetType": "member",
        "ip": "111.**26",
        "scope": "SCOPE_ORG",
        "actionTime": "2025-06-11T05:28:31Z"
    }
]

action string

The action that was performed.

actionTime string

The time when the action was performed.

app object

Information about the application.

Properties

identity string

The application identifier.

  • base: All organizations.

  • lingma: Enterprise administrator.

name string

The application name.

appId string

The application ID.

detail string

The action details.

id string

The unique ID of the audit log entry.

ip string

The source IP address from which the action was initiated.

organization object

Information about the organization.

Properties

id string

The organization ID.

name string

The organization name.

organizationId string

The organization ID.

scope string

The scope of the audit log.

targetId string

The ID of the target resource.

targetType string

The type of the target resource.

  • member

  • Developer Permission

  • license

user object

Information about the operator who performed the action.

Properties

id string

The ID of the operator.

name string

The name of the operator.

userId string

The operator ID.

Response headers

Parameter

Description

Example

x-next-token

The token for the next page of results. This header is present only when more results are available.

MT***********************BkYg==

Error codes

For more information, see Error code center.