List Audit Logs

Retrieve a paginated, filterable list of audit events for your organization. Designed for SIEM integration and compliance workflows.

GET /v1/audit/logs

List Audit Logs

cURL

curl --request GET \
  --url https://api.bland.ai/v1/audit/logs \
  --header 'authorization: <authorization>'

{
  "data": {
    "events": [
      {
        "id": "00000000-0000-0000-0000-000000000001",
        "org_id": "00000000-0000-0000-0000-000000000100",
        "actor_id": "00000000-0000-0000-0000-000000000200",
        "event_type": "pathway.published",
        "resource_type": "convo_pathway",
        "resource_id": "00000000-0000-0000-0000-000000000300",
        "metadata": {
          "version_number": 3,
          "environment": "production"
        },
        "created_at": "2025-01-15T14:32:00.000Z"
      },
      {
        "id": "00000000-0000-0000-0000-000000000002",
        "org_id": "00000000-0000-0000-0000-000000000100",
        "actor_id": "00000000-0000-0000-0000-000000000200",
        "event_type": "auth.sso_login",
        "resource_type": null,
        "resource_id": null,
        "metadata": {
          "provider_id": "okta",
          "email": "[e-mail]"
        },
        "created_at": "2025-01-15T14:30:00.000Z"
      }
    ],
    "total": 2,
    "total_pages": 1,
    "current_page": 1,
    "page_size": 50
  },
  "errors": null
}

Audit logs are an enterprise feature and not yet available for all accounts. To enable audit logging for your organization, contact your Bland representative or reach out to sales.

Overview

Returns a time-ordered log of auditable actions taken within your organization — logins, logouts, pathway changes, knowledge base edits, and more.

Results are scoped to your organization and require an admin or owner role.

Supported event types

Event type	Description
auth.sso_login	User logged in via SSO
auth.logout	User logged out
pathway.created	Conversational pathway created
pathway.updated	Pathway version updated
pathway.deleted	Pathway deleted
pathway.published	Pathway version published to an environment
kb.content_updated	Knowledge base text/markdown content edited
kb.file_replaced	Knowledge base source file replaced
kb.urls_replaced	Knowledge base URLs replaced (web scrape)
kb.version_restored	Knowledge base version restored

New event types are added over time. Filter by prefix (e.g. auth.*, pathway.*, kb.*) in your SIEM to group by category.

Headers

authorization · string · required

Your API key for authentication.

Query Parameters

event_type · string

Filter by exact event type (e.g. pathway.created, auth.sso_login).

actor_id · string

Filter by the user ID that performed the action.

created_after · string

ISO 8601 timestamp. Only return events created after this time.

Example: 2025-01-01T00:00:00Z

created_before · string

ISO 8601 timestamp. Only return events created before this time.

Example: 2025-02-01T00:00:00Z

page · number · default: "1"

Page number (1-indexed).

page_size · number · default: "50"

Results per page. Min 1, max 100.

Response

data · object

events · array

Array of audit event objects, ordered by created_at descending (newest first).

id · string

Unique identifier for the audit event.

org_id · string

The organization this event belongs to.

actor_id · string

The user ID that performed the action.

event_type · string

The type of event (see supported event types above).

resource_type · string | null

The type of resource affected (e.g. convo_pathway, kb). null for events like login/logout that don’t target a specific resource.

resource_id · string | null

The ID of the affected resource. null when no specific resource is involved.

metadata · object | null

Additional context about the event. Contents vary by event type — may include fields like version_id, name, environment, filename, email, etc.

created_at · string

ISO 8601 timestamp of when the event occurred.

total · number

Total number of events matching the query.

total_pages · number

Total number of pages.

current_page · number

The current page number.

page_size · number

The number of results per page.

errors · null

Always null on success.

{
  "data": {
    "events": [
      {
        "id": "00000000-0000-0000-0000-000000000001",
        "org_id": "00000000-0000-0000-0000-000000000100",
        "actor_id": "00000000-0000-0000-0000-000000000200",
        "event_type": "pathway.published",
        "resource_type": "convo_pathway",
        "resource_id": "00000000-0000-0000-0000-000000000300",
        "metadata": {
          "version_number": 3,
          "environment": "production"
        },
        "created_at": "2025-01-15T14:32:00.000Z"
      },
      {
        "id": "00000000-0000-0000-0000-000000000002",
        "org_id": "00000000-0000-0000-0000-000000000100",
        "actor_id": "00000000-0000-0000-0000-000000000200",
        "event_type": "auth.sso_login",
        "resource_type": null,
        "resource_id": null,
        "metadata": {
          "provider_id": "okta",
          "email": "[e-mail]"
        },
        "created_at": "2025-01-15T14:30:00.000Z"
      }
    ],
    "total": 2,
    "total_pages": 1,
    "current_page": 1,
    "page_size": 50
  },
  "errors": null
}

---

Docs for agents: llms.txt