Retrieve log entries that match the specified search criteria (or all log entries if no criteria specified).
Set custom search criteria using the q parameter, or search from a specific log ID (“search from checkpoint”).
For more information on all possible event types, their respective acronyms, and descriptions, see Log Event Type Codes.
:1 for ascending and :-1 for descending. e.g. date:-1For more information on the list of fields that can be used in fields and sort, see Searchable Fields.
Auth0 limits the number of logs you can return by search criteria to 100 logs per request. Furthermore, you may paginate only through 1,000 search results. If you exceed this threshold, please redefine your search or use the get logs by checkpoint method.
take parameter. If you use from at the same time as q, from takes precedence and q is ignored.from parameter.Important: When fetching logs from a checkpoint log ID, any parameter other than from and take will be ignored, and date ordering is not guaranteed.
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Page index of the results to return. First page is 0.
x >= 0Number of results per page. Paging is disabled if parameter not sent. Default: 50. Max value: 100
0 <= x <= 100Field to use for sorting appended with :1 for ascending and :-1 for descending. e.g. date:-1
^((date)|(connection)|(client_id)|(client_name)|(ip)|(user_id)|(user_name)|(description)|(user_agent)|(type)|(details)|(strategy)|(strategy_type))\:(1|-1)$Comma-separated list of fields to include or exclude (based on value provided for include_fields) in the result. Leave empty to retrieve all fields.
^((date)|(connection)|(client_id)|(client_name)|(ip)|(user_id)|(user_name)|(description)|(user_agent)|(type)|(details)|(strategy)|(strategy_type))(,((date)|(connection)|(client_id)|(client_name)|(ip)|(user_id)|(user_name)|(description)|(user_agent)|(type)|(details)|(strategy)|(strategy_type)))*$Whether specified fields are to be included (true) or excluded (false)
Return results as an array when false (default). Return results inside an object that also contains a total result count when true.
Log Event Id from which to start selection from.
Number of entries to retrieve when using the from parameter. Default 50, max 100
Retrieves logs that match the specified search criteria. This parameter can be combined with all the others in the /api/logs endpoint but is specified separately for clarity. If no fields are provided a case insensitive 'starts with' search is performed on all of the following fields: client_name, connection, user_name. Otherwise, you can specify multiple fields and specify the search using the %field%:%search%, for example: application:node user:"John@contoso.com". Values specified without quotes are matched using a case insensitive 'starts with' search. If quotes are used a case insensitve exact search is used. If multiple fields are used, the AND operator is used to join the clauses.
Logs successfully retrieved.
Date when the event occurred in ISO 8601 format.
Type of event.
Description of this event.
Name of the connection the event relates to.
ID of the connection the event relates to.
ID of the client (application).
Name of the client (application).
IP address of the log event source.
Hostname the event applies to.
ID of the user involved in the event.
Name of the user involved in the event.
API audience the event applies to.
Scope permissions applied to the event.
Name of the strategy involved in the event.
Type of strategy involved in the event.
Unique ID of the event.
Whether the client was a mobile device (true) or desktop/laptop/server (false).
Additional useful details about this event (structure is dependent upon event type).
User agent string from the client device that caused the event.
Information about security-related signals.
Information about the location that triggered this event based on the ip.