Audit Logs
The following endpoints allow you to get the organization and team audit logs and their details.
You can read more about audit logs in our Help Center.
Gets a list of all audit log entries for the specified organization.
The audit log entries in the response are sorted by the triggeredAt property in descending order by default. You can use pagination to navigate through a large number of entries.
You can get the audit log entries only for organizations in which you have the "Admin" or "Owner" roles. Otherwise, you get the 403 error.
Deprecated. Use GET /audit-logs/v2/organization/{organizationId} instead. That endpoint requires the audit-logs:read scope on the API token.
Authorize the API call with your API token in the Authorization header with the value: Token your-api-token.
If you don't have an API token yet, please refer to the "Authentication" section to learn how to create one.
The ID of the organization.
11The identification of the teams for which you want to get the audit log entries. You can use either team IDs or team names.
The team name can contain any valid UTF8 symbols and spaces.
team 11["team 1","team 2"][1,2,3]Use the dateFrom parameter to get audit log entries from the specified date or newer. Specify the date in the YYYY-MM-DD format.
2021-09-23T00:00:00.000ZUse the dateTo parameter to get audit log entries until the specified date or older. Specify the date in the YYYY-MM-DD format.
2021-09-24T00:00:00.000ZThe list of events for which you want to get audit log entries. To specify multiple events, use the array notation like: GET /audit-logs/organization/{organizationId}?event[0]=key_created&event[1]=connection_created.
You can check the list of supported events with the API call GET /audit-logs/organization/{organizationId}/filters in the events array in the response.
{"value":["key_created","connection_created"]}webhook_disabled["webhook_disabled","webhook_updated","webhook_deleted"]The identification of the users for whose actions you want to get the audit log entries. You can use either user IDs or user names.
The user name can contain any valid UTF8 symbols and spaces.
author 11["author 1","author 2"][1,2,3]The number of entities you want to skip before getting entities you want.
The maximum number of entities you want to get in the response.
The last retrieved key. In response, you get only entries that follow after the key.
10Specify the response property values that Make will use to sort the audit log entries in the response. The default is triggeredAt.
The sorting order. It accepts the ascending and descending direction specifiers.
Set to true to get also the total number of audit log entries in the response.
trueAudit log entries for the specified organization.
GET /api/v2/audit-logs/organization/{organizationId} HTTP/1.1
Host: eu1.make.com
Authorization: Token your-api-token
Accept: */*
Audit log entries for the specified organization.
{
"auditLogs": {
"uuid": "c37c7292-35cd-4dc4-9113-21b23beaea7d",
"createdAt": "2024-05-24T14:22:16.879Z",
"triggeredAt": "2024-04-19T12:05:22Z",
"organizationId": 3,
"organization": {
"id": 3,
"name": "John Doe's Organization"
},
"eventName": "webhook_created",
"team": {
"id": 212,
"name": "John Doe's Team"
},
"actor": {
"id": 212,
"name": "John Doe",
"email": "john.doe@whois.com"
},
"targetId": "3000",
"version": {
"from": "1.0.0",
"to": "1.0.1"
}
},
"pg": {
"sortBy": "triggeredAt",
"sortDir": "desc",
"offset": 0,
"limit": 100,
"totalCount": 60
}
}Gets available audit logs filters for the organization.
You can use the data in the response to filter audit log entries you get from the GET /audit-logs/organization/{organizationId} endpoint.
Deprecated. Use GET /audit-logs/v2/organization/{organizationId}/filters instead. That endpoint requires the audit-logs:read scope on the API token.
Authorize the API call with your API token in the Authorization header with the value: Token your-api-token.
If you don't have an API token yet, please refer to the "Authentication" section to learn how to create one.
The ID of the organization.
11Successfully retrieve of available audit logs filters for the organization
GET /api/v2/audit-logs/organization/{organizationId}/filters HTTP/1.1
Host: eu1.make.com
Authorization: Token your-api-token
Accept: */*
Successfully retrieve of available audit logs filters for the organization
{
"teams": [
{
"id": 1,
"name": "John Doe's Team"
}
],
"users": [
{
"id": 1,
"name": "John Doe",
"email": "john.doe@whois.com"
}
],
"events": [
{
"header": "Webhooks",
"items": [
{
"label": "Webhook created",
"value": "webhook_created"
},
{
"label": "Webhook updated",
"value": "webhook_updated"
}
]
}
]
}Gets a list of all audit log entries for the specified team.
The audit log entries in the response are sorted by the triggeredAt property in descending order by default. You can use pagination to navigate through a large number of entries.
You can get the audit log entries only for teams in which you have the "Team Admin" role. Otherwise, you get the 403 error.
Deprecated. Use GET /audit-logs/v2/team/{teamId} instead. That endpoint requires the audit-logs:read scope on the API token.
Authorize the API call with your API token in the Authorization header with the value: Token your-api-token.
If you don't have an API token yet, please refer to the "Authentication" section to learn how to create one.
The ID of the team.
11Use the dateFrom parameter to get audit log entries from the specified date or newer. Specify the date in the YYYY-MM-DD format.
2021-09-23T00:00:00.000ZUse the dateTo parameter to get audit log entries until the specified date or older. Specify the date in the YYYY-MM-DD format.
2021-09-24T00:00:00.000ZThe list of events for which you want to get audit log entries. To specify multiple events, use the array notation like: GET /audit-logs/team/{teamId}?event[0]=key_created&event[1]=connection_created.
You can check the list of supported events with the API call GET /audit-logs/team/{teamId}/filters in the events array in the response.
{"value":["key_created","connection_created"]}webhook_disabled["webhook_disabled","webhook_updated","webhook_deleted"]The identification of the users for whose actions you want to get the audit log entries. You can use either user IDs or user names.
The user name can contain any valid UTF8 symbols and spaces.
author 11["author 1","author 2"][1,2,3]The number of entities you want to skip before getting entities you want.
The maximum number of entities you want to get in the response.
The last retrieved key. In response, you get only entries that follow after the key.
10Specify the response property values that Make will use to sort the audit log entries in the response. The default is triggeredAt.
The sorting order. It accepts the ascending and descending direction specifiers.
Set to true to get also the total number of audit log entries in the response.
trueAudit log entries for the specified team.
GET /api/v2/audit-logs/team/{teamId} HTTP/1.1
Host: eu1.make.com
Authorization: Token your-api-token
Accept: */*
Audit log entries for the specified team.
{
"auditLogs": {
"uuid": "c37c7292-35cd-4dc4-9113-21b23beaea7d",
"createdAt": "2024-05-24T14:22:16.879Z",
"triggeredAt": "2024-04-19T12:05:22Z",
"organizationId": 3,
"organization": {
"id": 3,
"name": "John Doe's Organization"
},
"eventName": "webhook_created",
"team": {
"id": 212,
"name": "John Doe's Team"
},
"actor": {
"id": 212,
"name": "John Doe",
"email": "john.doe@whois.com"
},
"targetId": "3000",
"version": {
"from": "1.0.0",
"to": "1.0.1"
}
},
"pg": {
"sortBy": "triggeredAt",
"sortDir": "desc",
"offset": 0,
"limit": 100,
"totalCount": 60
}
}Gets available audit logs filters for the team.
You can use the data in the response to filter audit log entries you get from the GET /audit-logs/team/{teamId} endpoint.
Deprecated. Use GET /audit-logs/v2/team/{teamId}/filters instead. That endpoint requires the audit-logs:read scope on the API token.
Authorize the API call with your API token in the Authorization header with the value: Token your-api-token.
If you don't have an API token yet, please refer to the "Authentication" section to learn how to create one.
The ID of the team.
11Successfully retried available audit logs filters for the team
GET /api/v2/audit-logs/team/{teamId}/filters HTTP/1.1
Host: eu1.make.com
Authorization: Token your-api-token
Accept: */*
Successfully retried available audit logs filters for the team
{
"users": [
{
"id": 1,
"name": "John Doe",
"email": "john.doe@whois.com"
}
],
"events": [
{
"header": "Webhooks",
"items": [
{
"label": "Webhook created",
"value": "webhook_created"
},
{
"label": "Webhook updated",
"value": "webhook_updated"
}
]
}
]
}Gets details of the audit log entry with the specified UUID.
Deprecated. Use GET /audit-logs/v2/{organizationId}/{uuid} instead. That endpoint requires the audit-logs:read scope on the API token.
Authorize the API call with your API token in the Authorization header with the value: Token your-api-token.
If you don't have an API token yet, please refer to the "Authentication" section to learn how to create one.
The UUID of the audit log entry.
c37c7292-35cd-4dc4-9113-21b23beaea7dSuccessful response
GET /api/v2/audit-logs/{organizationId}/{uuid} HTTP/1.1
Host: eu1.make.com
Authorization: Token your-api-token
Accept: */*
Successful response
{
"details": {
"webhookName": "Webhook from John Doe",
"webhookType": "http"
},
"uuid": "c37c7292-35cd-4dc4-9113-21b23beaea7d",
"createdAt": "2024-05-24T14:22:16.879Z",
"triggeredAt": "2024-04-19T12:05:22Z",
"organizationId": 3,
"organization": {
"id": 3,
"name": "John Doe's Organization"
},
"eventName": "webhook_created",
"team": {
"id": 212,
"name": "John Doe's Team"
},
"actor": {
"id": 212,
"name": "John Doe",
"email": "john.doe@whois.com"
},
"targetId": "3000",
"version": {
"from": "1.0.0",
"to": "1.0.1"
}
}Gets a list of all audit log entries for the specified organization.
Requires the audit-logs:read scope on the API token.
The audit log entries in the response are sorted by the triggeredAt property in ascending order by default. Use the pg object to change the sorting or navigate through a large result set. For cursor pagination, pass the last entry's imtId as pg[last].
You can get the audit log entries only for organizations in which you have the "Admin" or "Owner" roles. Otherwise, you get the 403 error.
Authorize the API call with your API token in the Authorization header with the value: Token your-api-token.
If you don't have an API token yet, please refer to the "Authentication" section to learn how to create one.
The positive ID of the organization.
11Filter by one or more positive team IDs or team names. Repeat the parameter to provide multiple values.
{"value":[212,"Operations"]}Return entries triggered at or after this ISO 8601 date, ISO 8601 date-time, or Unix timestamp in milliseconds.
{"value":"2026-09-01"}Return entries triggered at or before this ISO 8601 date, ISO 8601 date-time, or Unix timestamp in milliseconds.
{"value":"2026-09-22"}Filter by one or more event names. Repeat the parameter to provide multiple values.
{"value":["key_created","connection_created"]}Filter by one or more positive actor IDs, names, or email addresses. Repeat the parameter to provide multiple values.
{"value":[212,"john.doe@example.com"]}Audit log entries for the specified organization.
An identifier, date, filter, pagination, or sorting value is invalid (SC400).
Authentication failed, the authorization lacks audit-logs:read, or an organization-bound authorization cannot access the requested entity (IM001 or SC401).
The organization license does not include the audit logs feature (IM027).
The caller lacks permission to view audit logs for the requested organization or team, or the audit log entry belongs to a different organization (SC403).
The requested organization, team, or audit log entry does not exist (SC404).
GET /api/v2/audit-logs/v2/organization/{organizationId} HTTP/1.1
Host: eu1.make.com
Authorization: Token your-api-token
Accept: */*
{
"auditLogs": [
{
"uuid": "c37c729235cd4dc4911321b23beaea7d",
"imtId": "1713528322000_c37c729235cd4dc4911321b23beaea7d",
"createdAt": "2024-05-24T14:22:16.879Z",
"triggeredAt": "2024-04-19T12:05:22.000Z",
"organizationId": 3,
"organization": {
"id": 3,
"name": "John's Organization"
},
"eventName": "webhook_created",
"team": {
"id": 212,
"name": "Operations"
},
"actor": {
"id": 212,
"name": "John Doe",
"email": "john.doe@example.com"
},
"targetId": "3000",
"version": {
"from": "1.0.0",
"to": "1.0.1"
}
}
],
"pg": {
"sortDir": "asc",
"returnTotalCount": false,
"limit": 1000,
"offset": 0
}
}Gets available audit logs filters for the organization.
Requires the audit-logs:read scope on the API token.
Use the data in the response to build filters for the GET /audit-logs/v2/organization/{organizationId} endpoint: users and teams supply the values for the author and team parameters, and events supplies the values for the event parameter. The endpoint takes no query parameters.
Authorize the API call with your API token in the Authorization header with the value: Token your-api-token.
If you don't have an API token yet, please refer to the "Authentication" section to learn how to create one.
The positive ID of the organization.
11Available audit logs filters for the specified organization.
An identifier, date, filter, pagination, or sorting value is invalid (SC400).
Authentication failed, the authorization lacks audit-logs:read, or an organization-bound authorization cannot access the requested entity (IM001 or SC401).
The organization license does not include the audit logs feature (IM027).
The caller lacks permission to view audit logs for the requested organization or team, or the audit log entry belongs to a different organization (SC403).
The requested organization, team, or audit log entry does not exist (SC404).
GET /api/v2/audit-logs/v2/organization/{organizationId}/filters HTTP/1.1
Host: eu1.make.com
Authorization: Token your-api-token
Accept: */*
{
"users": [
{
"id": 212,
"name": "John Doe",
"email": "john.doe@example.com"
}
],
"teams": [
{
"id": 212,
"name": "Operations"
}
],
"events": [
{
"header": "Webhooks",
"items": [
{
"label": "Webhook created",
"value": "webhook_created"
},
{
"label": "Webhook updated",
"value": "webhook_updated"
}
]
}
]
}Gets a list of all audit log entries for the specified team.
Requires the audit-logs:read scope on the API token.
The audit log entries in the response are sorted by the triggeredAt property in ascending order by default. Use the pg object to change the sorting or navigate through a large result set. For cursor pagination, pass the last entry's imtId as pg[last].
You can get the audit log entries only for teams in which you have the "Team Admin" role. Otherwise, you get the 403 error.
Authorize the API call with your API token in the Authorization header with the value: Token your-api-token.
If you don't have an API token yet, please refer to the "Authentication" section to learn how to create one.
The positive ID of the team.
212Return entries triggered at or after this ISO 8601 date, ISO 8601 date-time, or Unix timestamp in milliseconds.
{"value":"2026-09-01"}Return entries triggered at or before this ISO 8601 date, ISO 8601 date-time, or Unix timestamp in milliseconds.
{"value":"2026-09-22"}Filter by one or more event names. Repeat the parameter to provide multiple values.
{"value":["key_created","connection_created"]}Filter by one or more positive actor IDs, names, or email addresses. Repeat the parameter to provide multiple values.
{"value":[212,"john.doe@example.com"]}Audit log entries for the specified team.
An identifier, date, filter, pagination, or sorting value is invalid (SC400).
Authentication failed, the authorization lacks audit-logs:read, or an organization-bound authorization cannot access the requested entity (IM001 or SC401).
The organization license does not include the audit logs feature (IM027).
The caller lacks permission to view audit logs for the requested organization or team, or the audit log entry belongs to a different organization (SC403).
The requested organization, team, or audit log entry does not exist (SC404).
GET /api/v2/audit-logs/v2/team/{teamId} HTTP/1.1
Host: eu1.make.com
Authorization: Token your-api-token
Accept: */*
{
"auditLogs": [
{
"uuid": "c37c729235cd4dc4911321b23beaea7d",
"imtId": "1713528322000_c37c729235cd4dc4911321b23beaea7d",
"createdAt": "2024-05-24T14:22:16.879Z",
"triggeredAt": "2024-04-19T12:05:22.000Z",
"organizationId": 3,
"organization": {
"id": 3,
"name": "John's Organization"
},
"eventName": "webhook_created",
"team": {
"id": 212,
"name": "Operations"
},
"actor": {
"id": 212,
"name": "John Doe",
"email": "john.doe@example.com"
},
"targetId": "3000",
"version": {
"from": "1.0.0",
"to": "1.0.1"
}
}
],
"pg": {
"sortDir": "asc",
"returnTotalCount": false,
"limit": 1000,
"offset": 0
}
}Gets available audit logs filters for the team.
Requires the audit-logs:read scope on the API token.
Use the data in the response to build filters for the GET /audit-logs/v2/team/{teamId} endpoint: users supplies the values for the author parameter and events supplies the values for the event parameter. The response has no teams array — the team is already fixed by the path. The endpoint takes no query parameters.
Authorize the API call with your API token in the Authorization header with the value: Token your-api-token.
If you don't have an API token yet, please refer to the "Authentication" section to learn how to create one.
The positive ID of the team.
212Available audit logs filters for the specified team.
An identifier, date, filter, pagination, or sorting value is invalid (SC400).
Authentication failed, the authorization lacks audit-logs:read, or an organization-bound authorization cannot access the requested entity (IM001 or SC401).
The organization license does not include the audit logs feature (IM027).
The caller lacks permission to view audit logs for the requested organization or team, or the audit log entry belongs to a different organization (SC403).
The requested organization, team, or audit log entry does not exist (SC404).
GET /api/v2/audit-logs/v2/team/{teamId}/filters HTTP/1.1
Host: eu1.make.com
Authorization: Token your-api-token
Accept: */*
{
"users": [
{
"id": 212,
"name": "John Doe",
"email": "john.doe@example.com"
}
],
"events": [
{
"header": "Webhooks",
"items": [
{
"label": "Webhook created",
"value": "webhook_created"
},
{
"label": "Webhook updated",
"value": "webhook_updated"
}
]
}
]
}Gets details of the audit log entry with the specified UUID.
Requires the audit-logs:read scope on the API token.
The organizationId in the path must be the organization the entry belongs to.
Authorize the API call with your API token in the Authorization header with the value: Token your-api-token.
If you don't have an API token yet, please refer to the "Authentication" section to learn how to create one.
The positive ID of the organization.
11The UUIDv4 of the audit log entry. Hyphens are optional.
c37c7292-35cd-4dc4-9113-21b23beaea7dPattern: ^[0-9a-fA-F]{8}-?[0-9a-fA-F]{4}-?4[0-9a-fA-F]{3}-?[89abAB][0-9a-fA-F]{3}-?[0-9a-fA-F]{12}$Detail of the specified audit log entry.
The UUIDv4 of the audit log entry. Hyphens are optional.
^[0-9a-fA-F]{8}-?[0-9a-fA-F]{4}-?4[0-9a-fA-F]{3}-?[89abAB][0-9a-fA-F]{3}-?[0-9a-fA-F]{12}$When Auditman stored the entry.
When the audited event occurred.
An identifier, date, filter, pagination, or sorting value is invalid (SC400).
Authentication failed, the authorization lacks audit-logs:read, or an organization-bound authorization cannot access the requested entity (IM001 or SC401).
The organization license does not include the audit logs feature (IM027).
The caller lacks permission to view audit logs for the requested organization or team, or the audit log entry belongs to a different organization (SC403).
The requested organization, team, or audit log entry does not exist (SC404).
GET /api/v2/audit-logs/v2/{organizationId}/{uuid} HTTP/1.1
Host: eu1.make.com
Authorization: Token your-api-token
Accept: */*
{
"uuid": "c37c729235cd4dc4911321b23beaea7d",
"createdAt": "2024-05-24T14:22:16.879Z",
"triggeredAt": "2024-04-19T12:05:22.000Z",
"organizationId": 3,
"organization": {
"id": 3,
"name": "John's Organization"
},
"eventName": "webhook_created",
"team": {
"id": 212,
"name": "Operations"
},
"actor": {
"id": 212,
"name": "John Doe",
"email": "john.doe@example.com"
},
"targetId": "3000",
"version": {
"from": "1.0.0",
"to": "1.0.1"
},
"detail": {
"webhookName": "Orders webhook",
"webhookType": "http"
}
}Last updated