> For the complete documentation index, see [llms.txt](https://docs.nected.ai/nected-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nected.ai/nected-docs/management-api/audit-log-api/get-audit-log-search-result.md).

# Get Audit Log Search Result

Retrieve a paginated list of audit logs for a specific module with optional filtering and sorting.

### Endpoint

`GET /dev/v1/audit/{module}/search`

Get audit log search result.

### URL Format

Query parameters can be appended directly to the URL as a query string.

**Example:** `/dev/v1/audit/audit/search?pageNo=1&pageSize=5`

### Authentication

All endpoints require authentication via the `Nected-Branch` header.

| Header           | Type   | Required | Description                                         |
| ---------------- | ------ | -------- | --------------------------------------------------- |
| `Nected-API-Key` | string | Yes      | Your Nected API key.                                |
| `Nected-Branch`  | string | Yes      | Branch name (e.g. default branch of the workspace). |

## Search audit logs

> Paginated list of audit logs for \*\*\`module\`\*\*, with optional filters (\`type\`, \`status\`, \`environment\`, \`user\`, date range) and \*\*\`sort\`\*\* (default \`date:-1\`).\
> \
> \*\*200\*\* body: \`code\`, \`message\`, \`pageNo\`, \`pageSize\`, \`totalCount\`, \`totalPages\`, and \*\*\`data\`\*\* as an array of \*\*\`AuditLogEntry\`\*\*.\
> \
> Example: \*\*\`capturedSearch\`\*\* → \[examples/audit\_search\_200.json]\(./examples/audit\_search\_200.json) (canonical \[Get/GET\_SEARCH.json]\(./Get/GET\_SEARCH.json)).

```json
{"openapi":"3.0.3","info":{"title":"Nected Audit Log API (Dev V1)","version":"1.0"},"tags":[{"name":"Audit","description":"Search audit logs and fetch a single log with parent/child context."}],"servers":[{"url":"https://api.nected.ai","description":"Production"}],"security":[{"DevAuth":[]}],"components":{"securitySchemes":{"DevAuth":{"type":"apiKey","in":"header","name":"Nected-API-Key","description":"Dev API key (`Nected-API-Key` header)"}},"schemas":{"AuditSearchResponse":{"type":"object","description":"Search result; data is an array of audit log entries","properties":{"code":{"type":"string"},"data":{"type":"array","items":{"$ref":"#/components/schemas/AuditLogEntry"}},"message":{"type":"string"},"pageNo":{"type":"integer"},"pageSize":{"type":"integer"},"totalCount":{"type":"integer"},"totalPages":{"type":"integer"}}},"AuditLogEntry":{"type":"object","description":"Single audit log entry","properties":{"branchName":{"type":"string"},"date":{"type":"string"},"entityId":{"type":"string"},"environment":{"type":"string"},"event":{"type":"string"},"executionId":{"type":"string"},"executionTime":{"type":"string"},"input":{"type":"object","additionalProperties":true},"ip":{"type":"string"},"logId":{"type":"string"},"message":{"type":"string"},"name":{"type":"string"},"output":{"type":"object","additionalProperties":true},"path":{"type":"array","items":{"$ref":"#/components/schemas/AuditLogPathNode"}},"rootNode":{"$ref":"#/components/schemas/RootNode"},"signed":{"type":"boolean"},"status":{"type":"string"},"traceId":{"type":"string"},"type":{"type":"string"},"user":{"type":"string"},"version":{"type":"string"},"workspaceId":{"type":"string"}}},"AuditLogPathNode":{"type":"object","description":"Path node in audit hierarchy","properties":{"entity":{"type":"string"},"entityId":{"type":"string"},"entityType":{"type":"string"},"executionId":{"type":"string"},"name":{"type":"string"},"version":{"type":"string"}}},"RootNode":{"type":"object","properties":{"id":{"type":"string"},"logId":{"type":"string"},"name":{"type":"string"}}},"Response":{"type":"object","description":"Standard API response wrapper","properties":{"code":{"type":"string"},"data":{"type":"object","description":"Response payload","additionalProperties":true},"message":{"type":"string"},"pageNo":{"type":"integer"},"pageSize":{"type":"integer"},"totalCount":{"type":"integer"},"totalPages":{"type":"integer"}}}}},"paths":{"/dev/v1/audit/{module}/search":{"get":{"operationId":"getAuditLogSearchResult","tags":["Audit"],"summary":"Search audit logs","description":"Paginated list of audit logs for **`module`**, with optional filters (`type`, `status`, `environment`, `user`, date range) and **`sort`** (default `date:-1`).\n\n**200** body: `code`, `message`, `pageNo`, `pageSize`, `totalCount`, `totalPages`, and **`data`** as an array of **`AuditLogEntry`**.\n\nExample: **`capturedSearch`** → [examples/audit_search_200.json](./examples/audit_search_200.json) (canonical [Get/GET_SEARCH.json](./Get/GET_SEARCH.json)).","parameters":[{"name":"Nected-Branch","in":"header","required":true,"description":"Branch name (e.g. default branch). Required for audit endpoints.","schema":{"type":"string"}},{"name":"module","in":"path","required":true,"description":"Module name (audited area).","schema":{"type":"string"}},{"name":"type","in":"query","description":"Type of audit log (optional).","schema":{"type":"string"}},{"name":"status","in":"query","description":"Status filter (optional).","schema":{"type":"string"}},{"name":"sort","in":"query","description":"Sort order (optional, default `date:-1`).","schema":{"type":"string","default":"date:-1"}},{"name":"environment","in":"query","description":"Environment filter (optional).","schema":{"type":"string"}},{"name":"user","in":"query","description":"User who performed the action (optional).","schema":{"type":"string"}},{"name":"startDate","in":"query","description":"Start of date range (ISO format, optional).","schema":{"type":"string"}},{"name":"endDate","in":"query","description":"End of date range (ISO format, optional).","schema":{"type":"string"}},{"name":"pageNo","in":"query","description":"Page number (optional, default 1).","schema":{"type":"integer","default":1}},{"name":"pageSize","in":"query","description":"Page size (optional, default 10, max 10).","schema":{"type":"integer","default":10,"maximum":10}}],"responses":{"200":{"description":"OK — paginated audit entries.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditSearchResponse"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Response"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Response"}}}}}}}}}
```

### Path Parameters

| Parameter | Type   | Required | Description |
| --------- | ------ | -------- | ----------- |
| `module`  | string | Yes      | Module name |

### Query Parameters

| Parameter     | Type    | Required | Default   | Description                           |
| ------------- | ------- | -------- | --------- | ------------------------------------- |
| `type`        | string  | No       | -         | Type of audit log                     |
| `status`      | string  | No       | -         | Status of audit log                   |
| `sort`        | string  | No       | `date:-1` | Sort order for audit logs             |
| `environment` | string  | No       | -         | Environment of audit log              |
| `user`        | string  | No       | -         | User who performed the action         |
| `startDate`   | string  | No       | -         | Start date for filtering (ISO format) |
| `endDate`     | string  | No       | -         | End date for filtering (ISO format)   |
| `pageNo`      | integer | No       | 1         | Page number to retrieve               |
| `pageSize`    | integer | No       | 10        | Number of records per page (max: 10)  |

***

### Response

#### Status Code: 200 OK

```json
{
  "code": "",
  "data": [
    {
      "branchName": "string",
      "date": "string",
      "entityId": "string",
      "environment": "string",
      "event": "string",
      "executionId": "string",
      "executionTime": "string",
      "input": "string",
      "ip": "string",
      "logId": "string",
      "message": "string",
      "name": "string",
      "output": "string",
      "path": [
        {
          "entity": "string",
          "entityId": "string",
          "entityType": "string",
          "executionId": "string",
          "name": "string",
          "version": "string"
        }
      ],
      "rootNode": {
        "id": "string",
        "logId": "string",
        "name": "string"
      },
      "signed": true,
      "status": "string",
      "traceId": "string",
      "type": "string",
      "user": "string",
      "version": "string",
      "workspaceId": "string"
    }
  ],
  "message": "",
  "pageNo": 0,
  "pageSize": 0,
  "totalCount": 0,
  "totalPages": 0
}
```

***

### Error Responses

#### 401 Unauthorized

Authentication failed.

```json
{
  "code": "",
  "data": {},
  "message": "",
  "pageNo": 0,
  "pageSize": 0,
  "totalCount": 0,
  "totalPages": 0
}
```

#### 500 Internal Server Error

Server error occurred.

```json
{
  "code": "",
  "data": {},
  "message": "",
  "pageNo": 0,
  "pageSize": 0,
  "totalCount": 0,
  "totalPages": 0
}
```

***

### Data Models

#### Audit Log Entry

| Field           | Type    | Description                                          |
| --------------- | ------- | ---------------------------------------------------- |
| `logId`         | string  | Unique identifier for the audit log entry            |
| `branchName`    | string  | Branch name associated with the log                  |
| `date`          | string  | Timestamp of the action                              |
| `entityId`      | string  | ID of the entity that was modified                   |
| `environment`   | string  | Environment where the action occurred                |
| `event`         | string  | Type of event that occurred                          |
| `executionId`   | string  | ID of the execution                                  |
| `executionTime` | string  | Time taken for execution                             |
| `input`         | string  | Input data for the action                            |
| `ip`            | string  | IP address of the user                               |
| `message`       | string  | Descriptive message about the action                 |
| `name`          | string  | Name of the audit log entry                          |
| `output`        | string  | Output data from the action                          |
| `path`          | array   | Array of path objects showing the execution path     |
| `rootNode`      | object  | Root node information with `id`, `logId`, and `name` |
| `signed`        | boolean | Whether the log entry is signed                      |
| `status`        | string  | Status of the action                                 |
| `traceId`       | string  | Trace ID for tracking                                |
| `type`          | string  | Type of audit log                                    |
| `user`          | string  | User who performed the action                        |
| `version`       | string  | Version information                                  |
| `workspaceId`   | string  | Workspace identifier                                 |

#### Path Object

| Field         | Type   | Description                 |
| ------------- | ------ | --------------------------- |
| `entity`      | string | Entity name                 |
| `entityId`    | string | Entity identifier           |
| `entityType`  | string | Type of entity              |
| `executionId` | string | Execution identifier        |
| `name`        | string | Name of the path element    |
| `version`     | string | Version of the path element |

#### Root Node Object

| Field   | Type   | Description          |
| ------- | ------ | -------------------- |
| `id`    | string | Root node identifier |
| `logId` | string | Log identifier       |
| `name`  | string | Root node name       |

***

### Example Usage

```bash
curl -X GET "{{NECTED_BASE_URL}}/dev/v1/audit/workflows/search?type=execution&status=success&pageNo=1&pageSize=10" \
  -H "Nected-Branch: {Default Branch of the workspace}"
```

***

### Reference

**Reference:** Try this endpoint in Swagger UI.