> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kosli.com/llms.txt
> Use this file to discover all available pages before exploring further.

# kosli list audit-logs

> List audit log events for an org.

## Synopsis

```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
kosli list audit-logs [flags]
```

List audit log events for an org.
Each event records a change to an org member's role: a member being added, changing role, or being removed.
Listing the audit log requires org admin rights.
The list can be filtered by user, event type, role and source. When multiple filters are provided, only events matching all of them are returned.
The results are paginated and ordered from latest to oldest by default; use --page and --page-limit to navigate the pages.

## Flags

| Flag | Type | Description |
| :- | :- | :- |
| `--event-type` | string | \[optional] Only list events of this type. Valid values are: \[added, changed, removed]. |
| `-h`, `--help` | bool | help for audit-logs |
| `-o`, `--output` | string | \[defaulted] The format of the output. Valid formats are: \[table, json]. (default "table") |
| `--page` | int | \[defaulted] The page number of a response. (default 1) |
| `-n`, `--page-limit` | int | \[defaulted] The number of elements per page. (default 15) |
| `--role` | stringArray | \[optional] Only list events that set this role. Can be repeated to match more than one role. |
| `--search` | string | \[optional] Only list events where the affected user's or the acting user's name contains this substring (case-insensitive). |
| `--sort-by` | string | \[optional] The column to sort events by. Valid values are: \[when, user, role, changed\_by, source]. (defaults to when) |
| `--sort-direction` | string | \[optional] The direction to sort events in. Valid values are: \[asc, desc]. (defaults to desc) |
| `--source` | stringArray | \[optional] Only list events from this source (e.g. app, scim, invitation, script). Can be repeated to match more than one source. |

## Flags inherited from parent commands

| Flag | Type | Description |
| :- | :- | :- |
| `-a`, `--api-token` | string | The Kosli API token. |
| `-c`, `--config-file` | string | \[optional] The Kosli config file path. Config is read from this path or the default only, never implicitly from the current directory. (default "\$HOME/.kosli.yml") |
| `--debug` | bool | \[optional] Print debug logs to stdout. |
| `-H`, `--host` | string | \[defaulted] The Kosli endpoint. (default "[https://app.kosli.com](https://app.kosli.com)") |
| `--http-proxy` | string | \[optional] The HTTP proxy URL including protocol and port number. e.g. `http://proxy-server-ip:proxy-port` |
| `-r`, `--max-api-retries` | int | \[defaulted] How many times should API calls be retried when the API host is not reachable. (default 3) |
| `--org` | string | The Kosli organization. |
| `-q`, `--quiet` | bool | \[optional] Suppress non-critical warning messages. Errors and normal output are not affected. If both `--quiet` and `--debug` are set, `--debug` wins. |

## Examples Use Cases

These examples all assume that the flags  `--api-token`, `--org`, `--host`, (and `--flow`, `--trail` when required), are [set/provided](https://docs.kosli.com/getting_started/install.md#assigning-flags-via-environment-variables).

> [accordion] list the first page of audit log events for an org
>
> ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
> kosli list audit-logs 
>
> ```

> [accordion] list the second page of audit log events (30 per page)
>
> ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
> kosli list audit-logs 
> 	--page 2 
> 	--page-limit 30 
>
> ```

> [accordion] list audit log events in JSON
>
> ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
> kosli list audit-logs 
> 	--output json 
>
> ```

> [accordion] list the role changes that affected or were made by users whose name contains 'alice'
>
> ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
> kosli list audit-logs 
> 	--search alice 
> 	--event-type changed 
>
> ```

> [accordion] list the events that made someone an admin or a member through SCIM (--role and --source can be repeated)
>
> ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
> kosli list audit-logs 
> 	--role admin 
> 	--role member 
> 	--source scim 
>
> ```

> [accordion] list audit log events sorted by user name in ascending order
>
> ```shell theme={"theme":"dracula","languages":{"custom":["/languages/rego.json"]}}
> kosli list audit-logs 
> 	--sort-by user 
> 	--sort-direction asc 
> ```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.