# Source: https://getlago.com/docs/guide/security/audit-logs.md

> ## Documentation Index
> Fetch the complete documentation index at: https://getlago.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit logs

> The audit logs enable organization admins to efficiently track member activity, providing detailed records of who performed each action, what was done, and when it occurred.

## Activity logs

Activity logs provide a record of actions initiated within your organization, including actions performed through the UI, via the API, or triggered automatically by the system (e.g., automated billing operations).

### Activity logs retention

Access to the activity log is limited to paid tiers:

1. Free users do not have access to activity logs;
2. Premium users can view activity logs for up to 30 days; and
3. Enterprise customers with the appropriate paid add-on can access the full activity log history without time limits.

### How to access activity logs

<Tabs>
  <Tab title="Dashboard">
    Only organization admins can access Activity Logs through the Developers Console.
    To view the logs:

    1. Click the **Developers** icon in the navigation sidebar;
    2. Select the **Activity Logs** tab; and
    3. View paginated activity logs directly in this section.

    <Frame caption="Activity logs in the Developers Console">
      <img src="https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/activity-logs.png?fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=3923f2b8d01b83c73945fda3aa0d4b2f" data-og-width="2984" width="2984" data-og-height="2098" height="2098" data-path="guide/security/images/activity-logs.png" data-optimize="true" data-opv="3" srcset="https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/activity-logs.png?w=280&fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=cde02f1c47b1b1057576e8d640f9e18f 280w, https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/activity-logs.png?w=560&fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=de59c03fbf3f0b48f1aa2592242187f4 560w, https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/activity-logs.png?w=840&fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=c8d9e2c51f4dcd7799311476582c4a5a 840w, https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/activity-logs.png?w=1100&fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=6da1e1bb8dd40eb205bcbf7d5a8613f3 1100w, https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/activity-logs.png?w=1650&fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=2a05e99a5ac726d5fedddbcd8474459b 1650w, https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/activity-logs.png?w=2500&fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=7fd8a7a94bcf345fabaf4a7438339658 2500w" />
    </Frame>
  </Tab>

  <Tab title="API">
    <CodeGroup>
      ```bash Activity logs theme={"dark"}
      LAGO_URL="https://api.getlago.com"
      API_KEY="__YOUR_API_KEY__"

      curl --location --request GET "$LAGO_URL/api/v1/activity_logs" \
        --header "Authorization: Bearer $API_KEY" \
        --header 'Content-Type: application/json' \
      ```
    </CodeGroup>
  </Tab>
</Tabs>

### Activity log details

Each activity log includes a set of properties that provide context about the recorded action:

* **Type**: The name of the activity (e.g., `plan.updated`, `customer.created`, `invoice.drafted`);
* **Description**: A brief explanation of the activity;
* **Activity ID**: A unique identifier for the activity log entry;
* **Resource Type**: The type of object affected (e.g., `Wallet`, `Invoice`, `Customer`);
* **Resource ID**: The identifier of the impacted resource (e.g., `invoice_id`, `customer_id`);
* **Customer External ID**: Identifies the customer related to the activity;
* **Subscription External ID**: Identifies the subscription related to the activity;
* **Log Date**: The timestamp of the activity;
* **User**: The organization member who triggered the activity; and
* **Source**: Indicates the origin of the action.
  * `front` – triggered from the UI
  * `api` – triggered from the API
  * `system` – triggered automatically by the system (e.g., billing)

In addition to the above, the **Activity Payload** section provides contextual data:

* **Changes**: Details of modified data (available for update actions only); and
* **New Object**: The full payload of the newly created object.

### Filtering activity logs

All of the fields listed above can be used to filter activity logs, either through the UI or via the API.

### Activity logs per object

In the UI, you can view activity logs for a specific object by clicking on the desired object (e.g., a specific customer, plan, invoice, etc.), and access the **Activity Logs** tab.

## API logs

API logs offer a comprehensive record of all API requests and calls made within your organization. They serve as an essential tool for monitoring activity, troubleshooting issues, and auditing system usage.

### API logs limitations

1. **Operation scope:** Only `POST`, `PUT`, and `DELETE` requests are currently recorded in the API logs. All `GET` requests are excluded at this time.
2. **Excluded endpoints:** API calls related to metering and high-throughput ingestion, such as `POST /api/v1/events` or `POST /api/v1/batch_events`, are intentionally omitted from logging to ensure performance and scalability.

### API logs retention

Access to the API requests logs is limited to paid tiers:

1. Free users do not have access to API logs;
2. Premium users can view API logs for up to 30 days; and
3. Enterprise customers with the appropriate paid add-on can access the full API log history without time limits.

### How to access API logs

<Tabs>
  <Tab title="Dashboard">
    Only organization admins can access API Logs through the Developers Console.
    To view the logs:

    1. Click the **Developers** icon in the navigation sidebar;
    2. Select the **API Logs** tab; and
    3. View paginated activity logs directly in this section.

    <Frame caption="API logs in the Developers Console">
      <img src="https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/api-logs.png?fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=9d2f2309008b7d1275aaf70da71baa77" data-og-width="3396" width="3396" data-og-height="1964" height="1964" data-path="guide/security/images/api-logs.png" data-optimize="true" data-opv="3" srcset="https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/api-logs.png?w=280&fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=1e4c04d526d2c28d9a079f35ba436fa3 280w, https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/api-logs.png?w=560&fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=f623d743cb4cac69b96020f51bc959c2 560w, https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/api-logs.png?w=840&fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=95b7b85188ca593516335b70f89ee7bd 840w, https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/api-logs.png?w=1100&fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=19351e37fffd293ba67f5fe043a75195 1100w, https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/api-logs.png?w=1650&fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=d3267fe9cca89cff1eeb33f8b6a78fb6 1650w, https://mintcdn.com/lago-docs/ugh-mbZn6BFsC-Za/guide/security/images/api-logs.png?w=2500&fit=max&auto=format&n=ugh-mbZn6BFsC-Za&q=85&s=da5c194777702d1e25767ad9467fc5b5 2500w" />
    </Frame>
  </Tab>

  <Tab title="API">
    <CodeGroup>
      ```bash API Requests Logs theme={"dark"}
      LAGO_URL="https://api.getlago.com"
      API_KEY="__YOUR_API_KEY__"

      curl --location --request GET "$LAGO_URL/api/v1/api_logs" \
        --header "Authorization: Bearer $API_KEY" \
        --header 'Content-Type: application/json' \
      ```
    </CodeGroup>
  </Tab>
</Tabs>

### API log details

Each API log includes a set of properties that provide context about the recorded action:

* **Endpoint**: The API endpoint that was called;
* **Request ID**: A unique identifier for the request;
* **Request Method**: The HTTP method used for the request (e.g., `POST`, `PUT`, `DELETE`);
* **API key**: The API key used for the request;
* **API version**: The API version used for the request;
* **Origin**: The origin URL of the request;
* **Client**: The SDK or Client used for the request (e.g., `RubySDK`, `PythonSDK` or `PostmanRuntime/7.44.1`); and
* **HTTP status code**: The HTTP status code of the response (e.g., `200`, `400`, `404`).

In addition to the above, the **Event Payload** section provides contextual data:

* **Request Body**: The payload of the request; and
* **Response Body**: The payload of the response.

### Filtering API logs

All the fields described above can be used to filter API logs, either through the UI or programmatically via the API. Here are som key filtering behaviors to note:

**Exact Path Matching**: Supplying a full, exact path (e.g., `/api/v1/customers`) will return only requests made to that specific endpoint. It will **not** include requests to extended paths like `/api/v1/customers/123`.

**Wildcard Path Matching**: You can use wildcard patterns (e.g., `/api/v1/customers/*`) to match all sub-paths related to a resource. This is useful for retrieving all activity tied to specific objects or nested routes.