Learn how to query an account's audit logs using the platform API
The audit logs in monday.com provide a detailed record of an account’s security-related activities, including login attempts, board data exports, and more. Access to these logs is restricted to account admins on the Enterprise plan.
Queries
You can retrieve audit log data via the API through the audit_logs query.
- Required permissions:
manage_account_security - Returns an object containing metadata about audit logs
- Can only be queried directly at the root; can't be nested within another query
query {
audit_logs(
user_id: 1234567890
events: [
"login"
"logout"
]
limit: 100
) {
logs {
timestamp
event
user_agent
user {
id
name
email
}
ip_address
}
pagination {
has_more_pages
next_page_number
}
}
}import { ApiClient } from "@mondaydotcomorg/api";
const mondayApiClient = new ApiClient({ token: myToken, apiVersion: "2025-07" });
const query = `query ($userId: ID!, $events: [String!]) { audit_logs(user_id: $userId, events: $events, limit: 100) { logs { timestamp event user_agent user { id name email } ip_address } pagination { has_more_pages next_page_number } } }`
const variables = {
userId: 1234567890,
events: ["login", "logout"]
}
const response = await mondayApiClient.request(query, variables);Arguments
You can use the following arguments to reduce the number of results returned in your audit_logs query.
| Argument | Description |
|---|---|
end_time ISO8601DateTime | Filters for logs up to this date and time. |
events [String!] | The specific event(s) to return logs for. You can view a list of supported events by querying the audit_event_catalogue object. |
ip_address String | The specific IP address to return logs for. |
limit Int | The number of logs per page |
page Int | The page number to get. Starts at 1. |
start_time ISO8601DateTime | Filters for logs from this date and time. |
user_id ID | The specified user to return logs for. This ID can be retrieved from the users object. |
Fields
You can use the following fields to specify what information your audit_logs query will return. Some fields support their own subfields.
Field | Description | Supported Subfields |
|---|---|---|
logs | A paginated list of audit log entries. | account_id |
pagination | Details about the object's pagination. | has_more_pages |
