Query Organization Audit Logs

POST

organizations

{organization_id}

audit-logs

query

Query Organization Audit Logs

curl --request POST \
  --url https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "user_ids": [
    "<string>"
  ],
  "user_emails": [
    "<string>"
  ],
  "exclude_user_ids": [
    "<string>"
  ],
  "exclude_user_emails": [
    "<string>"
  ],
  "types": [
    "<string>"
  ],
  "created_before": "2023-11-07T05:31:56Z",
  "created_after": "2023-11-07T05:31:56Z",
  "services": [
    "<string>"
  ],
  "user_email_search": "<string>",
  "project_ids": [
    "<string>"
  ]
}
'

import requests

url = "https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query"

payload = {
    "user_ids": ["<string>"],
    "user_emails": ["<string>"],
    "exclude_user_ids": ["<string>"],
    "exclude_user_emails": ["<string>"],
    "types": ["<string>"],
    "created_before": "2023-11-07T05:31:56Z",
    "created_after": "2023-11-07T05:31:56Z",
    "services": ["<string>"],
    "user_email_search": "<string>",
    "project_ids": ["<string>"]
}
headers = {
    "Authorization": "Basic <encoded-value>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    user_ids: ['<string>'],
    user_emails: ['<string>'],
    exclude_user_ids: ['<string>'],
    exclude_user_emails: ['<string>'],
    types: ['<string>'],
    created_before: '2023-11-07T05:31:56Z',
    created_after: '2023-11-07T05:31:56Z',
    services: ['<string>'],
    user_email_search: '<string>',
    project_ids: ['<string>']
  })
};

fetch('https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'user_ids' => [
        '<string>'
    ],
    'user_emails' => [
        '<string>'
    ],
    'exclude_user_ids' => [
        '<string>'
    ],
    'exclude_user_emails' => [
        '<string>'
    ],
    'types' => [
        '<string>'
    ],
    'created_before' => '2023-11-07T05:31:56Z',
    'created_after' => '2023-11-07T05:31:56Z',
    'services' => [
        '<string>'
    ],
    'user_email_search' => '<string>',
    'project_ids' => [
        '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Basic <encoded-value>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query"

	payload := strings.NewReader("{\n  \"user_ids\": [\n    \"<string>\"\n  ],\n  \"user_emails\": [\n    \"<string>\"\n  ],\n  \"exclude_user_ids\": [\n    \"<string>\"\n  ],\n  \"exclude_user_emails\": [\n    \"<string>\"\n  ],\n  \"types\": [\n    \"<string>\"\n  ],\n  \"created_before\": \"2023-11-07T05:31:56Z\",\n  \"created_after\": \"2023-11-07T05:31:56Z\",\n  \"services\": [\n    \"<string>\"\n  ],\n  \"user_email_search\": \"<string>\",\n  \"project_ids\": [\n    \"<string>\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Basic <encoded-value>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query")
  .header("Authorization", "Basic <encoded-value>")
  .header("Content-Type", "application/json")
  .body("{\n  \"user_ids\": [\n    \"<string>\"\n  ],\n  \"user_emails\": [\n    \"<string>\"\n  ],\n  \"exclude_user_ids\": [\n    \"<string>\"\n  ],\n  \"exclude_user_emails\": [\n    \"<string>\"\n  ],\n  \"types\": [\n    \"<string>\"\n  ],\n  \"created_before\": \"2023-11-07T05:31:56Z\",\n  \"created_after\": \"2023-11-07T05:31:56Z\",\n  \"services\": [\n    \"<string>\"\n  ],\n  \"user_email_search\": \"<string>\",\n  \"project_ids\": [\n    \"<string>\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Basic <encoded-value>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"user_ids\": [\n    \"<string>\"\n  ],\n  \"user_emails\": [\n    \"<string>\"\n  ],\n  \"exclude_user_ids\": [\n    \"<string>\"\n  ],\n  \"exclude_user_emails\": [\n    \"<string>\"\n  ],\n  \"types\": [\n    \"<string>\"\n  ],\n  \"created_before\": \"2023-11-07T05:31:56Z\",\n  \"created_after\": \"2023-11-07T05:31:56Z\",\n  \"services\": [\n    \"<string>\"\n  ],\n  \"user_email_search\": \"<string>\",\n  \"project_ids\": [\n    \"<string>\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "results": [
    {
      "project_id": "<string>",
      "organization_id": "<string>",
      "service": "<string>",
      "event_category": "<string>",
      "organization_name": "<string>",
      "ttl_timestamp": "2023-11-07T05:31:56Z",
      "created": "2023-11-07T05:31:56Z",
      "id": "<string>",
      "was_impersonated_by_staff": true,
      "entity": {
        "entity_id": "<string>",
        "entity_name": "<string>",
        "payload": {},
        "action": "<string>",
        "entity_type": "<string>",
        "type": "<string>"
      },
      "client_ip": "<string>",
      "http_method": "<string>",
      "http_request_headers": {},
      "http_request_size": 123,
      "http_response_headers": {},
      "http_response_size": 123,
      "http_status": 123,
      "http_url": "<string>",
      "http_user_agent": "<string>",
      "project_name": "<string>",
      "user_email": "<string>",
      "user_id": "<string>",
      "user_roles": "<string>"
    }
  ],
  "pagination": {
    "previous_cursor": "<string>",
    "next_cursor": "<string>"
  }
}

{
  "status": 123,
  "title": "<string>",
  "type": "<string>",
  "instance": "<string>",
  "detail": "<string>",
  "error_id": "<string>",
  "errors": [
    {
      "type": "<string>",
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "ctx": {}
    }
  ]
}

{
  "status": 123,
  "title": "<string>",
  "type": "<string>",
  "instance": "<string>",
  "detail": "<string>",
  "error_id": "<string>"
}

Permissions

The permissions required to access this endpoint. See Permissions Reference for what each role grants.

Required Permissions: view_audit_logs

Granted By Role: Owner Admin

Authorizations

Authorization

string

header

required

This endpoint uses Service Account authentication.

Headers

Mixpanel-Version

string

default:2026-08-13

Optional date-based API version pin.

If omitted, the request is served by the latest API version, and the caller accepts that a future release may introduce a breaking change to the response contract. If set to a supported version date, that version's contract is honored and will not receive a breaking change.

Path Parameters

organization_id

string

required

The unique identifier for the organization.

Query Parameters

page_size

integer

default:100

Items per page.

Required range: 1 <= x <= 100

cursor

string | null

Previous or next cursor used to paginate.

order

enum<string>

default:desc

Sort order of results: 'asc' for oldest first, 'desc' for newest first.

Available options:

asc,

desc

Body

application/json

The set of filters to apply to the audit log query. All filters are optional, and if none are provided, all audit logs for the organization will be returned.

user_ids

string[] | null

Filter to audit logs by the IDs of the users who performed the actions.

user_emails

string[] | null

Filter to audit logs by the emails of the users who performed the actions.

exclude_user_ids

string[] | null

List of user IDs to exclude from the results. Audit logs performed by these users will not be included in the response.

exclude_user_emails

string[] | null

List of user emails to exclude from the results. Audit logs performed by these users will not be included in the response.

types

string[] | null

List of entity types and actions to filter audit logs by. See https://docs.mixpanel.com/docs/access-security/audit-log-reference for a list of valid types.

created_before

string<date-time> | null

Filter to audit logs created before this timestamp.

created_after

string<date-time> | null

Filter to audit logs created after this timestamp.

services

string[] | null

Filter to audit logs that originated from these Mixpanel services, e.g. mcp, webapp.

user_email_search

string | null

Case-insensitive substring match against user email addresses.

project_ids

string[] | null

List of Project IDs to filter audit logs by. If not provided, audit logs for all projects in the organization as well as organization-level audit logs will be returned.

Response

Response model for an audit log query.

results

AuditLog · object[]

required

List of items for the current page.

Show child attributes

pagination

CursorPaginationResponse · object

required

Pagination cursors to navigate through the results.

Show child attributes

Query Organization Audit Logs

curl --request POST \
  --url https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "user_ids": [
    "<string>"
  ],
  "user_emails": [
    "<string>"
  ],
  "exclude_user_ids": [
    "<string>"
  ],
  "exclude_user_emails": [
    "<string>"
  ],
  "types": [
    "<string>"
  ],
  "created_before": "2023-11-07T05:31:56Z",
  "created_after": "2023-11-07T05:31:56Z",
  "services": [
    "<string>"
  ],
  "user_email_search": "<string>",
  "project_ids": [
    "<string>"
  ]
}
'

import requests

url = "https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query"

payload = {
    "user_ids": ["<string>"],
    "user_emails": ["<string>"],
    "exclude_user_ids": ["<string>"],
    "exclude_user_emails": ["<string>"],
    "types": ["<string>"],
    "created_before": "2023-11-07T05:31:56Z",
    "created_after": "2023-11-07T05:31:56Z",
    "services": ["<string>"],
    "user_email_search": "<string>",
    "project_ids": ["<string>"]
}
headers = {
    "Authorization": "Basic <encoded-value>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Basic <encoded-value>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    user_ids: ['<string>'],
    user_emails: ['<string>'],
    exclude_user_ids: ['<string>'],
    exclude_user_emails: ['<string>'],
    types: ['<string>'],
    created_before: '2023-11-07T05:31:56Z',
    created_after: '2023-11-07T05:31:56Z',
    services: ['<string>'],
    user_email_search: '<string>',
    project_ids: ['<string>']
  })
};

fetch('https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'user_ids' => [
        '<string>'
    ],
    'user_emails' => [
        '<string>'
    ],
    'exclude_user_ids' => [
        '<string>'
    ],
    'exclude_user_emails' => [
        '<string>'
    ],
    'types' => [
        '<string>'
    ],
    'created_before' => '2023-11-07T05:31:56Z',
    'created_after' => '2023-11-07T05:31:56Z',
    'services' => [
        '<string>'
    ],
    'user_email_search' => '<string>',
    'project_ids' => [
        '<string>'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Basic <encoded-value>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query"

	payload := strings.NewReader("{\n  \"user_ids\": [\n    \"<string>\"\n  ],\n  \"user_emails\": [\n    \"<string>\"\n  ],\n  \"exclude_user_ids\": [\n    \"<string>\"\n  ],\n  \"exclude_user_emails\": [\n    \"<string>\"\n  ],\n  \"types\": [\n    \"<string>\"\n  ],\n  \"created_before\": \"2023-11-07T05:31:56Z\",\n  \"created_after\": \"2023-11-07T05:31:56Z\",\n  \"services\": [\n    \"<string>\"\n  ],\n  \"user_email_search\": \"<string>\",\n  \"project_ids\": [\n    \"<string>\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Basic <encoded-value>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query")
  .header("Authorization", "Basic <encoded-value>")
  .header("Content-Type", "application/json")
  .body("{\n  \"user_ids\": [\n    \"<string>\"\n  ],\n  \"user_emails\": [\n    \"<string>\"\n  ],\n  \"exclude_user_ids\": [\n    \"<string>\"\n  ],\n  \"exclude_user_emails\": [\n    \"<string>\"\n  ],\n  \"types\": [\n    \"<string>\"\n  ],\n  \"created_before\": \"2023-11-07T05:31:56Z\",\n  \"created_after\": \"2023-11-07T05:31:56Z\",\n  \"services\": [\n    \"<string>\"\n  ],\n  \"user_email_search\": \"<string>\",\n  \"project_ids\": [\n    \"<string>\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://platform-us.mixpanel.com/v1/organizations/{organization_id}/audit-logs/query")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Basic <encoded-value>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"user_ids\": [\n    \"<string>\"\n  ],\n  \"user_emails\": [\n    \"<string>\"\n  ],\n  \"exclude_user_ids\": [\n    \"<string>\"\n  ],\n  \"exclude_user_emails\": [\n    \"<string>\"\n  ],\n  \"types\": [\n    \"<string>\"\n  ],\n  \"created_before\": \"2023-11-07T05:31:56Z\",\n  \"created_after\": \"2023-11-07T05:31:56Z\",\n  \"services\": [\n    \"<string>\"\n  ],\n  \"user_email_search\": \"<string>\",\n  \"project_ids\": [\n    \"<string>\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "results": [
    {
      "project_id": "<string>",
      "organization_id": "<string>",
      "service": "<string>",
      "event_category": "<string>",
      "organization_name": "<string>",
      "ttl_timestamp": "2023-11-07T05:31:56Z",
      "created": "2023-11-07T05:31:56Z",
      "id": "<string>",
      "was_impersonated_by_staff": true,
      "entity": {
        "entity_id": "<string>",
        "entity_name": "<string>",
        "payload": {},
        "action": "<string>",
        "entity_type": "<string>",
        "type": "<string>"
      },
      "client_ip": "<string>",
      "http_method": "<string>",
      "http_request_headers": {},
      "http_request_size": 123,
      "http_response_headers": {},
      "http_response_size": 123,
      "http_status": 123,
      "http_url": "<string>",
      "http_user_agent": "<string>",
      "project_name": "<string>",
      "user_email": "<string>",
      "user_id": "<string>",
      "user_roles": "<string>"
    }
  ],
  "pagination": {
    "previous_cursor": "<string>",
    "next_cursor": "<string>"
  }
}

{
  "status": 123,
  "title": "<string>",
  "type": "<string>",
  "instance": "<string>",
  "detail": "<string>",
  "error_id": "<string>",
  "errors": [
    {
      "type": "<string>",
      "loc": [
        "<string>"
      ],
      "msg": "<string>",
      "ctx": {}
    }
  ]
}

{
  "status": 123,
  "title": "<string>",
  "type": "<string>",
  "instance": "<string>",
  "detail": "<string>",
  "error_id": "<string>"
}

MIXPANEL APIs

INGESTION API

IDENTITY API

QUERY API

EVENT EXPORT API

LEXICON SCHEMAS API

DATA PIPELINES API

SERVICE ACCOUNTS API

ANNOTATIONS API

GDPR API

WAREHOUSE CONNECTORS API

FEATURE FLAGS API

FEATURE FLAGS MANAGEMENT API

EXPERIMENTS API

PLATFORM API

Query Organization Audit Logs

Permissions

Authorizations

Headers

Path Parameters

Query Parameters

Body

Response

​Permissions

Authorizations

Headers

Path Parameters

Query Parameters

Body

Response

Permissions