---
title: "Fetch audit logs"
url: "https://developer.incode.com/api-reference/executive-events-find/"
section: "api-reference"
group: "Organization"
version: "v1.1"
status: "live"
endpoint: "POST /omni/executive-events/find"
---
# Fetch audit logs

`POST /omni/executive-events/find`

Base URL: `https://demo-api.incodesmile.com` — Incode demo environment

Use this API to retrieve records of activities performed within your organization. These logs include key events such as changes to organization settings, executive actions, updates to flows, workflows and user identities, as well as changes made to organization’s watchlist.
Note: Requires admin login token.

## Path & query parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `avoidCounting` | query | boolean |  |  |
| `pageable` | query | Pageable | yes |  |
| `api-version` | header | string | yes |  |

## Request body

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `codes` | array[string] |  |  |
| `before` | string (date-time) |  |  |
| `after` | string (date-time) |  |  |
| `executiveIds` | array[string] |  |  |
| `entityTypes` | array[string] |  |  |
| `entityIds` | array[string] |  |  |
| `applications` | array[string] |  |  |
| `email` | string |  |  |
| `ipAddress` | string |  |  |
| `userAgent` | string |  |  |

## Responses

### 200

OK

Response body (`application/json`):

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `content` | array[ExecutiveEventDto] |  |  |
| `content.id` | string |  |  |
| `content.code` | string |  | Enum: `SESSION_DELETED`, `IDENTITY_DELETED`, `SESSION_FACE_ADDED`, `IDENTITY_FACE_ADDED`, `SESSION_MANUALLY_APPROVED`, `SESSION_MANUALLY_REJECTED`, `SESSION_VIEWED`, `SESSIONS_VIEWED`, `SESSION_PDF_DOWNLOADED`, `LOGIN_ATTEMPT`, `LOGOUT`, `USER_CREATED`, `USER_DELETED`, `USER_UPDATED`, `CONFIGURATION_CREATE`, `CONFIGURATION_CLONED`, `CONFIGURATION_RESET`, `CONFIGURATION_UPDATE`, `FLOW_CREATE`, `FLOW_UPDATE`, `FLOW_DELETE`, `FLOW_CLONE`, `IDENTITIES_REPORT_GENERATED`, `SESSIONS_REPORT_GENERATED`, `AUTHENTICATIONS_REPORT_GENERATED`, `WATCH_LISTS_REPORT_GENERATED`, `USERS_REPORT_GENERATED`, `DOUBLE_CHECK_RECORD_FETCHED`, `DOUBLE_CHECK_RECORD_UPDATED`, `DOUBLE_CHECK_FINISHED`, `SESSION_ANTIFRAUD_RESOLVED`, `WATCH_LISTS_ENTRY_CREATED`, `GOVERNMENT_VERIFICATION_PROVIDERS_UPDATED`, `GOVERNMENT_VERIFICATION_PROVIDERS_CREATED`, `GOVERNMENT_VERIFICATION_PROVIDERS_DELETED`, `WATCHLIST_PROVIDER_SETTINGS_CREATED`, `WATCHLIST_PROVIDER_SETTINGS_UPDATED`, `WATCHLIST_PROVIDER_SETTINGS_DELETED`, `PAYMENTS_PROVIDER_SETTINGS_CREATED`, `PAYMENTS_PROVIDER_SETTINGS_UPDATED`, `PAYMENTS_PROVIDER_SETTINGS_DELETED`, `PERSONAL_IDENTIFICATION_NUMBER_PROVIDERS_UPDATED`, `PERSONAL_IDENTIFICATION_NUMBER_PROVIDERS_DELETED`, `PERSONAL_IDENTIFICATION_NUMBER_PROVIDERS_CREATED`, `EKYB_PROVIDERS_UPDATED`, `EKYB_PROVIDERS_CREATED`, `EKYB_PROVIDERS_DELETED`, `EKYC_PROVIDERS_CREATED`, `EKYC_PROVIDERS_UPDATED`, `EKYC_PROVIDERS_DELETED`, `QES_PROVIDERS_UPDATED`, `QES_PROVIDERS_DELETED`, `QES_PROVIDERS_CREATED`, `GENERAL_PROVISIONING_SETTINGS_UPDATED`, `MODULES_PROVISIONING_SETTINGS_UPDATED`, `WORKFLOW_CREATED`, `WORKFLOW_IMPORTED`, `WORKFLOW_EDITED`, `WORKFLOW_UPDATED`, `WORKFLOW_DELETED`, `WORKFLOW_ACTIVATED`, `WORKFLOW_PAUSED`, `CONSENT_CREATED`, `CONSENT_UPDATED`, `CONSENT_DELETED`, `FRAUD_REPORTED`, `FRAUD_REPORT_REVOKED`, `WEBHOOK_CREATED`, `WEBHOOK_UPDATE`, `WEBHOOK_DELETE`, `WEBHOOK_AUTH_CONFIG_CREATE`, `WEBHOOK_AUTH_CONFIG_UPDATE`, `DATA_DELETION_UPDATE`, `WATCHLIST_ENTRY_DELETED`, `WATCHLIST_ENTRY_UPDATED`, `WATCHLIST_LIST_VIEWED`, `AUTHENTICATION_LIST_VIEWED`, `IDENTITY_VIEWED`, `SESSION_LIST_VIEWED`, `IDENTITY_LIST_VIEWED`, `AUDIT_LOG_REPORT_GENERATED`, `SINGLE_SESSION_REPORT_GENERATED`, `DATA_DELETION_DISABLE`, `FACE_ADDED_TO_DATABASE`, `SELFIE_ADDED_TO_IDENTITY_TEMPLATE`, `FRAUD_RING_RENAMED`, `FRAUD_RING_NOTE_ADDED` |
| `content.timestamp` | string (date-time) |  |  |
| `content.executiveId` | string |  |  |
| `content.managedEntityType` | string |  | Enum: `SESSION`, `IDENTITY`, `EXECUTIVE`, `FLOW`, `CONFIGURATION`, `WORKFLOW`, `WATCHLIST`, `PROVISIONING`, `CONSENT`, `DATA`, `WEBHOOK`, `AUDIT_LOG`, `AUTHENTICATION`, `USER`, `FRAUD_RING` |
| `content.managedEntityId` | string |  |  |
| `content.payload` | object |  |  |
| `content.apiKey` | string |  |  |
| `content.role` | string |  | Enum: `OPEN`, `STATISTICS`, `LIMITED`, `INCODE_IDENTITY`, `INCODE_ID_USER`, `ACCESS`, `AUTHENTICATOR`, `REFRESH`, `REGISTER`, `INCODE_ID_CLIENT`, `EXECUTIVE`, `ADMIN`, `SCIM_ADMIN`, `MULTI_ORG_ADMIN`, `INTEGRATOR`, `INCODE_EXECUTIVE`, `INCODE_ADMIN`, `WIDGET_CLIENT`, `INTERNAL_SERVICE`, `AUTHORIZATION_SERVER`, `KEYCLOAK_SESSION`, `HIPAA_ADMIN`, `HIPAA_VIEWER`, `WORKFORCE_ADMIN`, `WORKFORCE_HELPDESK_STAFF`, `WORKFORCE_RECRUITER`, `SERVER`, `IDENTITY_SERVICE`, `TRUST_GRAPH_DATA_LOADER` |
| `content.application` | string |  | Enum: `USER_SERVICE` |
| `content.ipAddress` | string |  |  |
| `content.userAgent` | string |  |  |
| `content.email` | string |  |  |
| `page` | Page |  |  |
| `page.size` | integer (int32) |  |  |
| `page.totalElements` | integer (int64) |  |  |
| `page.totalPages` | integer (int64) |  |  |
| `page.currentPageNumber` | integer (int32) |  |  |
| `total` | integer (int64) |  |  |
| `more` | boolean |  |  |

### 400

Bad Request

Response body (`application/json`):

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `timestamp` | integer (int64) |  | UTC timestamp in milliseconds |
| `status` | integer (int32) |  | Custom error code or HTTP status code |
| `error` | string |  | HTTP status error |
| `message` | string |  | Custom error message |
| `path` | string |  | Endpoint path |
| `details` | object |  | Custom error details |

## Code samples

Generated from this endpoint's method, path, and the conventional Incode headers. The base URL is the Incode demo environment; replace `<YOUR_API_KEY>` with a key for your region.

### cURL

```bash
curl -X POST https://demo-api.incodesmile.com/omni/executive-events/find \
  -H "x-api-key: <YOUR_API_KEY>" \
  -H "api-version: 1.0" \
  -H "Content-Type: application/json" \
  -d '{
    "codes": [],
    "before": "",
    "after": "",
    "executiveIds": [],
    "entityTypes": [],
    "entityIds": [],
    "applications": [],
    "email": "",
    "ipAddress": "",
    "userAgent": ""
  }'
```

### Node

```js
const res = await fetch("https://demo-api.incodesmile.com/omni/executive-events/find", {
  method: "POST",
  headers: {
      "x-api-key": "<YOUR_API_KEY>",
      "api-version": "1.0",
      "Content-Type": "application/json",
  },
    body: JSON.stringify({
      "codes": [],
      "before": "",
      "after": "",
      "executiveIds": [],
      "entityTypes": [],
      "entityIds": [],
      "applications": [],
      "email": "",
      "ipAddress": "",
      "userAgent": ""
    }),
});
const data = await res.json();
```

### Python

```python
import requests

headers = {
    "x-api-key": "<YOUR_API_KEY>",
    "api-version": "1.0",
    "Content-Type": "application/json",
}
res = requests.post("https://demo-api.incodesmile.com/omni/executive-events/find", headers=headers, json={
  "codes": [],
  "before": "",
  "after": "",
  "executiveIds": [],
  "entityTypes": [],
  "entityIds": [],
  "applications": [],
  "email": "",
  "ipAddress": "",
  "userAgent": ""
})
data = res.json()
```

### Java

```java
HttpRequest req = HttpRequest.newBuilder()
    .uri(URI.create("https://demo-api.incodesmile.com/omni/executive-events/find"))
    .header("x-api-key", "<YOUR_API_KEY>")
    .header("api-version", "1.0")
    .header("Content-Type", "application/json")
    .method("POST", HttpRequest.BodyPublishers.ofString("{\n  \"codes\": [],\n  \"before\": \"\",\n  \"after\": \"\",\n  \"executiveIds\": [],\n  \"entityTypes\": [],\n  \"entityIds\": [],\n  \"applications\": [],\n  \"email\": \"\",\n  \"ipAddress\": \"\",\n  \"userAgent\": \"\"\n}"))
    .build();
HttpResponse<String> res = HttpClient.newHttpClient()
    .send(req, HttpResponse.BodyHandlers.ofString());
```

### Example response

```json
{
  "success": true,
  "status": "OK"
}
```