API Reference

Organizations

Copy Markdown

Open in Claude

Open in ChatGPT

Open in Cursor

---

Copy Markdown

View as Markdown

Logs

LogsAudit

Get organization audit logs (Version 2)

organizations.logs.audit.list(strorganization_id, AuditListParams**kwargs) -> SyncCursorPaginationAfter[AuditListResponse]

GET/organizations/{organization_id}/logs/audit

Get resource change history from an organization audit log entry (Version 2)

organizations.logs.audit.history(strid, AuditHistoryParams**kwargs) -> AuditHistoryResponse

GET/organizations/{organization_id}/logs/audit/{id}/history

ModelsExpand Collapse

class AuditListResponse: …

id: Optional[str]

A unique identifier for the audit log entry.

maxLength32

action: Optional[Action]

Provides information about the action performed.

description: Optional[str]

A short description of the action performed.

result: Optional[str]

The result of the action, indicating success or failure.

time: Optional[datetime]

A timestamp indicating when the action was logged.

formatdate-time

type: Optional[str]

A short string that describes the action that was performed.

actor: Optional[Actor]

Provides details about the actor who performed the action.

id: Optional[str]

The ID of the actor who performed the action. If a user performed the action, this will be their User ID.

context: Optional[Literal["api", "api_key", "api_token", 3 more]]

The context in which the action was initiated.

• api: The action was performed through the API. The specific credential type was not recorded.
• api_key: The action was authenticated with a Cloudflare Global API Key.
• api_token: The action was authenticated with an API token.
• dash: The action was performed through the Cloudflare dashboard.
• oauth: The action was authenticated with an OAuth token.
• origin_ca_key: The action was authenticated with an Origin CA key.

One of the following:

"api"

"api_key"

"api_token"

"dash"

"oauth"

"origin_ca_key"

email: Optional[str]

The email of the actor who performed the action.

formatemail

ip_address: Optional[str]

The IP address of the request that performed the action.

token_id: Optional[str]

The API token ID when the actor context is an api_token or oauth.

token_name: Optional[str]

The API token name when the actor context is an api_token or oauth.

type: Optional[Literal["cloudflare_admin", "system", "user"]]

The type of actor.

One of the following:

"cloudflare_admin"

"system"

"user"

organization: Optional[Organization]

Contains organization related information.

id: Optional[str]

A unique identifier for the organization.

raw: Optional[Raw]

Provides raw information about the request and response.

cf_rayid: Optional[str]

The Cloudflare Ray ID for the request.

method: Optional[str]

The HTTP method of the request.

status_code: Optional[int]

The HTTP response status code returned by the API.

uri: Optional[str]

The URI of the request.

user_agent: Optional[str]

The client’s user agent string sent with the request.

resource: Optional[Resource]

Provides details about the affected resource.

id: Optional[str]

The unique identifier for the affected resource.

product: Optional[str]

The Cloudflare product associated with the resource.

request: Optional[object]

response: Optional[object]

scope: Optional[object]

The scope of the resource.

type: Optional[str]

The type of the resource.

List[AuditHistoryResponseItem]

id: Optional[str]

A unique identifier for the audit log entry.

maxLength32

action: Optional[AuditHistoryResponseItemAction]

Provides information about the action performed.

description: Optional[str]

A short description of the action performed.

result: Optional[str]

The result of the action, indicating success or failure.

time: Optional[datetime]

A timestamp indicating when the action was logged.

formatdate-time

type: Optional[str]

A short string that describes the action that was performed.

actor: Optional[AuditHistoryResponseItemActor]

Provides details about the actor who performed the action.

id: Optional[str]

The ID of the actor who performed the action. If a user performed the action, this will be their User ID.

context: Optional[Literal["api", "api_key", "api_token", 3 more]]

The context in which the action was initiated.

• api: The action was performed through the API. The specific credential type was not recorded.
• api_key: The action was authenticated with a Cloudflare Global API Key.
• api_token: The action was authenticated with an API token.
• dash: The action was performed through the Cloudflare dashboard.
• oauth: The action was authenticated with an OAuth token.
• origin_ca_key: The action was authenticated with an Origin CA key.

One of the following:

"api"

"api_key"

"api_token"

"dash"

"oauth"

"origin_ca_key"

email: Optional[str]

The email of the actor who performed the action.

formatemail

ip_address: Optional[str]

The IP address of the request that performed the action.

token_id: Optional[str]

The API token ID when the actor context is an api_token or oauth.

token_name: Optional[str]

The API token name when the actor context is an api_token or oauth.

type: Optional[Literal["cloudflare_admin", "system", "user"]]

The type of actor.

One of the following:

"cloudflare_admin"

"system"

"user"

organization: Optional[AuditHistoryResponseItemOrganization]

Contains organization related information.

id: Optional[str]

A unique identifier for the organization.

raw: Optional[AuditHistoryResponseItemRaw]

Provides raw information about the request and response.

cf_rayid: Optional[str]

The Cloudflare Ray ID for the request.

method: Optional[str]

The HTTP method of the request.

status_code: Optional[int]

The HTTP response status code returned by the API.

uri: Optional[str]

The URI of the request.

user_agent: Optional[str]

The client’s user agent string sent with the request.

resource: Optional[AuditHistoryResponseItemResource]

Provides details about the affected resource.

id: Optional[str]

The unique identifier for the affected resource.

product: Optional[str]

The Cloudflare product associated with the resource.

request: Optional[object]

response: Optional[object]

scope: Optional[object]

The scope of the resource.

type: Optional[str]

The type of the resource.