On this page

For AI agents: a documentation index is available at /docs/llms.txt. Append .md to any page URL for markdown, or send Accept: text/markdown.

Audit Logs API

The Audit Logs API exports audit events for security monitoring, compliance reporting, and operational oversight.

Prerequisites

  • An Organization API key
  • An Organization Secret Key from Amplitude Support
  • Your Organization ID

Retrieve audit events

To retrieve audit events and export them to a SIEM or internal workflow:

  1. Contact Amplitude Support, provide your Organization ID, and request your Organization API key and Organization Secret Key.
  2. Send a POST request to your organization's endpoint. Use Basic authentication with your Organization API key and Organization Secret Key.
    • Standard endpoint: https://amplitude.com/api/2/audit-logs/{ORG_ID}
    • EU endpoint: https://analytics.eu.amplitude.com/api/2/audit-logs/{ORG_ID}

Amplitude returns audit events for the organization in the response.

Example request

bash
curl -X POST "https://amplitude.com/api/2/audit-logs/76273" \
  -H "Authorization: Basic Base64<ORG_API_KEY:ORG_SECRET_KEY>" \
  -H "Content-Type: application/json" \
  -d '{
    "start_date": "2026-01-01T00:00:00Z",
    "end_date": "2026-01-10T23:59:59Z",
    "filters": {
      "domain": "auth",
      "feature": "auth",
      "action": "login"
    },
    "pagination": {
      "limit": 100
    }
  }'

Required parameters

ParameterTypeRequiredDescription
start_dateStringYesStart of the date range in ISO 8601 format.
end_dateStringYesEnd of the date range in ISO 8601 format.

All other fields are optional and refine the query. The maximum query range is 30 days. Amplitude retains audit data for 90 days.

Common use cases

Integrate with a SIEM

Export audit events to your SIEM to monitor administrative activity and detect anomalous access patterns.

Support compliance reporting

Collect audit events to support compliance workflows, such as SOC 2, ISO 27001, and HIPAA reporting.

Investigate security incidents

Review audit events to trace administrative actions and support forensic investigations.

Common questions

How to get an Organization API key and Organization Secret Key

Contact Amplitude Support and provide your Organization ID. Amplitude Support issues both the Organization API key and the Organization Secret Key. The Organization API key isn't available in the Amplitude UI.

EU endpoint

EU-hosted organizations must use https://analytics.eu.amplitude.com/api/2/audit-logs/{ORG_ID}.

Was this helpful?