> ## Documentation Index
> Fetch the complete documentation index at: https://docs.co-mind.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Logs

The co-mind.ai platform maintains comprehensive audit logs for all API activity. Use audit logs for compliance reporting, security monitoring, and usage analysis.

<Note>
  Audit log access requires **JWT authentication** with **Admin** role and the `auditView` privilege.
</Note>

## Endpoint

| Endpoint               | Method | Auth        | Purpose                                       |
| ---------------------- | ------ | ----------- | --------------------------------------------- |
| `/v1/admin/audit-logs` | GET    | Admin (JWT) | Query audit logs with filters and aggregation |

## Query Audit Logs

```bash theme={null}
curl "https://your-instance/v1/admin/audit-logs?start=2025-01-01T00:00:00Z&end=2025-01-31T23:59:59Z&limit=100" \
  -H "Authorization: Bearer $JWT"
```

## Filtering

Audit logs support rich filtering to narrow down results:

| Parameter  | Type              | Description                                                   |
| ---------- | ----------------- | ------------------------------------------------------------- |
| `start`    | ISO 8601 datetime | Start of the time range                                       |
| `end`      | ISO 8601 datetime | End of the time range                                         |
| `user_id`  | string            | Filter by specific user                                       |
| `action`   | string            | Filter by action type (e.g., `chat.completion`, `auth.login`) |
| `resource` | string            | Filter by resource type                                       |
| `status`   | string            | Filter by status (`success`, `error`)                         |
| `limit`    | integer           | Maximum results to return (default: 50)                       |
| `offset`   | integer           | Pagination offset                                             |

### Filter by User

```bash theme={null}
curl "https://your-instance/v1/admin/audit-logs?user_id=user_abc123&limit=50" \
  -H "Authorization: Bearer $JWT"
```

### Filter by Action

```bash theme={null}
curl "https://your-instance/v1/admin/audit-logs?action=auth.login&status=error&limit=100" \
  -H "Authorization: Bearer $JWT"
```

## Use Cases

<CardGroup cols={2}>
  <Card title="Compliance Reporting" icon="clipboard-check">
    Generate reports showing who accessed what data, when, and from where.
  </Card>

  <Card title="Security Monitoring" icon="shield-halved">
    Track failed login attempts, unusual API patterns, and token usage.
  </Card>

  <Card title="Usage Analytics" icon="chart-bar">
    Analyze API usage by endpoint, user, model, and time period.
  </Card>

  <Card title="Incident Investigation" icon="magnifying-glass">
    Trace specific requests and responses during security incidents.
  </Card>
</CardGroup>

## Common Queries

<AccordionGroup>
  <Accordion title="Failed login attempts in the last 24 hours">
    ```bash theme={null}
    curl "https://your-instance/v1/admin/audit-logs?action=auth.login&status=error&start=$(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ)" \
      -H "Authorization: Bearer $JWT"
    ```
  </Accordion>

  <Accordion title="All chat completions by a specific user">
    ```bash theme={null}
    curl "https://your-instance/v1/admin/audit-logs?user_id=user_abc123&action=chat.completion" \
      -H "Authorization: Bearer $JWT"
    ```
  </Accordion>

  <Accordion title="Token creation and revocation events">
    ```bash theme={null}
    curl "https://your-instance/v1/admin/audit-logs?action=api-token.create&limit=100" \
      -H "Authorization: Bearer $JWT"

    curl "https://your-instance/v1/admin/audit-logs?action=api-token.revoke&limit=100" \
      -H "Authorization: Bearer $JWT"
    ```
  </Accordion>
</AccordionGroup>