# Audit logs (/cli/audit-logs)





Read organization audit actions and filter by actor, resource, workspace, or time.

Requires an organization Admin or owner, an OAuth login or personal API key, and enabled enterprise audit access for the deployment.

`sim audit-logs` is also spelled `sim audit-log`.

These commands accept the [global options](/cli/commands#global-options).

## List audit logs [#list-audit-logs]

OAuth login or personal API key required.

```bash
sim audit-logs list [options]
```

**Options**

<CommandTable>
  | Option | Required | Description |
  | - | - | - |
  | `--action <value>` | No | Filter by exact action name. |
  | `--resource-type <value>` | No | Filter by resource type. Accepts a comma-separated set; members are trimmed and deduplicated, and member order affects neither the result nor the cursor. |
  | `--resource-id <value>` | No | Filter by exact resource identifier. |
  | `--start-date <value>` | No | Include audit entries created at or after this UTC ISO 8601 timestamp, such as `2026-08-06T00:00:00Z`. Dates without a time, timestamps with an offset instead of `Z`, and year `0000` are rejected. |
  | `--end-date <value>` | No | Include audit entries created at or before this UTC ISO 8601 timestamp, such as `2026-08-06T00:00:00Z`. Dates without a time, timestamps with an offset instead of `Z`, and year `0000` are rejected. |
  | `--include-departed` | No | Include actions by users who have left the organization. |
  | `--no-include-departed` | No | Send --include-departed as false. |
  | `--limit <n>` | No | Maximum items to return (0 for everything). Defaults to `100`. |
  | `--cursor <value>` | No | Continue from nextCursor returned by a previous result. |
  | `--organization <value>` | No | Organization whose audit trail to read; defaults to the caller’s organization. A caller that belongs to no organization, or names one it does not belong to, is refused with 403. |
  | `--actor-email <value>` | No | Filter by actor email address. |
  | `--all-workspaces` | No | Do not filter to the configured workspace (OAuth login or personal API key required for account-wide access). |
</CommandTable>

API request and response schemas: [listAuditLogs](/api-reference/audit-logs/listAuditLogs).

## Get audit log [#get-audit-log]

OAuth login or personal API key required.

```bash
sim audit-logs get <auditLogId> [options]
```

**Arguments**

<CommandTable>
  | Argument | Required | Description |
  | - | - | - |
  | `auditLogId` | Yes | Audit-log entry identifier. |
</CommandTable>

**Options**

<CommandTable>
  | Option | Required | Description |
  | - | - | - |
  | `--organization <value>` | No | Organization whose audit trail to read; defaults to the caller’s organization. A caller that belongs to no organization, or names one it does not belong to, is refused with 403. |
</CommandTable>

API request and response schemas: [getAuditLog](/api-reference/audit-logs/getAuditLog).

## Related docs [#related-docs]

* [Organization permissions](/platform/permissions)
* [Authentication](/cli/authentication)