# List audit events

> Lists an organization's audit events, newest first, with the filters of Account → Audit: a date range, a person, actions and a patient. Each event names its action with a dotted name such as chat.viewed, the same name the audit log's CSV export uses. In BloomText today, Owners and IT see the audit log under Settings → Account → Audit and download it as CSV.

Source: https://www.bloomtext.com/developers/api/reference/list-audit-events/

> Your BloomText team turns this on for your account. [Request access](https://calendly.com/tyler-bloom/bloomtext-homepage-demo-request?utm_campaign=api-access&utm_content=audit-events)

`GET /audit-events`

Lists an organization's audit events, newest first, with the filters of Account → Audit: a date range, a person, actions and a patient. Each event names its action with a dotted name such as `chat.viewed`, the same name the audit log's CSV export uses. In BloomText today, Owners and IT see the audit log under Settings → Account → Audit and download it as CSV.

**Credentials:** [API key](https://www.bloomtext.com/developers/api/api-keys/) with member scopes · **Scope:** `audit.read`

[Run in Postman](https://www.bloomtext.com/developers/api/postman/bloomtext-api.postman_collection.json): import the collection and set `api_key`.

### Query parameters

- `org_id` (UUID): The organization the call acts on, from List organizations. Required when an account API key reaches more than one organization; an organization key or a key limited to one organization can leave it out.

- `after` (string): Only messages sent at or after this time. An RFC 3339 timestamp, or a date for midnight in the organization's time zone.

- `before` (string): Only messages sent before this time. Same format as `after`.

- `actor_id` (UUID): Only events this person did, by user ID.

- `action` (array of AuditAction): Only these actions, by dotted name. Repeat the parameter for several.

- `patient_id` (UUID): Only events about this patient.

- `page[limit]` (integer): Number of records to return. Defaults to 50, maximum 100.

- `page[after]` (string): Cursor from the previous page's `pagination.next_cursor`.

### Returns

Returns `200 OK` with a `data` array of [Audit event object](https://www.bloomtext.com/developers/api/reference/audit-event-object/)s and a `pagination` object. See [pagination](https://www.bloomtext.com/developers/api/pagination/).

### Errors

Failed requests return `application/problem+json` [problem details](https://www.bloomtext.com/developers/api/errors/). The errors specific to this endpoint:

| Status | Code | Meaning |
| --- | --- | --- |
| 400 | `invalid_request` | The request is malformed, such as invalid JSON. |
| 400 | `org_id_required` | The key reaches more than one organization: pass `org_id`. |
| 401 | `invalid_token` | The API key is missing or malformed, or isn’t a BloomText key. |
| 401 | `key_revoked` | The API key was revoked. |
| 401 | `key_expired` | The API key’s expiry has passed. |
| 403 | `insufficient_scope` | The key doesn’t have the scope this endpoint needs. |
| 403 | `org_not_reachable` | The key can't reach the organization in `org_id`. |
| 403 | `accounts_not_enabled` | The account layer isn't turned on for this account yet. |
| 429 | `rate_limited` | Too many requests. Retry after `Retry-After` seconds. |

```bash filename="Request"
curl "https://api.bloomtext.com/v1/audit-events?after=2026-09-21T00:00:00Z" \
  -H "Authorization: Bearer $BLOOMTEXT_API_KEY"
```

```js filename="Request"
const response = await fetch('https://api.bloomtext.com/v1/audit-events?after=2026-09-21T00:00:00Z', {
  headers: {
    Authorization: `Bearer ${process.env.BLOOMTEXT_API_KEY}`,
  },
})

if (!response.ok) throw new Error(`BloomText API error: ${response.status}`)
const data = await response.json()
```

```python filename="Request"
import os

import requests

response = requests.get(
    "https://api.bloomtext.com/v1/audit-events?after=2026-09-21T00:00:00Z",
    headers={
        "Authorization": f"Bearer {os.environ['BLOOMTEXT_API_KEY']}",
    },
)
response.raise_for_status()
data = response.json()
```

```go filename="Request"
package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.bloomtext.com/v1/audit-events?after=2026-09-21T00:00:00Z", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Authorization", "Bearer "+os.Getenv("BLOOMTEXT_API_KEY"))

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	out, _ := io.ReadAll(res.Body)
	fmt.Println(res.Status, string(out))
}
```

```ruby filename="Request"
require "net/http"
require "json"

uri = URI("https://api.bloomtext.com/v1/audit-events?after=2026-09-21T00:00:00Z")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer #{ENV.fetch("BLOOMTEXT_API_KEY")}"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end
data = JSON.parse(response.body)
```

```json filename="Response · 200 OK"
{
  "data": [
    {
      "id": "8b9c2d2f-6b1a-44f4-a7b1-0d6d3f2d6f55",
      "org_id": "8b9c2d2f-6b1a-44f4-a7b1-0d6d3f2d6f55",
      "occurred_at": "2026-09-21T15:04:05Z",
      "action": "audit_log.exported",
      "actor": {
        "id": "8b9c2d2f-6b1a-44f4-a7b1-0d6d3f2d6f55",
        "name": "string",
        "is_support": false
      },
      "member_id": "8b9c2d2f-6b1a-44f4-a7b1-0d6d3f2d6f55",
      "patient_id": "8b9c2d2f-6b1a-44f4-a7b1-0d6d3f2d6f55",
      "conversation_id": "e5c3b7b8-8f08-4d5a-9af1-0d11b0f4b7a0",
      "team_id": "8b9c2d2f-6b1a-44f4-a7b1-0d6d3f2d6f55",
      "details": "string"
    }
  ],
  "pagination": {
    "next_cursor": null,
    "has_more": false
  }
}
```