The Audit Log Configuration endpoint provides a single view of an organization’s audit logging setup. It includes retention settings (how long audit logs are stored), the audit log state (active, inactive, or disabled), and – if configured – the audit log stream, which sends events to external destinations like Splunk, Datadog, S3, Google Cloud Storage, or a custom HTTPS endpoint.
The log_stream field is optional and only appears if the organization has a stream configured. If no stream is set up, the response includes only the audit log retention and state information.
curl "https://api.workos.com/organizations/org_01EHZNVPK3SFK441A1RGBFSHRT/audit_log_configuration" \ --header "Authorization: Bearer sk_example_123456789"
{ "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT", "retention_period_in_days": 30, "state": "active", "log_stream": { "id": "als_01EHZNVPK3SFK441A1RGBFSHRT", "type": "Datadog", "state": "active", "last_synced_at": "2026-01-15T12:00:00.000Z", "created_at": "2026-01-15T12:00:00.000Z" } }
{ "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT", "retention_period_in_days": 30, "state": "active" }
| curl "https://api.workos.com/organizations/org_01EHZNVPK3SFK441A1RGBFSHRT/audit_log_configuration" \ | |
| --header "Authorization: Bearer sk_example_123456789" |
| { | |
| "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "retention_period_in_days": 30, | |
| "state": "active", | |
| "log_stream": { | |
| "id": "als_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "type": "Datadog", | |
| "state": "active", | |
| "last_synced_at": "2026-01-15T12:00:00.000Z", | |
| "created_at": "2026-01-15T12:00:00.000Z" | |
| } | |
| } |
| { | |
| "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT", | |
| "retention_period_in_days": 30, | |
| "state": "active" | |
| } |
GET/organizationsParameters Returns