Postman Audit Logs API
Enterprise-only Audit Logs API exposing team audit events (user actions, configuration changes, security events) for SIEM ingestion and compliance reporting (SOC 2, GDPR, ISO).
OpenAPI Specification
openapi: 3.1.0
info:
title: Postman APIs API Comments Audit Logs API
description: 'The Postman APIs API enables you to manage your API definitions in Postman''s
API Builder. You can create APIs, manage versions, add schemas (OpenAPI,
GraphQL, etc.), and link collections, environments, mock servers, monitors,
and documentation to your API definitions.
## Authentication
All requests require an API key passed in the `x-api-key` header.
## Rate Limits
Standard Postman API rate limits apply.
'
version: 1.0.0
contact:
name: Postman Developer Support
url: https://learning.postman.com/docs/developer/postman-api/intro-api/
email: help@postman.com
license:
name: Postman Terms of Service
url: https://www.postman.com/legal/terms/
servers:
- url: https://api.getpostman.com
description: Postman Production API Server
security:
- apiKeyAuth: []
tags:
- name: Audit Logs
description: Operations for accessing team audit logs.
paths:
/audit/logs:
get:
tags:
- Audit Logs
summary: Postman Get audit logs
operationId: getAuditLogs
description: Gets team audit log events. You can filter by date range, event name, and user. Audit logs include user sign-ins, collection changes, workspace modifications, team membership changes, and other security and governance events.
parameters:
- name: since
in: query
description: Return audit events since this date (ISO 8601).
required: false
schema:
type: string
format: date-time
- name: until
in: query
description: Return audit events until this date (ISO 8601).
required: false
schema:
type: string
format: date-time
- name: limit
in: query
description: Maximum number of results to return.
required: false
schema:
type: integer
default: 50
maximum: 300
- name: cursor
in: query
description: Pagination cursor for the next page of results.
required: false
schema:
type: string
- name: orderBy
in: query
description: Sort order for results.
required: false
schema:
type: string
enum:
- asc
- desc
default: desc
responses:
'200':
description: Successful response with audit log events
content:
application/json:
schema:
type: object
properties:
trails:
type: array
items:
$ref: '#/components/schemas/AuditEvent'
meta:
type: object
properties:
nextCursor:
type: string
description: Cursor for the next page of results
total:
type: integer
'401':
$ref: '#/components/responses/UnauthorizedError'
'403':
$ref: '#/components/responses/ForbiddenError'
'429':
$ref: '#/components/responses/RateLimitError'
'500':
$ref: '#/components/responses/InternalServerError'
components:
responses:
ForbiddenError:
description: Insufficient permissions - Enterprise plan required
content:
application/json:
schema:
type: object
properties:
error:
type: object
properties:
name:
type: string
message:
type: string
UnauthorizedError:
description: Authentication credentials are missing or invalid
content:
application/json:
schema:
type: object
properties:
error:
type: object
properties:
name:
type: string
message:
type: string
RateLimitError:
description: Too many requests - rate limit exceeded
content:
application/json:
schema:
type: object
properties:
error:
type: string
message:
type: string
InternalServerError:
description: An unexpected error occurred on the server
content:
application/json:
schema:
type: object
properties:
error:
type: object
properties:
name:
type: string
message:
type: string
schemas:
AuditEvent:
type: object
description: An audit log event tracking a user action or system event.
properties:
id:
type: string
description: The unique ID of the audit event
ip:
type: string
description: The IP address of the user who performed the action
userAgent:
type: string
description: The user agent string from the request
action:
type: string
description: The action that was performed. Common actions include user.sign_in, team.member_added, collection.created, workspace.created, api_key.created, etc.
example: user.sign_in
timestamp:
type: string
format: date-time
description: When the event occurred
message:
type: string
description: A human-readable description of the event
user:
type: object
description: The user who performed the action
properties:
id:
type: integer
name:
type: string
email:
type: string
format: email
username:
type: string
data:
type: object
description: Additional context data about the event. The structure varies by event type.
additionalProperties: true
properties:
team:
type: object
properties:
id:
type: integer
name:
type: string
actor:
type: object
properties:
id:
type: integer
name:
type: string
email:
type: string
variables:
type: object
additionalProperties: true
securitySchemes:
apiKeyAuth:
type: apiKey
name: x-api-key
in: header
description: Postman API key for authentication.