# Audit Logs API queries and events

*Slack Developer Study Guide · APIs for Managing Your Slack · Last updated October 21, 2026 · https://www.certifyforce.com/study-guide/slack-developer/apis-for-managing-your-slack/audit-logs-api-queries-and-events*

How to monitor an Enterprise org with the read-only Audit Logs API: the three GET endpoints, the actor-action-entity-context shape of every event, combining filters, newest-first results with cursor pagination, and the org-wide Tier 3 rate limit that all apps share.

- Certification: Salesforce Slack Developer
- Exam section: APIs for Managing Your Slack
- Study guide: https://www.certifyforce.com/study-guide/slack-developer

**Official exam objective:**

> Monitor workspace events with the Audit Logs API.

## What the exam expects

- Recommend the Audit Logs API when a security or compliance team must watch user and admin actions across an Enterprise org, for example feeding a SIEM.
- Read an audit event: who acted (actor), what they did (action), on what (entity), and where (context, including `context.app`).
- Build a `/logs` query with `oldest`, `latest`, `limit`, `action`, `actor` and `entity`, and predict the result and its order.
- Retrieve large result sets with cursor pagination and explain the org-wide rate limit.
- Reject what the API cannot do: write or annotate events, return message content, judge whether an action was appropriate.

Key terms: **audit event** (one logged action: actor, action, entity, context); **actor** (the user who acted, by user ID); **entity** (the object acted on); **context** (the workspace or Enterprise org where it happened); **SIEM** (security information and event management tool that ingests the log).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Verbs | GET only; no write methods | [Audit Logs API](https://docs.slack.dev/reference/audit-logs-api/) |
| Base URL | `https://api.slack.com/audit/v1/` | [Methods & actions](https://docs.slack.dev/reference/audit-logs-api/methods-actions-reference/) |
| Unauthenticated endpoints | `/schemas` and `/actions`; `/logs` requires a token | [Methods & actions](https://docs.slack.dev/reference/audit-logs-api/methods-actions-reference/) |
| Event shape | Actor takes an action on an entity within a context | [Using the Audit Logs API](https://docs.slack.dev/admins/audit-logs-api/) |
| Context location | Always a workspace or an Enterprise, with its ID | [Using the Audit Logs API](https://docs.slack.dev/admins/audit-logs-api/) |
| `context.app` | Present only when an app triggered the event | [Using the Audit Logs API](https://docs.slack.dev/admins/audit-logs-api/) |
| Filter logic | Additive (AND); `action` takes up to 30 comma-separated values | [Methods & actions](https://docs.slack.dev/reference/audit-logs-api/methods-actions-reference/) |
| Page size and order | Max 9,999 events per request, most recent first | [Methods & actions](https://docs.slack.dev/reference/audit-logs-api/methods-actions-reference/) |
| More results | Cursor-based pagination | [Methods & actions](https://docs.slack.dev/reference/audit-logs-api/methods-actions-reference/) |
| Rate limit | Tier 3, about 50 calls per minute, org-wide across apps | [Methods & actions](https://docs.slack.dev/reference/audit-logs-api/methods-actions-reference/) |
| Message content | Not included; use eDiscovery or DLP | [Using the Audit Logs API](https://docs.slack.dev/admins/audit-logs-api/) |

## Check yourself

- Why can't a compliance app annotate or correct audit events?
- When do two different apps hit `rate_limited` together?
- Which part of an event says whether it happened in a workspace or at the org level?
- Which Audit Logs endpoints need no token?
- How do you get more than 9,999 events?

## Sources

- [Using the Audit Logs API](https://docs.slack.dev/admins/audit-logs-api/)
- [Audit Logs API methods & actions](https://docs.slack.dev/reference/audit-logs-api/methods-actions-reference/)
- [Audit Logs API](https://docs.slack.dev/reference/audit-logs-api/)
- [Admin resources](https://docs.slack.dev/admins/)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 7 linked practice questions, and unlimited timed mock exams are included with the Slack Developer pack (USD $19): https://www.certifyforce.com/practice-exams