APIs for Managing Your Slack12% of the exam
Audit Logs API queries and events
How to monitor an Enterprise org with the read-only Audit Logs API: the three GET endpoints, the actor-action-entity-context shape of every event, combining filters, newest-first results with cursor pagination, and the org-wide Tier 3 rate limit that all apps share.
Monitor workspace events with the Audit Logs API.
~8 min read · 7 practice questions ·
What the exam expects
- Recommend the Audit Logs API when a security or compliance team must watch user and admin actions across an Enterprise org, for example feeding a SIEM.
- Read an audit event: who acted (actor), what they did (action), on what (entity), and where (context, including
context.app). - Build a
/logsquery witholdest,latest,limit,action,actorandentity, and predict the result and its order. - Retrieve large result sets with cursor pagination and explain the org-wide rate limit.
- Reject what the API cannot do: write or annotate events, return message content, judge whether an action was appropriate.
Key terms: audit event (one logged action: actor, action, entity, context); actor (the user who acted, by user ID); entity (the object acted on); context (the workspace or Enterprise org where it happened); SIEM (security information and event management tool that ingests the log).
Key facts
Verbs
- Detail
- GET only; no write methods
Base URL
- Detail
https://api.slack.com/audit/v1/
Unauthenticated endpoints
- Detail
/schemasand/actions;/logsrequires a token
Event shape
- Detail
- Actor takes an action on an entity within a context
Context location
- Detail
- Always a workspace or an Enterprise, with its ID
context.app- Detail
- Present only when an app triggered the event
Filter logic
- Detail
- Additive (AND);
actiontakes up to 30 comma-separated values
Page size and order
- Detail
- Max 9,999 events per request, most recent first
More results
- Detail
- Cursor-based pagination
Rate limit
- Detail
- Tier 3, about 50 calls per minute, org-wide across apps
Message content
- Detail
- Not included; use eDiscovery or DLP
- Why can't a compliance app annotate or correct audit events?
- When do two different apps hit `rate_limited` together?
- Which part of an event says whether it happened in a workspace or at the org level?
- Which Audit Logs endpoints need no token?
- How do you get more than 9,999 events?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Slack Developer pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 38 lessons of the Slack Developer guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (7 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams