> Documentation index for AI agents: https://docs.pagerduty.com/llms.txt

# List audit records for a user

`GET https://api.pagerduty.com/users/{id}/audit/records`

The response will include audit records with changes that are made to the identified user not changes made by the identified user.

The returned records are sorted by the `execution_time` from newest to oldest.

See [`Cursor-based pagination`](https://docs.pagerduty.com/developer/pagination) for instructions on how to paginate through the result set.

For more information see the [Audit API Document](https://docs.pagerduty.com/developer/audit-records-api).

Scoped OAuth requires: `audit_records.read`

## Authorization

- **api_key** (apiKey) — `Authorization` header. The API Key with format `Token token=<API_KEY>`

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `id` | string | yes | The ID of the resource. |

## Query parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `limit` | integer |  | The minimum of the `limit` parameter used in the request or the maximum request size of the API. |
| `cursor` | string |  | Optional parameter used to request the "next" set of results from an API. The value provided here is most commonly obtained from the `next_cursor` field of the previous request. When no value is provided, the request starts at the beginning of the result set. |
| `since` | string (date-time) |  | The start of the date range over which you want to search. If not specified, defaults to `now() - 24 hours` (past 24 hours) |
| `until` | string (date-time) |  | The end of the date range over which you want to search. If not specified, defaults to `now()`. May not be more than 31 days after `since`. |

## Header parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `Accept` | string | yes | The `Accept` header is used as a versioning header. Default: `application/vnd.pagerduty+json;version=2`. |

## Response 200

Records matching the query criteria.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `records` | array of object | yes |  |
| `records[].id` | string | yes |  |
| `records[].self` | string \| null |  | Record URL. |
| `records[].execution_time` | string (date-time) | yes | The date/time the action executed, in ISO8601 format and millisecond precision. |
| `records[].execution_context` | object \| null |  | Action execution context. |
| `records[].execution_context.request_id` | string \| null |  | Request Id. |
| `records[].execution_context.remote_address` | string \| null |  | remote address. |
| `records[].actors` | array \| null |  |  |
| `records[].method` | object | yes | The method information. |
| `records[].method.description` | string \| null |  |  |
| `records[].method.truncated_token` | string \| null |  | Truncated token containing the last 4 chars of the token's actual value. |
| `records[].method.type` | string | yes | Describes the method used to perform the action: `browser` -- authenticated user session. Session value is not returned in the `truncated_token` field. `oauth` -- access token obtained via the OAuth flow. Truncated token value is returned in the `truncated_token` field. `api_token` -- Pagerduty API token. Truncated token value is returned in the `truncated_token` field. `identity_provider` -- action performed by an Identity provider on behalf of a user. No value is returned in the `truncated_token` field. `other` -- Method that does not fall in the predefined categories. Truncated token value MAY be returned in the `truncated_token` field. One of: `browser`, `oauth`, `api_token`, `identity_provider`, `other`. |
| `records[].root_resource` | object | yes |  |
| `records[].root_resource.id` | string | yes | Read-only. |
| `records[].root_resource.summary` | string \| null |  | A short-form, server-generated string that provides succinct, important information about an object suitable for primary labeling of an entity in a client. In many cases, this will be identical to `name`, though it is not intended to be an identifier. Read-only. |
| `records[].root_resource.type` | string | yes | A string that determines the schema of the object. This must be the standard name for the entity, suffixed by `_reference` if the object is a reference. Read-only. |
| `records[].root_resource.self` | string \| null (url) |  | the API show URL at which the object is accessible. Read-only. |
| `records[].root_resource.html_url` | string \| null (url) |  | a URL at which the entity is uniquely displayed in the Web app. Read-only. |
| `records[].action` | string | yes |  |
| `records[].details` | object \| null |  | Additional details to provide further information about the action or the resource that has been audited. |
| `records[].details.resource` | object | yes | Same fields as `records[].root_resource` above. |
| `records[].details.fields` | array \| null |  | A set of fields that have been affected. The fields that have not been affected MAY be returned. |
| `records[].details.references` | array \| null |  | A set of references that have been affected. |
| `response_metadata` | one of: object |  |  |
| `response_metadata.messages` | array \| null |  | (option 1) |
| `limit` | integer | yes | The minimum of the `limit` parameter used in the request or the maximum request size of the API. Read-only. |
| `next_cursor` | string \| null | yes | An opaque string than will deliver the next set of results when provided as the `cursor` parameter in a subsequent request. A `null` value for this field indicates that there are no additional results. Read-only. |

Example: Response Example

```json
{
  "records": [
    {
      "id": "PD_ADD_HIGH_URGENCY_NOTIFICATION",
      "action": "update",
      "actors": [
        {
          "id": "PDUSER",
          "summary": "John Snow",
          "type": "user_reference",
          "self": "https://api.pagerduty.com/users/PD_USER123",
          "html_url": "https://mydomain.pagerduty.com/users/PD_USER123"
        }
      ],
      "details": {
        "references": [
          {
            "added": [
              {
                "id": "PD_NOTIFICATION_RULE_HIGH",
                "summary": "High Urgency (Email: Default)",
                "type": "assignment_notification_rule_reference"
              }
            ],
            "name": "notification_rules"
          }
        ],
        "resource": {
          "id": "PD_USER_999",
          "summary": "Test User",
          "type": "user_reference",
          "self": "https://api.pagerduty.com/users/PD_USER_999",
          "html_url": "https://mydomain.pagerduty.com/users/PD_USER_999"
        }
      },
      "execution_context": {
        "request_id": "a68929b2-d0f4-4def-b1d2-6bb744c44e3d"
      },
      "execution_time": "2021-01-05T15:17:32.343Z",
      "method": {
        "type": "browser"
      },
      "root_resource": {
        "id": "PD_USER_999",
        "summary": "Test User",
        "type": "user_reference",
        "self": "https://api.pagerduty.com/users/PD_USER_999",
        "html_url": "https://mydomain.pagerduty.com/users/PD_USER_999"
      }
    },
    {
      "id": "PD_ADD_HIGH_URGENCY_EMAIL_CONTACT",
      "action": "update",
      "actors": [
        {
          "id": "PDUSER",
          "summary": "John Snow",
          "type": "user_reference",
          "self": "https://api.pagerduty.com/users/PD_USER123",
          "html_url": "https://mydomain.pagerduty.com/users/PD_USER123"
        }
      ],
      "details": {
        "fields": [
          {
            "name": "start_delay_in_minutes",
            "value": "0"
          },
          {
            "name": "urgency",
            "value": "high"
          }
        ],
        "references": [
          {
            "added": [
              {
                "id": "PD_CONTACT_METHOD",
                "summary": "Default",
                "type": "email_contact_method_reference"
              }
            ],
            "name": "contact_method"
          }
        ],
        "resource": {
          "id": "PD_NOTIFICATION_RULE_HIGH",
          "summary": "High Urgency (Email: Default)",
          "type": "assignment_notification_rule_reference"
        }
      },
      "execution_context": {
        "request_id": "a68929b2-d0f4-4def-b1d2-6bb744c44e3d"
      },
      "execution_time": "2021-01-05T15:17:32.343Z",
      "method": {
        "type": "browser"
      },
      "root_resource": {
        "id": "PD_USER_999",
        "summary": "Test User",
        "type": "user_reference",
        "self": "https://api.pagerduty.com/users/PD_USER_999",
        "html_url": "https://mydomain.pagerduty.com/users/PD_USER_999"
      }
    },
    {
      "id": "PD_ADD_LOW_URGENCY_EMAIL_RULE",
      "action": "update",
      "actors": [
        {
          "id": "PDUSER",
          "summary": "John Snow",
          "type": "user_reference",
          "self": "https://api.pagerduty.com/users/PD_USER123",
          "html_url": "https://mydomain.pagerduty.com/users/PD_USER123"
        }
      ],
      "details": {
        "fields": [
          {
            "name": "start_delay_in_minutes",
            "value": "0"
          },
          {
            "name": "urgency",
            "value": "low"
          }
        ],
        "references": [
          {
            "added": [
              {
                "id": "PD_CONTACT_METHOD",
                "summary": "Default",
                "type": "email_contact_method_reference"
              }
            ],
            "name": "contact_method"
          }
        ],
        "resource": {
          "id": "PD_NOTIFICATION_RULE_LOW",
          "summary": "Low Urgency (Email: Default)",
          "type": "assignment_notification_rule_reference"
        }
      },
      "execution_context": {
        "request_id": "a68929b2-d0f4-4def-b1d2-6bb744c44e3d"
      },
      "execution_time": "2021-01-05T15:17:32.335Z",
      "method": {
        "type": "browser"
      },
      "root_resource": {
        "id": "PD_USER_999",
        "summary": "Test User",
        "type": "user_reference",
        "self": "https://api.pagerduty.com/users/PD_USER_999",
        "html_url": "https://mydomain.pagerduty.com/users/PD_USER_999"
      }
    },
    {
      "id": "PD_ADD_LOW_URGENCY_EMAIL_CONTACT",
      "action": "update",
      "actors": [
        {
          "id": "PDUSER",
          "summary": "John Snow",
          "type": "user_reference",
          "self": "https://api.pagerduty.com/users/PD_USER123",
          "html_url": "https://mydomain.pagerduty.com/users/PD_USER123"
        }
      ],
      "details": {
        "references": [
          {
            "added": [
              {
                "id": "PD_NOTIFICATION_RULE_LOW",
                "summary": "Low Urgency (Email: Default)",
                "type": "assignment_notification_rule_reference"
              }
            ],
            "name": "notification_rules"
          }
        ],
        "resource": {
          "id": "PD_USER_999",
          "summary": "Test User",
          "type": "user_reference",
          "self": "https://api.pagerduty.com/users/PD_USER_999",
          "html_url": "https://mydomain.pagerduty.com/users/PD_USER_999"
        }
      },
      "execution_context": {
        "request_id": "a68929b2-d0f4-4def-b1d2-6bb744c44e3d"
      },
      "execution_time": "2021-01-05T15:17:32.335Z",
      "method": {
        "type": "browser"
      },
      "root_resource": {
        "id": "PD_USER_999",
        "summary": "Test User",
        "type": "user_reference",
        "self": "https://api.pagerduty.com/users/PD_USER_999",
        "html_url": "https://mydomain.pagerduty.com/users/PD_USER_999"
      }
    },
    {
      "id": "PD_EMAIL_CONTACT_FOR_USER",
      "action": "update",
      "actors": [
        {
          "id": "PDUSER",
          "summary": "John Snow",
          "type": "user_reference",
          "self": "https://api.pagerduty.com/users/PD_USER123",
          "html_url": "https://mydomain.pagerduty.com/users/PD_USER123"
        }
      ],
      "details": {
        "fields": [
          {
            "name": "label",
            "value": "Default"
          },
          {
            "name": "type",
            "value": "email_contact_method"
          },
          {
            "name": "address",
            "value": "testuser@testabc123.com"
          }
        ],
        "resource": {
          "id": "PD_CONTACT_METHOD",
          "summary": "Default",
          "type": "email_contact_method_reference"
        }
      },
      "execution_context": {
        "request_id": "a68929b2-d0f4-4def-b1d2-6bb744c44e3d"
      },
      "execution_time": "2021-01-05T15:17:32.327Z",
      "method": {
        "type": "browser"
      },
      "root_resource": {
        "id": "PD_USER_999",
        "summary": "Test User",
        "type": "user_reference",
        "self": "https://api.pagerduty.com/users/PD_USER_999",
        "html_url": "https://mydomain.pagerduty.com/users/PD_USER_999"
      }
    },
    {
      "id": "PD_ADD_EMAIL_CONTACT_TO_USER",
      "action": "update",
      "actors": [
        {
          "id": "PDUSER",
          "summary": "John Snow",
          "type": "user_reference",
          "self": "https://api.pagerduty.com/users/PD_USER123",
          "html_url": "https://mydomain.pagerduty.com/users/PD_USER123"
        }
      ],
      "details": {
        "references": [
          {
            "added": [
              {
                "id": "PD_CONTACT_METHOD",
                "summary": "Default",
                "type": "email_contact_method_reference"
              }
            ],
            "name": "contact_methods"
          }
        ],
        "resource": {
          "id": "PD_USER_999",
          "summary": "Test User",
          "type": "user_reference",
          "self": "https://api.pagerduty.com/users/PD_USER_999",
          "html_url": "https://mydomain.pagerduty.com/users/PD_USER_999"
        }
      },
      "execution_context": {
        "request_id": "a68929b2-d0f4-4def-b1d2-6bb744c44e3d"
      },
      "execution_time": "2021-01-05T15:17:32.327Z",
      "method": {
        "type": "browser"
      },
      "root_resource": {
        "id": "PD_USER_999",
        "summary": "Test User",
        "type": "user_reference",
        "self": "https://api.pagerduty.com/users/PD_USER_999",
        "html_url": "https://mydomain.pagerduty.com/users/PD_USER_999"
      }
    },
    {
      "id": "PD_CREATE_USER",
      "action": "create",
      "actors": [
        {
          "id": "PDUSER",
          "summary": "John Snow",
          "type": "user_reference",
          "self": "https://api.pagerduty.com/users/PD_USER123",
          "html_url": "https://mydomain.pagerduty.com/users/PD_USER123"
        }
      ],
      "details": {
        "fields": [
          {
            "name": "name",
            "value": "Test User"
          },
          {
            "name": "role",
            "value": "user"
          },
          {
            "name": "email",
            "value": "testuser@testabc123.com"
          },
          {
            "name": "time_zone",
            "value": "America/New_York"
          },
          {
            "name": "description",
            "value": null
          },
          {
            "name": "job_title",
            "value": null
          },
          {
            "name": "color",
            "value": "brown"
          }
        ],
        "resource": {
          "id": "PD_USER_999",
          "summary": "Test User",
          "type": "user_reference",
          "self": "https://api.pagerduty.com/users/PD_USER_999",
          "html_url": "https://mydomain.pagerduty.com/users/PD_USER_999"
        }
      },
      "execution_context": {
        "request_id": "a68929b2-d0f4-4def-b1d2-6bb744c44e3d"
      },
      "execution_time": "2021-01-05T15:17:31.708Z",
      "method": {
        "type": "browser"
      },
      "root_resource": {
        "id": "PD_USER_999",
        "summary": "Test User",
        "type": "user_reference",
        "self": "https://api.pagerduty.com/users/PD_USER_999",
        "html_url": "https://mydomain.pagerduty.com/users/PD_USER_999"
      }
    }
  ],
  "limit": 10,
  "next_cursor": null
}
```

## Response 400

Caller provided invalid arguments. Please review the response for error details. Retrying with the same arguments will *not* work.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Response 401

Caller did not supply credentials or did not provide the correct credentials.
If you are using an API key, it may be invalid or your Authorization header may be malformed.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Response 402

Account does not have the abilities to perform the action. Please review the response for the required abilities.
You can also use the [Abilities API](#resource_Abilities) to determine what features are available to your account.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Response 403

Caller is not authorized to view the requested resource.
While your authentication is valid, the authenticated user or token does not have permission to perform this action.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Response 404

The requested resource was not found.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Response 429

Too many requests have been made, the rate limit has been reached.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Response 500

Internal Server Error the PagerDuty server experienced an error.

### `application/json`

| Field | Type | Required | Description |
|---|---|---|---|
| `error` | object |  |  |
| `error.code` | integer |  | Read-only. |
| `error.message` | string |  | Error message string. Read-only. |
| `error.errors` | array of string |  | Read-only. |

## Developer Agreement

Your access to and use of the PagerDuty Developer Services is governed by the [PagerDuty Developer Agreement](https://docs.pagerduty.com/developer/pagerduty-developer-agreement).