# Get Organization Activity Logs

Returns the organization's activity log events accessible to the current user

Endpoint: GET /api/v3.0/orgs/{orgUuid}/activity-logs
Version: 3.0
Security: bearer-key

## Query parameters:

  - `cursor` (string)
    Parameter indicates the starting point for retrieving results, the first call doesn't include a cursor parameter in the request, the API response includes the first set of results along with a cursor pointing to the last item retrieved.

  - `limit` (string)
    Specifies the maximum number of items to be returned in the response.

  - `startDate` (string)
    Start of the time window. Format: yyyy-MM-dd or yyyy-MM-dd'T'HH:mm:ss, optionally with a zone offset (Z or +HH:mm); without an offset the value is interpreted as UTC. With days, the window is [startDate, startDate + days]; without days it extends to now. Takes precedence over a timestamp filter inside search.

  - `days` (integer)
    Length of the time window in days (positive integer). With startDate, the window is [startDate, startDate + days]; without startDate it is the last  days. Takes precedence over a timestamp filter inside search.

  - `engineType` (string)
    Comma-separated engine types to filter by, e.g. SCA,SAST,IMG,IAC,AI,PLATFORM. Case-insensitive. Takes precedence over an engineType filter inside search.

## Path parameters:

  - `orgUuid` (string, required)
    org UUID (from the Mend App: Administration General > Organization UUID).

## Response 200 fields (application/json):

  - `additionalData` (object)
    + totalItems: The total count of data points returned in an API response.
    Example: {"totalItems":"422","next":"http://someUrl?cursor=3","cursor":3}

  - `supportToken` (string)
    Example: "1171c60d"

  - `response` (array)

  - `response.uuid` (string)
    Unique event identifier
    Example: "0190f3a1-1c2d-7e4f-8a9b-1234567890ab"

  - `response.timestamp` (string)
    ISO-8601 UTC timestamp
    Example: "2026-05-31T14:22:05Z"

  - `response.event` (string)
    Raw event name; the UI renders the display label
    Example: "LOGGED_IN"

  - `response.category` (string)
    Raw category name; the UI renders the display label
    Example: "AUTHENTICATION"

  - `response.eventType` (string)
    Enum: "ACTIVITY", "AUDIT"

  - `response.engineType` (string)
    Enum: "PLATFORM", "SCA", "SAST", "IMG", "CN", "IAC", "DAST", "AI", "LLM"

  - `response.changeType` (string,null)
    Raw change type for audit events
    Enum: "CREATED", "CHANGED", "DELETED", "ORDER"

  - `response.userName` (string)
    Consolidated actor display value (user name, or Mend System / Mend Expert)
    Example: "John Smith"

  - `response.actorType` (string)
    Raw operator classification
    Enum: "USER", "SYSTEM", "EXPERT", "IDP"

  - `response.entityType` (string,null)
    Type of the modified object
    Example: "LIBRARY"

  - `response.entityUuid` (string,null)

  - `response.entityName` (string,null)

  - `response.scopeType` (string,null)
    Raw context scope name in which the action occurred
    Example: "ORGANIZATION"

  - `response.scopeUuid` (string,null)

  - `response.scopeName` (string,null)

  - `response.applicationUuid` (string,null)

  - `response.applicationName` (string,null)

  - `response.projectUuid` (string,null)

  - `response.projectName` (string,null)

  - `response.details` (object)
    For AUDIT: before/after. For ACTIVITY: structured action payload

  - `response.requestToken` (string,null)
    Per-event correlation token for support

## Response 400 fields (*/*):

  - `supportToken` (string)
    Example: "1171c60d"