> ## Documentation Index > Fetch the complete documentation index at: https://docs.flexxible.com/llms.txt > Use this file to discover all available pages before exploring further. # List event logs > Returns a paginated list of event logs for the authorized organization. Optionally filter by workspace_id (query param or filters expression). ## OpenAPI ````yaml /en/api-reference/openapi.en-v2.json get /v2/organizations/{organization_id}/event-logs openapi: 3.0.3 info: title: API Publica Portal version: 1.0.0 description: Public REST API for portal servers: - url: https://api.flexxible.net/ description: Portal API security: - bearerAuth: [] tags: - name: Solve description: Flexxible Solve ticket visibility and management - name: Digital activity description: Core process group creation by organization - name: Locations description: Location management (FWS) - name: Roles description: Role creation endpoint for organization - name: Users description: User creation endpoint for organization - name: Workspace groups description: Management endpoints for workspace groups - name: Networks description: Network management (FWS) - name: WiFi Networks description: Wi-Fi network management (FWS) - name: Workspaces description: Workspace deletion endpoint for the organization - name: Event logs description: Workspace event logs query - name: Installed apps description: Installed application detail endpoint for the organization - name: Authentication description: Session context and authentication endpoints - name: Microservices description: Details of microservices by organization - name: Operations description: Detail queries for operations by organization - name: Organization description: Organization operations - name: Patch policy targets description: Patch policy objective management endpoints - name: Product configurations description: Product configuration management endpoints - name: Reporting Groups description: Operations on reporting groups - name: Sessions description: Session detail endpoint for the organization - name: Tenants description: Tenant management endpoints - name: Workspace Connection Logs description: Workspace connection logs query - name: Workspace GPO description: Query GPOs applied to a session - name: Workspace Notifications description: Workspace notifications query paths: /v2/organizations/{organization_id}/event-logs: get: tags: - Event logs summary: List event logs description: >- Returns a paginated list of event logs for the authorized organization. Optionally filter by workspace_id (query param or filters expression). operationId: listEventLogs parameters: - name: organization_id in: path required: true schema: type: string pattern: ^[0-9a-f]{24}$ minLength: 24 maxLength: 24 description: Organization identifier. example: 507f1f77bcf86cd799439011 - name: page in: query required: false schema: type: integer default: 1 minimum: 1 description: Page number. - name: per_page in: query required: false schema: type: integer default: 100 minimum: 1 maximum: 100 description: Number of items per page. - name: fields in: query required: false schema: type: string maxLength: 2048 description: Response fields separated by commas for each element. example: workspace_id,recorded_at,source,event_type - name: workspace_id in: query required: false schema: type: string pattern: ^[0-9a-f]{24}$ minLength: 24 maxLength: 24 description: Optional filter by workspace identifier. example: 64f0c2a1b2d3e4f506070811 - name: filters in: query required: false schema: type: string maxLength: 5120 description: JSON expression of filters on filterable resource fields. examples: simple: summary: Filter by workspace identifier value: >- {"field":"workspace_id","op":"eq","value":"64f0c2a1b2d3e4f506070811"} complex-and: summary: Filter by event type and source value: >- {"and":[{"field":"event_type","op":"eq","value":"error"},{"field":"source","op":"eq","value":"Application"}]} - name: sort in: query required: false schema: type: string pattern: ^([a-z_]+):(asc|desc)$ description: >- Sorting expression with format :asc|desc. Default is recorded_at:desc. example: recorded_at:desc responses: '200': description: Event logs retrieved successfully. content: application/json: schema: $ref: '#/components/schemas/ListEventLogsResponseV2' examples: paginated_result: summary: Paginated list with results value: has_next: true data: - workspace_id: 64f0c2a1b2d3e4f506070811 organization_id: 507f1f77bcf86cd799439011 recorded_at: '2026-08-01T12:00:00.000Z' source: Application message: Something happened event_id: 1000 log_file: Application event_type: information '400': description: Invalid request parameters. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Not authorized or without access to the organization. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '404': description: Resource not found within the authorized organization. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '429': description: Rate limit exceeded. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '500': description: Internal server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' components: schemas: ListEventLogsResponseV2: type: object properties: has_next: type: boolean description: Indicates if there's a next page. data: type: array items: $ref: '#/components/schemas/EventLogItemV2' required: - has_next - data ErrorResponse: type: object properties: error: type: object properties: message: type: string code: type: string details: type: string required: - message - code required: - error EventLogItemV2: type: object properties: workspace_id: type: string nullable: true pattern: ^[0-9a-f]{24}$ minLength: 24 maxLength: 24 description: Workspace Id. Can be null if Snowflake join didn't find workspace. organization_id: type: string nullable: true pattern: ^[0-9a-f]{24}$ minLength: 24 maxLength: 24 description: >- Event organization Id. Can be null if Snowflake join didn't find organization. recorded_at: type: string format: date-time nullable: true description: Date and time when the event was recorded. source: type: string nullable: true description: Event source (provider that generated it). message: type: string nullable: true description: Event message. event_id: type: number nullable: true description: Numeric event Id. log_file: type: string nullable: true description: Event log (channel) where the event was stored. event_type: type: string nullable: true enum: - critical - error - warning - information - unknown description: Normalized event severity. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT ````