Audit logs

Audit logs provide a chronological record of administrative actions performed within your workspace, supporting security monitoring, compliance reporting, and incident investigation. Coverage spans over 100 endpoints across user provisioning, authentication, API key management, and other administrative surfaces.

Logs are emitted in the OCSF v1.6.0 schema with the datetime and host profiles applied, so most entries can be ingested into a SIEM with minimal normalisation.

Two independent checks gate retrieval:

Requests authenticate with a workspace API key. The user or service account associated with the key must hold the audit_log_read permission.

Audit logs are returned by GET /v1/workspace/audit-logs. See the API reference for the full list of query parameters and pagination details.

from dotenv import load_dotenv
import os
from elevenlabs import ElevenLabs

load_dotenv()

elevenlabs = ElevenLabs(api_key=os.getenv("ELEVENLABS_API_KEY"))

page = elevenlabs.workspace.audit_logs.list(limit=50)
for entry in page.entries:
    print(entry.time_dt, entry.class_name, entry.activity_name)

import 'dotenv/config';
import { ElevenLabsClient } from "@elevenlabs/elevenlabs-js";

const elevenlabs = new ElevenLabsClient({ apiKey: process.env.ELEVENLABS_API_KEY });

const page = await elevenlabs.workspace.auditLogs.list({ limit: 50 });
for (const entry of page.entries) {
  console.log(entry.timeDt, entry.className, entry.activityName);
}

Requests are limited to 30 per minute per user. Combined with the maximum limit of 100, this allows up to 3,000 entries per minute.

Audit logs follow the OCSF v1.6.0 specification. Event-class-specific fields supplement a common base; see the API reference for the per-field response schema.

The following OCSF classes are emitted today:

OCSF compliance is best-effort. Where a canonical OCSF field exists, audit entries use it; the unmapped field carries any ElevenLabs-specific attributes that don't fit the standard.

Sensitive material that would otherwise appear in URL paths or query parameters is redacted before audit entries are written. Password reset tokens are one such case; equivalent redaction applies to any audit-relevant request whose URL structure carries secrets.