Audit Logs

GET /api/v1/logs/audit/search
GET /api/v1/logs/audit/earliest
GET /api/v1/logs/audit/latest
GET /api/v1/logs/audit

​

Overview

• Track User Activity: Monitor all actions taken by users in your workspace
• Maintain Compliance: Keep detailed records for audit and compliance purposes
• Investigate Incidents: Retrieve historical logs to investigate specific events
• Export Records: Fetch and store audit logs in your own systems

​

Endpoints

​

Search Audit Logs

GET /api/v1/logs/audit/search

• time (required): UTC epoch timestamp, up to 1 year old from now

curl -X GET "https://api.harvey.ai/api/v1/logs/audit/search?time=1712066546" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

​

Get Earliest Audit Log

GET /api/v1/logs/audit/earliest

curl -X GET "https://api.harvey.ai/api/v1/logs/audit/earliest" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

​

Get Latest Audit Log

GET /api/v1/logs/audit/latest

curl -X GET "https://api.harvey.ai/api/v1/logs/audit/latest" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

​

Query Audit Logs

GET /api/v1/logs/audit

• from (required): Audit log ID to begin fetching from (UUID format)
• take (required): Number of audit log entries to fetch (max 1000)

curl -X GET "https://api.harvey.ai/api/v1/logs/audit?from=018e983f-d10f-72aa-9c94-d8263e53c6a4&take=100" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

​

Audit Log Types

​

API Operations

​

Authentication

​

Admin Operations

​

User Operations

​

System Operations

​

Use Cases

​

Use Case 1: Compliance Monitoring and Audit Trail Capture

​

Use Case 2: Incident Response and User Investigations

​

Use Case 3: Continuous Monitoring

​

Regular Cadence Fetching

​

Initial Backfill

import requests
import time

token = "YOUR_API_KEY"
headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {token}"
}

# Start from the earliest log
response = requests.get("https://api.harvey.ai/api/v1/logs/audit/earliest", headers=headers)
current_log = response.json()["log"]

# Save to your database
save_to_database([current_log])
last_processed_id = current_log["id"]

# Paginate through all historical logs
while True:
    time.sleep(1)  # Respect 60 req/min rate limit
    
    response = requests.get(
        f"https://api.harvey.ai/api/v1/logs/audit?from={last_processed_id}&take=1000",
        headers=headers
    )
    
    logs = response.json()
    if not logs:
        break
    
    save_to_database(logs)
    last_processed_id = logs[-1]["id"]
    print(f"Processed {len(logs)} logs, last ID: {last_processed_id}")

# Store checkpoint in database
save_checkpoint(last_processed_id)

​

Incremental Updates

import requests
import time

token = "YOUR_API_KEY"
headers = {
    "Content-Type": "application/json",
    "Authorization": f"Bearer {token}"
}

# Load the last processed ID from your database
last_processed_id = load_checkpoint()

# Fetch new logs since last check
response = requests.get(
    f"https://api.harvey.ai/api/v1/logs/audit?from={last_processed_id}&take=1000",
    headers=headers
)

new_logs = response.json()
if new_logs:
    save_to_database(new_logs)
    
    # Update the checkpoint
    last_processed_id = new_logs[-1]["id"]
    save_checkpoint(last_processed_id)
    
    print(f"Fetched {len(new_logs)} new logs")
else:
    print("No new logs since last check")

​

Scheduling Recommendations

• High-activity workspaces: Poll every 5-10 minutes with take=1000
• Medium-activity workspaces: Poll every 15-30 minutes with take=500
• Low-activity workspaces: Poll hourly with take=100

​

Key Considerations

• Persistent storage: Always save the last processed log ID to disk/database so your process can resume after restarts.
• Idempotency: Audit logs are immutable, so it’s safe to reprocess the same log multiple times if needed.
• Error handling: If a fetch fails, retry from the same log ID and don’t skip ahead.
• Rate limiting: With the 60 req / min, fetching 1000 logs takes approximately 1 second per batch. Plan your cadence accordingly.
• Gap detection: Monitor timestamps to detect if you’re falling behind. If the latest fetched timestamp is more than your polling interval old, increase frequency or batch size.

​

Best Practices

• Respect rate limits: The API is limited to 60 requests per minute. Implement appropriate delays in your polling logic
• Store logs externally: Export audit logs to your own SIEM or audit repository for long-term retention and analysis
• Handle timestamps correctly: The time parameter uses UTC epoch timestamps (seconds since January 1, 1970)
• Track pagination state: Always save the last processed log ID to persistent storage to resume pagination if your process is interrupted
• Monitor for new event types: The API may add new event types over time, so build your parsing logic to handle unknown types gracefully
• Implement retries with backoff: If you hit rate limits or encounter errors, implement exponential backoff before retrying
• Deduplicate on ingestion: Use the log id field as a unique identifier to prevent duplicate storage if you need to reprocess logs
• Set up alerting: Monitor your sync process to ensure logs are being fetched regularly and alert if the process fails

​

Error Handling