# Search activity logs

Search and filter admin activity logs using a POST request with event type filter in the request body. You can find more details about the available event types in the List all activity log event types endpoint.
Results are paginated by page number. Use `page` and `per_page` in the request body to choose a page. The `next` link in the response is a URL that keeps the query string of the request URL and sets `page` and `per_page` for the next page. It does not include the filters from your request body. To fetch the next page, send a POST request with the same request body to that URL. Query parameters in the `next` URL take precedence over `page` and `per_page` in the body.
Requires the `read_admins` OAuth scope.

Endpoint: POST /admins/activity_logs/search
Version: 2.17
Security: bearerAuth

## Header parameters:

  - `Intercom-Version` (string)

## Request fields (application/json):

  - `created_at_after` (integer)
    The start date that you request data for. It must be formatted as a UNIX timestamp. If you leave it out, it defaults to 30 days before the request.
    Example: 1677253093

  - `created_at_before` (integer)
    The end date that you request data for. It must be formatted as a UNIX timestamp. If you leave it out, it defaults to the time of the request.
    Example: 1677861493

  - `event_types` (array)
    An optional list of event types to filter activity logs by. Use the list all activity log event types endpoint to retrieve available values.
    Example: ["app_name_change","message_state_change"]

  - `page` (integer)
    The page number of results to return.
    Example: 1

  - `per_page` (integer)
    The number of results per page. Must be between 1 and 250.
    Example: 20

## Response 200 fields (application/json):

  - `type` (string)
    String representing the object's type. Always has the value `activity_log.list`.
    Example: activity_log.list

  - `pages` (object)
    The majority of list resources in the API are paginated to allow clients to traverse data over multiple requests.

Their responses are likely to contain a pages object that hosts pagination links which a client can use to paginate through the data without having to construct a query. The link relations for the pages field are as follows.

  - `pages.type` (string)
    Enum: "pages"

  - `pages.page` (integer)
    Example: 1

  - `pages.next` (string)
    A link to the next page of results. Omitted or `null` on the last page, depending on the list. Some lists never include `next` or `prev`, so compare `page` with `total_pages` to tell whether more pages remain.

  - `pages.prev` (string)
    A link to the previous page of results. Omitted on the first page.

  - `pages.per_page` (integer)
    Example: 50

  - `pages.total_pages` (integer)
    Example: 1

  - `activity_logs` (array)
    An array of activity logs

  - `activity_logs.type` (string)
    String representing the object's type. Always has the value `admin_activity_log_event`.
    Example: admin_activity_log_event

  - `activity_logs.id` (string)
    The id representing the activity.
    Example: 6

  - `activity_logs.performed_by` (object)
    Details about the Admin involved in the activity. `null` when the admin who performed the activity isn't available.

  - `activity_logs.performed_by.type` (string)
    String representing the object's type. Always has the value `admin`.
    Example: admin

  - `activity_logs.performed_by.id` (string)
    The id representing the admin.
    Example: 1295

  - `activity_logs.performed_by.email` (string)
    The email of the admin.
    Example: john@example.com

  - `activity_logs.performed_by.ip` (string)
    The IP address of the admin.
    Example: 198.51.100.255

  - `activity_logs.metadata` (object)
    Additional data provided about Admin activity.

  - `activity_logs.metadata.sign_in_method` (string)
    The way the admin signed in.
    Example: email_password

  - `activity_logs.metadata.external_id` (string)
    The unique identifier for the contact which is provided by the Client.
    Example: f3b87a2e09d514c6c2e79b9a

  - `activity_logs.metadata.away_mode` (boolean)
    The away mode status which is set to true when away and false when returned.
    Example: true

  - `activity_logs.metadata.away_status_reason` (string)
    The reason the Admin is away.
    Example: 😌 On a break

  - `activity_logs.metadata.reassign_conversations` (boolean)
    Indicates if conversations should be reassigned while an Admin is away.
    Example: false

  - `activity_logs.metadata.source` (string)
    The action that initiated the status change.
    Example: admin update from web - Admin id: 93

  - `activity_logs.metadata.auto_changed` (string)
    Indicates if the status was changed automatically or manually.
    Example: false

  - `activity_logs.metadata.update_by` (integer)
    The ID of the Admin who initiated the activity.
    Example: 93

  - `activity_logs.metadata.update_by_name` (string)
    The name of the Admin who initiated the activity.
    Example: Joe Example

  - `activity_logs.metadata.previous_state` (string)
    The state before the change. `idle` or `occupied` for an occupancy change, and null when the Admin had not been classified yet; `enabled` or `disabled` for an IP allowlist change.
    Example: idle

  - `activity_logs.metadata.new_state` (string)
    The state after the change. `idle` or `occupied` for an occupancy change; `enabled` or `disabled` for an IP allowlist change.
    Example: occupied

  - `activity_logs.metadata.threshold_minutes` (integer)
    The inactivity window, in minutes, used to classify the Admin.
    Example: 15

  - `activity_logs.metadata.last_activity_at` (integer)
    The time of the Admin's last recorded activity.
    Example: 1671028894

  - `activity_logs.metadata.auto` (boolean)
    Indicates the state was derived automatically rather than set by an Admin.
    Example: true

  - `activity_logs.metadata.setting_type` (string)
    The group of workspace settings the change belongs to, for example `teammate_occupancy` or `automatic_away_mode`.
    Example: teammate_occupancy

  - `activity_logs.metadata.conversation_assignment_limit` (integer)
    The conversation assignment limit value for an admin.
    Example: 15

  - `activity_logs.metadata.ticket_assignment_limit` (integer)
    The ticket assignment limit value for an admin.
    Example: 20

  - `activity_logs.metadata.team` (object)
    Details about the team whose assignment limit was changed.

  - `activity_logs.metadata.team.id` (integer)
    The ID of the team.
    Example: 123

  - `activity_logs.metadata.team.name` (string)
    The name of the team.
    Example: Support Team

  - `activity_logs.metadata.team_assignment_limit` (integer)
    The team assignment limit value (null if limit was removed).
    Example: 50

  - `activity_logs.metadata.enabled` (boolean)
    Indicates if the setting is enabled or disabled.
    Example: true

  - `activity_logs.metadata.mode` (string)
    The mode of the setting (e.g., when_away_only, when_away_and_reassign).
    Example: when_away_only

  - `activity_logs.metadata.consent_id` (integer)
    The ID of the impersonation consent.
    Example: 149673

  - `activity_logs.metadata.expired_at` (string)
    The timestamp when the impersonation consent expires.
    Example: 2025-12-04T09:31:57.000Z

  - `activity_logs.metadata.before` (object)
    The state of settings or values before the change. Structure varies by activity type.

  - `activity_logs.metadata.after` (object)
    The state of settings or values after the change. Structure varies by activity type.

  - `activity_logs.created_at` (integer)
    The time the activity was created.
    Example: 1671028894

  - `activity_logs.activity_type` (string)
    Enum: "admin_avatar_change", "admin_away_mode_change", "admin_occupancy_state_change", "admin_channel_change", "admin_deletion", "admin_deprovisioned", "intercom_teammate_removal", "admin_impersonation_consent_approved", "admin_impersonation_consent_revoked", "admin_impersonation_end", "admin_impersonation_start", "admin_invite_change", "admin_bulk_invite_creation", "admin_bulk_notification_settings_change", "admin_invite_creation", "admin_invite_deletion", "admin_unauthorized_sign_in_method", "admin_login_failure", "admin_login_success", "admin_logout", "admin_login_attempts_reset", "admin_mobile_login_failure", "admin_mobile_login_success", "admin_sign_in_method_expired", "admin_password_reset_request", "admin_password_reset_success", "admin_permission_change", "admin_provisioned", "admin_name_change", "admin_email_change", "admin_password_change", "admin_locale_change", "app_admin_join", "app_authentication_method_change", "app_data_deletion", "app_data_export", "request_log_export_requested", "workspace_deletion_request", "workspace_owner_designation_change", "app_google_sso_domain_change", "app_identity_verification_change", "app_identity_verification_reminder_disabled", "identity_verification_unmarked", "app_name_change", "app_outbound_address_change", "app_package_installation", "app_package_token_regeneration", "app_package_uninstallation", "developer_hub_secret_revealed", "developer_hub_secret_copied", "app_team_creation", "app_team_deletion", "app_team_membership_modification", "app_timezone_change", "app_webhook_creation", "app_webhook_deletion", "articles_in_messenger_enabled_change", "automatic_domain_authentication_started", "automatic_domain_authentication_complete", "messenger_api_secret_creation", "messenger_api_secret_deletion", "messenger_search_required_change", "messenger_spaces_change", "bulk_data_export_creation", "bulk_data_export_delete", "bulk_data_export_run", "bulk_data_export_settings_change", "bulk_delete", "bulk_export", "call_settings_change", "campaign_deletion", "campaign_state_change", "content_sync_pair_creation", "content_sync_pair_deletion", "content_sync_pair_run", "content_sync_pair_update", "conversation_attribute_archive", "conversation_deletion", "conversation_deletion_schedule_creation", "conversation_deletion_schedule_state_change", "conversation_deletion_schedule_update", "conversation_hard_deletion_enqueued", "conversation_part_deletion", "conversation_part_edited", "conversation_part_redaction", "conversation_pdf_export", "conversation_redaction_enqueued", "conversation_sla_change", "conversation_topic_change", "conversation_topic_creation", "conversation_topic_deletion", "csv_import_completion", "csv_import_creation", "taxonomy_upload_creation", "automation_roadmap_form_submission_creation", "data_connector_log_retention_setting_creation", "data_connector_log_retention_setting_update", "email_settings_change", "strip_inbound_email_links_change", "help_center_settings_change", "inbound_conversations_change", "inbox_access_change", "inbox_bulk_action", "internal_agent_proposal_applied", "message_deletion", "ruleset_activation", "ruleset_deletion", "ruleset_creation", "workflow_creation", "workflow_deletion", "workflow_update", "workflow_status_change", "workflow_participant_action_configured", "oauth_token_revocation", "article_creation", "article_deletion", "article_content_creation", "article_content_update", "article_content_deletion", "article_content_published", "article_content_unpublished", "article_content_audience_updated", "message_state_change", "messenger_look_and_feel_change", "office_hours_change", "office_hours_exception_change", "role_change", "role_creation", "role_deletion", "seat_change", "seat_revoke", "pre_migration_seat_expiration_date_change", "post_migration_seat_deletion", "post_migration_seat_update", "post_migration_seat_creation", "security_settings_change", "temporary_expectation_auto_expired", "temporary_expectation_change", "temporary_expectation_messages_change", "welcome_message_change", "start_conversation_button_text_change", "upfront_email_collection_change", "admin_assignment_limit_change", "admin_channel_limit_change", "admin_conversation_assignment_limit_change", "admin_ticket_assignment_limit_change", "admin_unassign_unsnoozed_at_capacity_change", "team_assignment_limit_change", "teammate_skills_synced", "skill_category_created", "skill_category_updated", "snooze_presets_change", "team_skill_categories_updated", "admin_two_factor_auth_change", "admin_two_factor_login_failure", "email_signature_change", "recovery_code_sent", "billing_addressees_change", "billing_addressees_bounced_and_removed", "billing_details_change", "broadcast_deletion", "fin_opt_in", "fin_free_usage_window_create", "fin_free_usage_window_extension", "fin_ingestion_consent", "ip_allowlist_setting_change", "rest_api_ip_allowlist_setting_change", "messenger_platform_availability_change", "messenger_platform_inactivity_disable_event", "custom_report_update", "custom_report_delete", "custom_report_create", "reporting_folder_create", "reporting_folder_delete", "teammate_office_hours_schedule_assign", "teammate_office_hours_schedule_unassign", "report_snapshot_create", "report_scheduled_share_create", "report_scheduled_share_update", "report_scheduled_share_delete", "reporting_folder_name_change", "reporting_folder_position_change", "reporting_folder_reports_change", "reporting_folder_pin_change", "reporting_csv_export", "pii_data_revealed", "privacy_policy_notice_change", "privacy_policy_notice_contents_change", "report_access_create", "report_access_delete", "report_access_update", "fin_persisted_data_context_attribute_change", "fin_sdr_connector_generated", "fin_sdr_connector_activated", "fin_sdr_marketo_connected", "fin_sdr_marketo_partition_selected", "fin_sdr_marketo_disconnected", "fin_sdr_playbook_updated", "generic_ecommerce_connector_creation", "ai_agent_customization_settings_change", "ai_agent_identity_settings_change", "ai_agent_multilingual_settings_change", "ai_agent_safety_guard_settings_change", "messenger_language_change", "ai_agent_guidance_change", "ai_category_change", "escalation_rule_change", "hitl_rule_change", "safety_response_category_config_change", "hitl_inbox_action", "brand_creation", "brand_update", "brand_deletion", "brand_settings_change", "action_created", "action_risk_accepted_change", "data_connector_security_warning_acknowledged", "action_published", "action_status_change", "action_update", "allowed_attachment_filetypes_setting_change", "ai_agent_fin_playground_change", "ai_agent_preview_token_generated", "selection_set_creation", "selection_set_archive", "series_creation", "series_deletion", "series_settings_update", "series_status_change", "series_update", "messenger_launch_to_conversation_change", "messenger_launcher_display_condition_change", "alias_mode_change", "alias_name_change", "hippa_compliance_settings_change", "ai_inbox_translation_setting_change", "slack_integration_auto_promoted", "slack_oauth_fresh_install", "slack_oauth_reinstall", "slack_oauth_reauthentication", "slack_integration_uninstalled", "telegram_identity_reset", "telegram_integration_installed", "telegram_integration_uninstalled", "slack_user_association_setting_change", "ms_teams_user_association_setting_change", "slack_integration_type_change", "slack_multi_conversational_changed", "whatsapp_direct_send_changed", "slack_user_token_creation", "standalone_channel_change", "standalone_connection_config_change", "standalone_schedule_sync_deletion", "skill_category_deleted", "skill_based_routing_toggled", "consent_banner_settings_change", "content_redaction_rule_creation", "content_redaction_rule_deletion", "content_redaction_rule_update", "content_suggestions_change", "suggestions_limiters_reset", "custom_authentication_token_creation", "custom_authentication_token_update", "custom_authentication_token_deletion", "device_token_deletion", "predictive_answers_settings_change", "custom_emoji_deletion", "customer_facing_name_change", "attach_uploads_inline_setting_change", "user_camera_attachments_setting_change", "user_media_attachments_setting_change", "user_file_attachments_setting_change", "file_upload_audience_predicates_setting_change", "user_gifs_setting_change", "user_emojis_setting_change", "user_voice_notes_setting_change", "user_conversation_attachments_setting_change", "teammate_gifs_setting_change", "scim_group_creation", "scim_group_update", "scim_groups_bulk_update", "scim_group_deletion", "scim_group_membership_change", "scim_admin_role_change", "scim_admin_bulk_role_assignment", "scim_admin_profile_update", "scim_admin_password_update", "scim_system_enabled", "scim_system_disabled", "scim_settings_change", "macro_content_export_run", "personal_macro_admin_read", "personal_macro_admin_convert", "personal_macro_admin_destroy", "macro_creation", "macro_deletion", "macro_update", "macro_usage_export", "mcp_server_created", "mcp_server_updated", "mcp_server_deleted", "mcp_server_enabled", "mcp_server_disabled", "mcp_server_oauth_connected", "mcp_server_oauth_disconnected", "mcp_server_reconnected", "mcp_action_added", "mcp_actions_batch_added", "mcp_action_updated", "mcp_action_removed", "fin_agent_api_settings_change", "fin_procedures_hitl_settings_change", "fin_procedures_hitl_access_token_rotated", "fin_agent_api_secret_revealed", "fin_agent_api_secret_copied", "a2a_agent_registered", "a2a_agent_oauth_connected", "automatic_away_mode_setting_change", "admin_occupancy_setting_change", "unassign_unsnoozed_at_capacity_setting_change", "unassign_unsnoozed_when_away_setting_change", "unassign_triggers_setting_change", "malicious_domains_setting_change", "trusted_domains_setting_change", "messenger_allowed_domains_change", "qa_monitor_creation", "qa_monitor_update", "qa_monitor_archive", "qa_monitor_restore", "qa_scorecard_creation", "qa_scorecard_update", "qa_scorecard_archive", "qa_review_plan_creation", "qa_review_plan_archive", "lead_to_user_merge", "user_to_user_merge", "sales_messenger_configuration_change", "shopify_refund_order", "shopify_replacement_order", "shopify_gift_card_compensation", "shopify_add_replacement_item", "shopify_disable_discount_code", "shopify_disable_gift_card", "shopify_create_discount_code", "shopify_update_shipping_address", "channel_identity_rule_change", "topic_curation_set_live", "hide_csat_from_agents_setting_change", "phone_purchase_diagnostic", "phone_number_purchase", "sip_domain_provisioned", "sip_domain_deleted", "sip_integration_stage_confirmed", "sip_header_mappings_updated", "phone_queue_call_pinned", "phone_queue_call_unpinned", "phone_queue_call_pin_cleared", "outbound_phone_campaign_creation", "outbound_phone_campaign_change", "outbound_phone_campaign_deletion", "outbound_phone_campaign_state_change", "outbound_phone_campaign_csv_upload", "outbound_phone_campaign_import", "outbound_phone_campaign_session_start", "channel_wrap_up_settings_change", "ticket_state_customer_notifications_change", "schedule_template_update", "schedule_template_creation", "schedule_template_deletion", "schedule_template_apply", "wfm_google_calendar_connected", "wfm_google_calendar_disconnected", "wfm_google_calendar_sync_setting_change", "github_sync_disconnected", "github_sync_cleanup_deleted_folder", "github_sync_installed", "github_sync_connector_cloned", "github_sync_pulled", "fallback_admin_alias_change", "spam_email_deletion", "snowflake_share_activated", "snowflake_share_torn_down", "calendar_mapping_rule_creation", "calendar_mapping_rule_deletion", "calendar_mapping_rule_update", "activity_type_creation", "masked_admin_avatar_change"

  - `activity_logs.activity_description` (string)
    A sentence or two describing the activity. `null` when the admin who performed the activity isn't available.
    Example: Admin updated the app's name to "My App".

## Response 400 fields (application/json):

  - `type` (string, required)
    The type is error.list
    Example: error.list

  - `request_id` (string)
    Example: f93ecfa8-d08a-4325-8694-89aeb89c8f85

  - `errors` (array, required)
    An array of one or more error objects

  - `errors.code` (any, required)
    A string indicating the kind of error, used to further qualify the HTTP response code. A few request validation errors send an HTTP status code as an integer here instead, for example `422`.
    Example: unauthorized

  - `errors.message` (string)
    Optional. Human readable description of the error.
    Example: Access Token Invalid

## Response 401 fields (application/json):

  - `type` (string, required)
    The type is error.list
    Example: error.list

  - `request_id` (string)
    Example: f93ecfa8-d08a-4325-8694-89aeb89c8f85

  - `errors` (array, required)
    An array of one or more error objects

  - `errors.code` (any, required)
    A string indicating the kind of error, used to further qualify the HTTP response code. A few request validation errors send an HTTP status code as an integer here instead, for example `422`.
    Example: unauthorized

  - `errors.message` (string)
    Optional. Human readable description of the error.
    Example: Access Token Invalid