# Search activity logs

Search and filter admin activity logs using a POST request with event type filter in the request body. You can find more details about the available event types in the List all activity log event types endpoint.

Endpoint: POST /admins/activity_logs/search
Version: 2.16
Security: bearerAuth

## Header parameters:

  - `Intercom-Version` (string)

## Request fields (application/json):

  - `created_at_after` (integer, required)
    The start date that you request data for. It must be formatted as a UNIX timestamp.
    Example: 1677253093

  - `created_at_before` (integer)
    The end date that you request data for. It must be formatted as a UNIX timestamp.
    Example: 1677861493

  - `event_types` (array)
    An optional list of event types to filter activity logs by. Use the list all activity log event types endpoint to retrieve available values.
    Example: ["app_name_change","message_state_change"]

  - `page` (integer)
    The page number of results to return.
    Example: 1

  - `per_page` (integer)
    The number of results per page. Must be between 1 and 250.
    Example: 20

## Response 200 fields (application/json):

  - `type` (string)
    String representing the object's type. Always has the value `activity_log.list`.
    Example: activity_log.list

  - `pages` (object)
    Cursor-based pagination is a technique used in the Intercom API to navigate through large amounts of data.
A "cursor" or pointer is used to keep track of the current position in the result set, allowing the API to return the data in small chunks or "pages" as needed.

  - `pages.type` (string)
    the type of object `pages`.
    Enum: "pages"

  - `pages.page` (integer)
    The current page
    Example: 1

  - `pages.next` (object)

  - `pages.next.per_page` (integer)
    The number of results to fetch per page.
    Example: 2

  - `pages.next.starting_after` (string)
    The cursor to use in the next request to get the next page of results.
    Example: your-cursor-from-response

  - `pages.per_page` (integer)
    Number of results per page
    Example: 2

  - `pages.total_pages` (integer)
    Total number of pages
    Example: 13

  - `activity_logs` (array)
    An array of activity logs

  - `activity_logs.id` (string)
    The id representing the activity.
    Example: 6

  - `activity_logs.performed_by` (object)
    Details about the Admin involved in the activity.

  - `activity_logs.performed_by.type` (string)
    String representing the object's type. Always has the value `admin`.
    Example: admin

  - `activity_logs.performed_by.id` (string)
    The id representing the admin.
    Example: 1295

  - `activity_logs.performed_by.email` (string)
    The email of the admin.
    Example: john@example.com

  - `activity_logs.performed_by.ip` (string)
    The IP address of the admin.
    Example: 198.51.100.255

  - `activity_logs.metadata` (object)
    Additional data provided about Admin activity.

  - `activity_logs.metadata.sign_in_method` (string)
    The way the admin signed in.
    Example: email_password

  - `activity_logs.metadata.external_id` (string)
    The unique identifier for the contact which is provided by the Client.
    Example: f3b87a2e09d514c6c2e79b9a

  - `activity_logs.metadata.away_mode` (boolean)
    The away mode status which is set to true when away and false when returned.
    Example: true

  - `activity_logs.metadata.away_status_reason` (string)
    The reason the Admin is away.
    Example: 😌 On a break

  - `activity_logs.metadata.reassign_conversations` (boolean)
    Indicates if conversations should be reassigned while an Admin is away.
    Example: false

  - `activity_logs.metadata.source` (string)
    The action that initiated the status change.
    Example: admin update from web - Admin id: 93

  - `activity_logs.metadata.auto_changed` (string)
    Indicates if the status was changed automatically or manually.
    Example: false

  - `activity_logs.metadata.update_by` (integer)
    The ID of the Admin who initiated the activity.
    Example: 93

  - `activity_logs.metadata.update_by_name` (string)
    The name of the Admin who initiated the activity.
    Example: Joe Example

  - `activity_logs.metadata.conversation_assignment_limit` (integer)
    The conversation assignment limit value for an admin.
    Example: 15

  - `activity_logs.metadata.ticket_assignment_limit` (integer)
    The ticket assignment limit value for an admin.
    Example: 20

  - `activity_logs.metadata.team` (object)
    Details about the team whose assignment limit was changed.

  - `activity_logs.metadata.team.id` (integer)
    The ID of the team.
    Example: 123

  - `activity_logs.metadata.team.name` (string)
    The name of the team.
    Example: Support Team

  - `activity_logs.metadata.team_assignment_limit` (integer)
    The team assignment limit value (null if limit was removed).
    Example: 50

  - `activity_logs.metadata.enabled` (boolean)
    Indicates if the setting is enabled or disabled.
    Example: true

  - `activity_logs.metadata.mode` (string)
    The mode of the setting (e.g., when_away_only, when_away_and_reassign).
    Example: when_away_only

  - `activity_logs.metadata.consent_id` (integer)
    The ID of the impersonation consent.
    Example: 149673

  - `activity_logs.metadata.expired_at` (string)
    The timestamp when the impersonation consent expires.
    Example: 2025-12-04T09:31:57.000Z

  - `activity_logs.metadata.before` (object)
    The state of settings or values before the change. Structure varies by activity type.

  - `activity_logs.metadata.after` (object)
    The state of settings or values after the change. Structure varies by activity type.

  - `activity_logs.created_at` (integer)
    The time the activity was created.
    Example: 1671028894

  - `activity_logs.activity_type` (string)
    Enum: "admin_conversation_assignment_limit_change", "admin_ticket_assignment_limit_change", "admin_avatar_change", "admin_away_mode_change", "admin_deletion", "admin_deprovisioned", "admin_impersonation_end", "admin_impersonation_start", "admin_impersonation_consent_approved", "admin_impersonation_consent_revoked", "admin_invite_change", "admin_invite_creation", "admin_invite_deletion", "admin_login_failure", "admin_login_success", "admin_logout", "admin_password_reset_request", "admin_password_reset_success", "admin_permission_change", "admin_provisioned", "admin_two_factor_auth_change", "admin_unauthorized_sign_in_method", "app_admin_join", "app_authentication_method_change", "app_data_deletion", "app_data_export", "app_google_sso_domain_change", "app_identity_verification_change", "app_name_change", "app_outbound_address_change", "app_package_installation", "app_package_token_regeneration", "app_package_uninstallation", "app_team_creation", "app_team_deletion", "app_team_membership_modification", "app_timezone_change", "app_webhook_creation", "app_webhook_deletion", "articles_in_messenger_enabled_change", "automatic_away_mode_setting_change", "bulk_delete", "bulk_export", "campaign_deletion", "campaign_state_change", "conversation_deletion_schedule_creation", "conversation_deletion_schedule_deletion", "conversation_deletion_schedule_state_change", "conversation_deletion_schedule_update", "conversation_part_deletion", "conversation_pdf_export", "conversation_topic_change", "conversation_topic_creation", "conversation_topic_deletion", "content_redaction_rule_creation", "content_redaction_rule_deletion", "content_redaction_rule_update", "csv_import_completion", "csv_import_creation", "custom_authentication_token_creation", "help_center_settings_change", "inbound_conversations_change", "inbox_access_change", "inbox_bulk_action", "macro_creation", "macro_deletion", "macro_update", "macro_usage_export", "malicious_domains_setting_change", "message_deletion", "message_state_change", "messenger_api_secret_creation", "messenger_api_secret_deletion", "messenger_look_and_feel_change", "messenger_search_required_change", "messenger_spaces_change", "oauth_token_revocation", "office_hours_change", "role_change", "role_creation", "role_deletion", "ruleset_activation_title_preview", "ruleset_creation", "ruleset_deletion", "search_browse_enabled_change", "search_browse_required_change", "seat_change", "seat_revoke", "security_settings_change", "series_creation", "series_deletion", "series_settings_update", "series_status_change", "series_update", "strip_inbound_email_links_change", "temporary_expectation_change", "team_assignment_limit_change", "trusted_domains_setting_change", "unassign_unsnoozed_at_capacity_setting_change", "unassign_unsnoozed_when_away_setting_change", "upfront_email_collection_change", "allowed_attachment_filetypes_setting_change", "attach_uploads_inline_setting_change", "teammate_gifs_setting_change", "user_camera_attachments_setting_change", "user_conversation_attachments_setting_change", "user_file_attachments_setting_change", "user_gifs_setting_change", "user_media_attachments_setting_change", "user_voice_notes_setting_change", "welcome_message_change", "workspace_deletion_request", "hide_csat_from_agents_setting_change"

  - `activity_logs.activity_description` (string)
    A sentence or two describing the activity.
    Example: Admin updated the app's name to "My App".

## Response 401 fields (application/json):

  - `type` (string, required)
    The type is error.list
    Example: error.list

  - `request_id` (string)
    Example: f93ecfa8-d08a-4325-8694-89aeb89c8f85

  - `errors` (array, required)
    An array of one or more error objects

  - `errors.code` (string, required)
    A string indicating the kind of error, used to further qualify the HTTP response code
    Example: unauthorized

  - `errors.message` (string)
    Optional. Human readable description of the error.
    Example: Access Token Invalid

  - `errors.field` (string)
    Optional. Used to identify a particular field or query parameter that was in error.
    Example: email