---
descriptions:
  get_audit_log_configuration:
    organization_id: The ID of the Organization
    retention_period_in_days: The number of days audit log events are retained
    state: 'The state of the audit log trail (e.g., "active", "inactive", "disabled")'
    log_stream: >-
      Optional object containing the audit log stream configuration. Only
      present if a stream is configured.
    log_stream.id: The unique identifier for the audit log stream
    log_stream.type: >-
      The type of destination for the audit log stream (e.g., "Datadog",
      "Splunk", "S3", "GoogleCloudStorage", "GenericHttps")
    log_stream.state: >-
      The current state of the audit log stream ("active", "inactive", "error",
      "invalid")
    log_stream.last_synced_at: >-
      ISO-8601 timestamp of when the last event was successfully synced, or null
      if no events have been synced
    log_stream.created_at: ISO-8601 timestamp indicating when the audit log stream was created
reference:
  curl:
    - key: get_audit_log_configuration
      id: get_audit_log_configuration
      url: /reference/audit-logs/configuration
      title: '/organizations/:id/audit_log_configuration'
      type: GET
      parameters:
        - key: id
          type: string
          description: The organization ID
      returns:
        - key: anonymous
          type: object
          unwrap: true
          properties:
            - key: organization_id
              type: string
              description: The ID of the Organization
            - key: retention_period_in_days
              type: number
              description: The number of days audit log events are retained
            - key: state
              type: string
              description: >-
                The state of the audit log trail (e.g., "active", "inactive",
                "disabled")
            - key: log_stream
              type: object
              optional: true
              description: >-
                Optional object containing the audit log stream configuration.
                Only present if a stream is configured.
              properties:
                - key: id
                  type: string
                  description: The unique identifier for the audit log stream
                - key: type
                  type: string
                  description: >-
                    The type of destination for the audit log stream (e.g.,
                    "Datadog", "Splunk", "S3", "GoogleCloudStorage",
                    "GenericHttps")
                - key: state
                  type: string
                  description: >-
                    The current state of the audit log stream ("active",
                    "inactive", "error", "invalid")
                - key: last_synced_at
                  type: string
                  optional: true
                  description: >-
                    ISO-8601 timestamp of when the last event was successfully
                    synced, or null if no events have been synced
                - key: created_at
                  type: string
                  description: >-
                    ISO-8601 timestamp indicating when the audit log stream was
                    created
originalPath: >-
  .tmp-workos-clone/packages/docs/content/reference/audit-logs/configuration/index.mdx
---

# Get Audit Log Configuration

The Audit Log Configuration endpoint provides a single view of an organization’s audit logging setup. It includes retention settings (how long audit logs are stored), the audit log state (active, inactive, or disabled), and—if configured—the audit log stream, which sends events to external destinations like Splunk, Datadog, S3, Google Cloud Storage, or a custom HTTPS endpoint.

The log_stream field is optional and only appears if the organization has a stream configured. If no stream is set up, the response includes only the audit log retention and state information.

<CodeBlock referenceId="get_audit_log_configuration">
  <CodeBlockTab title="Request" file="get-configuration-request" />
  <CodeBlockTab title="Response" file="get-configuration-response" />
  <CodeBlockTab
    title="Response (No Stream)"
    file="get-configuration-response-no-stream"
  />
</CodeBlock>