Audit Logs Resource

When an administrative action is performed in a guild, an entry is added to its audit log. Viewing audit logs requires the VIEW_AUDIT_LOG permission and can be fetched using the Get Guild Audit Log endpoint. All audit log entries are stored for 45 days.

Audit Reason

When performing an eligible action using the API, users can pass an X-Audit-Log-Reason header to indicate why the action was taken. More information is in the audit log entry section.

Audit Log Object

Audit Log Structure
FieldTypeDescription
audit_log_entriesarray[audit log entry object]Audit log entries
application_commandsarray[application command object]Application commands referenced in the audit log
auto_moderation_rulesarray[automod rule object]AutoMod rules referenced in the audit log
guild_scheduled_eventsarray[guild scheduled event object]Guild scheduled events referenced in the audit log
integrationsarray[partial integration object]Partial integrations referenced in the audit log
threads 1array[thread-specific channel object]Threads referenced in the audit log
usersarray[user object]Users referenced in the audit log
webhooksarray[webhook object]Webhooks referenced in the audit log

1 Threads referenced in THREAD_CREATE and THREAD_UPDATE events are included in the threads map, since archived threads might not be kept in memory by clients.

Audit Log Entry Object

Each audit log entry represents a single administrative action (or event), indicated by action_type. Most entries contain one to many changes in the changes array that affected an entity in Discord—whether that's a user, channel, guild, emoji, or something else.

The information (and structure) of an entry's changes will be different depending on its type. For example, in MEMBER_ROLE_UPDATE events there is only one change: a member is either added or removed from a specific role. However, in CHANNEL_CREATE events there are many changes, including (but not limited to) the channel's name, type, and permission overwrites added. More details are in the change object section.

Users can specify why an administrative action is being taken by passing an X-Audit-Log-Reason request header, which will be stored as the audit log entry's reason field. The X-Audit-Log-Reason header supports up to 512 URL-encoded UTF-8 characters. Reasons are visible in the client and when fetching audit log entries with the API.

Audit Log Entry Structure
FieldTypeDescription
target_id?stringID of the affected entity (webhook, user, role, etc.)
changes?array[audit log change object]Changes made to the `target_id``
user_id?snowflakeThe user who made the changes
idsnowflakeThe ID of the entry
action_typeintegerThe type of action that occurred
options?optional audit entry infoAdditional info for certain action types
reason?stringThe reason for the change (max 512 characters)
Audit Log Events

The table below lists audit log events and values (the action_type field) that you may receive.

The Object Changed column notes which object's values may be included in the entry. Though there are exceptions, possible keys in the changes array typically correspond to the object's fields. The descriptions and types for those fields can be found in the linked documentation for the object.

If no object is noted, there won't be a changes array in the entry, though other fields like the target_id still exist and many have fields in the options array.

EventValueDescriptionObject Changed
GUILD_UPDATE1Guild settings were updatedGuild
CHANNEL_CREATE10Channel was createdChannel
CHANNEL_UPDATE11Channel settings were updatedChannel
CHANNEL_DELETE12Channel was deletedChannel
CHANNEL_OVERWRITE_CREATE13Permission overwrite was added to a channelChannel Overwrite
CHANNEL_OVERWRITE_UPDATE14Permission overwrite was updated for a channelChannel Overwrite
CHANNEL_OVERWRITE_DELETE15Permission overwrite was deleted from a channelChannel Overwrite
MEMBER_KICK20Member was removed from guild
MEMBER_PRUNE21Members were pruned from guild
MEMBER_BAN_ADD22Member was banned from guild
MEMBER_BAN_REMOVE23Member was unbanned from guild
MEMBER_UPDATE24Member was updated in guildMember
MEMBER_ROLE_UPDATE25Member was added or removed from a rolePartial Role 1
MEMBER_MOVE26Member was moved to a different voice channel
MEMBER_DISCONNECT27Member was disconnected from a voice channel
BOT_ADD28Bot user was added to guild
ROLE_CREATE30Role was createdRole
ROLE_UPDATE31Role was editedRole
ROLE_DELETE32Role was deletedRole
INVITE_CREATE40Guild invite was createdInvite and Invite Metadata 1
INVITE_UPDATE41Guild invite was updatedInvite and Invite Metadata 1
INVITE_DELETE42Guild invite was deletedInvite and Invite Metadata 1
WEBHOOK_CREATE50Webhook was createdWebhook 1
WEBHOOK_UPDATE51Webhook properties or channel were updatedWebhook 1
WEBHOOK_DELETE52Webhook was deletedWebhook 1
EMOJI_CREATE60Emoji was createdEmoji
EMOJI_UPDATE61Emoji name was updatedEmoji
EMOJI_DELETE62Emoji was deletedEmoji
MESSAGE_DELETE72Single message was deleted
MESSAGE_BULK_DELETE73Multiple messages were deleted
MESSAGE_PIN74Message was pinned to a channel
MESSAGE_UNPIN75Message was unpinned from a channel
INTEGRATION_CREATE80Integration was added to guildIntegration
INTEGRATION_UPDATE81Integration was updated (e.g. its scopes were updated)Integration
INTEGRATION_DELETE82Integration was removed from guildIntegration
STAGE_INSTANCE_CREATE83Stage instance was created (stage channel becomes live)Stage Instance
STAGE_INSTANCE_UPDATE84Stage instance details were updatedStage Instance
STAGE_INSTANCE_DELETE85Stage instance was deleted (stage channel no longer live)Stage Instance
STICKER_CREATE90Sticker was createdSticker
STICKER_UPDATE91Sticker details were updatedSticker
STICKER_DELETE92Sticker was deletedSticker
GUILD_SCHEDULED_EVENT_CREATE100Event was createdGuild Scheduled Event
GUILD_SCHEDULED_EVENT_UPDATE101Event was updatedGuild Scheduled Event
GUILD_SCHEDULED_EVENT_DELETE102Event was cancelledGuild Scheduled Event
THREAD_CREATE110Thread was created in a channelThread
THREAD_UPDATE111Thread was updatedThread
THREAD_DELETE112Thread was deletedThread
APPLICATION_COMMAND_PERMISSION_UPDATE121Permissions were updated for a commandApplication Command Permission 1
AUTO_MODERATION_RULE_CREATE140AutoMod rule was createdAutoMod Rule
AUTO_MODERATION_RULE_UPDATE141AutoMod rule was updatedAutoMod Rule
AUTO_MODERATION_RULE_DELETE142AutoMod rule was deletedAutoMod Rule
AUTO_MODERATION_BLOCK_MESSAGE143Message was blocked by AutoMod
AUTO_MODERATION_FLAG_TO_CHANNEL144Message was flagged by AutoMod
AUTO_MODERATION_USER_COMMUNICATION_DISABLED145Member was timed out by AutoMod
AUTO_MODERATION_QUARANTINE_USER146Member was quarantined by AutoMod
CREATOR_MONETIZATION_REQUEST_CREATED150Creator monetization request was created
CREATOR_MONETIZATION_TERMS_ACCEPTED151Creator monetization terms were accepted
ONBOARDING_PROMPT_CREATE163Onboarding prompt was createdOnboarding Prompt
ONBOARDING_PROMPT_UPDATE164Onboarding prompt was updatedOnboarding Prompt
ONBOARDING_PROMPT_DELETE165Onboarding prompt was deletedOnboarding Prompt
ONBOARDING_CREATE166Onboarding was createdOnboarding
ONBOARDING_UPDATE167Onboarding was updatedOnboarding
VOICE_CHANNEL_STATUS_UPDATE192Voice channel status was updatedChannel
VOICE_CHANNEL_STATUS_DELETE193Voice channel status was deletedChannel

1 Object has exception(s) to available keys. See the exceptions section below for details.

Optional Audit Entry Info
FieldTypeDescriptionAction Type
application_id?snowflakeThe ID of the application whose permissions were targetedAPPLICATION_COMMAND_PERMISSION_UPDATE
auto_moderation_rule_name?stringThe name of the AutoMod rule that was triggeredAUTO_MODERATION_BLOCK_MESSAGE, AUTO_MODERATION_FLAG_TO_CHANNEL, AUTO_MODERATION_USER_COMMUNICATION_DISABLED, AUTO_MODERATION_QUARANTINE_USER
auto_moderation_rule_trigger_type?stringThe trigger type of the AutoMod rule that was triggeredAUTO_MODERATION_BLOCK_MESSAGE, AUTO_MODERATION_FLAG_TO_CHANNEL, AUTO_MODERATION_USER_COMMUNICATION_DISABLED, AUTO_MODERATION_QUARANTINE_USER
channel_id?snowflakeThe channel in which the entities were targetedMEMBER_MOVE, MESSAGE_PIN, MESSAGE_UNPIN, MESSAGE_DELETE, STAGE_INSTANCE_CREATE, STAGE_INSTANCE_UPDATE, STAGE_INSTANCE_DELETE
count?stringNumber of entities that were targetedMESSAGE_DELETE, MESSAGE_BULK_DELETE, MEMBER_DISCONNECT, MEMBER_MOVE
delete_member_days?stringNumber of days after which inactive members were kickedMEMBER_PRUNE
id?snowflakeThe ID of the overwritten entityCHANNEL_OVERWRITE_CREATE, CHANNEL_OVERWRITE_UPDATE, CHANNEL_OVERWRITE_DELETE
integration_type?stringThe type of integration which performed the actionMEMBER_KICK, MEMBER_ROLE_UPDATE
members_removed?stringNumber of members removed by the pruneMEMBER_PRUNE
message_id?snowflakeThe ID of the message that was targetedMESSAGE_PIN, MESSAGE_UNPIN
role_name?stringThe name of the role (only present if type is "0")CHANNEL_OVERWRITE_CREATE, CHANNEL_OVERWRITE_UPDATE, CHANNEL_OVERWRITE_DELETE
type? 1stringThe type of overwritten entityCHANNEL_OVERWRITE_CREATE, CHANNEL_OVERWRITE_UPDATE, CHANNEL_OVERWRITE_DELETE
statusstringThe new status of the voice channelVOICE_CHANNEL_STATUS_UPDATE

1 Due to technical limitations, this field is always serialized as a string, not an integer.

Audit Log Change Object

Many audit log events include a changes array in their entry object. The structure for the individual changes varies based on the event type and its changed objects, so apps shouldn't depend on a single pattern of handling audit log events.

Audit Log Change Structure

Some events don't follow the same pattern as other audit log events. Details about these exceptions are explained in the next section.

FieldTypeDescription
new_value?mixed (matches object field's type)New value of the key
old_value?mixed (matches object field's type)Old value of the key
keystringName of the changed entity, with a few exceptions
Audit Log Change Exceptions

For most objects, the change keys may be any field on the changed object. The following table details the exceptions to this pattern.

Object ChangedChange Key ExceptionsChange Object Exceptions
AutoMod Rule$add_keyword_filter, $remove_keyword_filter, $add_regex_patterns, $remove_regex_patterns, $add_allow_list, $remove_allow_list as keysnew_value and old_value are arrays of strings representing the keywords, regex patterns, or allow list items that were added or removed
Application Command PermissionA snowflake is used as the keyThe changes array contains objects with a key field representing the entity whose command was affected (role, channel, or user ID), a previous permissions object (with an old_value key), and an updated permissions object (with a new_value key)
Guild MemberAdditional bypasses_verification key (instead of object's flags)new_value and old_value are booleans representing whether the member bypasses verification
Invite and Invite MetadataAdditional channel_id and inviter_id keys (instead of object's channel.id and inviter.id)
Partial Role$add and $remove as keysnew_value is an array of objects that contain the role id and name

Partial Integration Object

Partial Integration Structure
FieldTypeDescription
idsnowflakeThe ID of the integration
namestringThe name of the integration
typestringThe type of integration
accountaccount objectThe integration's account information
application_id?snowflakeThe OAuth2 application for Discord integrations
Example Partial Integration
{
"id": "1029376264039039006",
"type": "discord",
"name": "Good University",
"account": {
"id": "971811349262917662",
"name": "Good University"
},
"application_id": "971811349262917662"
}

Partial Role Object

Partial Role Structure
FieldTypeDescription
idsnowflakeThe ID of the role
namestringThe name of the role
Example Partial Role
{
"name": "I am a role",
"id": "584120723283509258"
}

Endpoints

Get Guild Audit Log

GET/guilds/{guild.id}/audit-logs

Returns an audit log object for the guild. Requires the 'VIEW_AUDIT_LOG' permission.

Query String Params
FieldTypeDescription
before?snowflakeGet entries before this entry ID
after?snowflakeGet entries after this entry ID
limit?integerMax number of entries to return (1-100, default 50)
user_id?snowflakeGet actions made by a specific user
action_type?integerThe type of audit log event to filter by