`team.accessLogs` method

Facts

DescriptionGets the access logs for the current team.

Method Access

HTTP
Slack CLI
JavaScript
Python
Java

GET https://slack.com/api/team.accessLogs

slack api team.accessLogs

app.client.team.accessLogs

app.client.team_accessLogs

app.client().teamAccessLogs

Scopes

User token:

admin

Content types

application/x-www-form-urlencoded

application/json

Rate LimitsTier 2: 20+ per minute

Arguments

Required arguments

tokenstringRequired

Authentication token bearing required scopes. Tokens should be passed as an HTTP Authorization header or alternatively, as a POST parameter.

Example: xxxx-xxxxxxxxx-xxxx

Optional arguments

beforeOptional

End of time range of logs to include in results (inclusive).

Default: now

Acceptable values: now

Example: 1457989166

countstringOptional

Default: 100

pagestringOptional

Default: 1

cursorstringOptional

Parameter for pagination. Set cursor equal to the next_cursor attribute returned by the previous request's response_metadata. This parameter is optional, but pagination is mandatory: the default value simply fetches the first "page" of the collection. See pagination for more details.

Example: dXNlcjpVMDYxTkZUVDI=

limitintegerOptional

The maximum number of items to return. Fewer than the requested number of items may be returned, even if the end of the list hasn't been reached. If specified, result is returned using a cursor-based approach instead of a classic one.

Example: 20

team_idstringOptional

encoded team id to get logs from, required if org token is used

Usage info

This method is used to retrieve the "access logs" for users on a workspace.

Each access log entry represents a user accessing Slack from a specific user, IP address, and user agent combination.

The team_id is only relevant when using an org-level token. This field will be ignored if the API call is sent using a workspace-level token. On Enterprise Grid, passing a workspace ID returns only team site and 3rd-party app access. Passing no team_id returns complete access data for the org (desktop, mobile, web).

Need to time travel? Set the before parameter to the oldest timestamp returned by the method to browse access logs from further back in time.

Need richer login event data (e.g., user_login, user_login_failed with auth method and account type)? Refer to our Audit Logs API docs.

Response

This response demonstrates pagination and two access log entries.

{
  "ok": true,
  "logins": [
    {
      "user_id": "U45678",
      "username": "alice",
      "date_first": 1422922864,
      "date_last": 1422922864,
      "count": 1,
      "ip": "127.0.0.1",
      "user_agent": "SlackWeb Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.35 Safari/537.36",
      "isp": "BigCo ISP",
      "country": "US",
      "region": "CA"
    },
    {
      "user_id": "U12345",
      "username": "white_rabbit",
      "date_first": 1422922493,
      "date_last": 1422922493,
      

Facts​

Arguments​