Audit Log

When an administrative action is performed in a guild, an entry is added to its audit log. Viewing audit logs requires the VIEW_AUDIT_LOG permission and can be fetched using the Get Guild Audit Log endpoint. All audit log entries are stored for 45 days.

Audit Reason

When performing an eligible action using the API, users can pass an X-Audit-Log-Reason header to indicate why the action was taken. More information is in the audit log entry section.

Audit Log Entry Object

Each audit log entry represents a single administrative action (or event), indicated by action_type. Most entries contain one to many changes in the changes array that affected an entity in Discord—whether that's a user, channel, guild, emoji, or something else.

The information (and structure) of an entry's changes will be different depending on its type. For example, in MEMBER_ROLE_UPDATE events there is only one change: a member is either added or removed from a specific role. However, in CHANNEL_CREATE events there are many changes, including (but not limited to) the channel's name, type, and permission overwrites added. More details are in the change object section.

Users can specify why an administrative action is being taken by passing an X-Audit-Log-Reason request header, which will be stored as the audit log entry's reason field. The X-Audit-Log-Reason header supports up to 512 URL-encoded UTF-8 characters. Reasons are visible in the client and when fetching audit log entries with the API.

Audit Log Entry Structure
FieldTypeDescription
target_id?snowflakeID of the affected entity (webhook, user, role, etc.)
changes?array[audit log change object]Changes made to the `target_id``
user_id?snowflakeThe user who made the changes
idsnowflakeThe ID of the entry
action_typeintegerThe type of action that occurred
options?optional audit entry info objectAdditional info for certain action types
reason?stringThe reason for the change (max 512 characters)
Audit Log Action Type

The table below lists audit log events and values (the action_type field) that you may receive.

The Object Changed column notes which object's values may be included in the entry. Though there are exceptions, possible keys in the changes array typically correspond to the object's fields. The descriptions and types for those fields can be found in the linked documentation for the object.

If no object is noted, there won't be a changes array in the entry, though other fields like the target_id still exist and many have fields in the options array.

ValueNameDescriptionObject Changed
1GUILD_UPDATEGuild settings were updatedGuild
10CHANNEL_CREATEChannel was createdChannel
11CHANNEL_UPDATEChannel settings were updatedChannel
12CHANNEL_DELETEChannel was deletedChannel
13CHANNEL_OVERWRITE_CREATEPermission overwrite was added to a channelChannel Overwrite
14CHANNEL_OVERWRITE_UPDATEPermission overwrite was updated for a channelChannel Overwrite
15CHANNEL_OVERWRITE_DELETEPermission overwrite was deleted from a channelChannel Overwrite
20MEMBER_KICKMember was removed from guild
21MEMBER_PRUNEMembers were pruned from guild
22MEMBER_BAN_ADDMember was banned from guild
23MEMBER_BAN_REMOVEMember was unbanned from guild
24MEMBER_UPDATEMember was updated in guildMember
25MEMBER_ROLE_UPDATEMember was added or removed from a rolePartial Role 1
26MEMBER_MOVEMember was moved to a different voice channel
27MEMBER_DISCONNECTMember was disconnected from a voice channel
28BOT_ADDBot user was added to guild
30ROLE_CREATERole was createdRole
31ROLE_UPDATERole was editedRole
32ROLE_DELETERole was deletedRole
40INVITE_CREATEGuild invite was createdInvite and Invite Metadata 1
41INVITE_UPDATEGuild invite was updatedInvite and Invite Metadata 1
42INVITE_DELETEGuild invite was deletedInvite and Invite Metadata 1
50WEBHOOK_CREATEWebhook was createdWebhook 1
51WEBHOOK_UPDATEWebhook properties or channel were updatedWebhook 1
52WEBHOOK_DELETEWebhook was deletedWebhook 1
60EMOJI_CREATEEmoji was createdEmoji
61EMOJI_UPDATEEmoji name was updatedEmoji
62EMOJI_DELETEEmoji was deletedEmoji
72MESSAGE_DELETESingle message was deleted
73MESSAGE_BULK_DELETEMultiple messages were deleted
74MESSAGE_PINMessage was pinned to a channel
75MESSAGE_UNPINMessage was unpinned from a channel
80INTEGRATION_CREATEIntegration was added to guildIntegration
81INTEGRATION_UPDATEIntegration was updated (e.g. its scopes were updated)Integration
82INTEGRATION_DELETEIntegration was removed from guildIntegration
83STAGE_INSTANCE_CREATEStage instance was created (stage channel becomes live)Stage Instance
84STAGE_INSTANCE_UPDATEStage instance details were updatedStage Instance
85STAGE_INSTANCE_DELETEStage instance was deleted (stage channel no longer live)Stage Instance
90STICKER_CREATESticker was createdSticker
91STICKER_UPDATESticker details were updatedSticker
92STICKER_DELETESticker was deletedSticker
100GUILD_SCHEDULED_EVENT_CREATEEvent was createdGuild Scheduled Event
101GUILD_SCHEDULED_EVENT_UPDATEEvent was updatedGuild Scheduled Event
102GUILD_SCHEDULED_EVENT_DELETEEvent was cancelledGuild Scheduled Event
110THREAD_CREATEThread was created in a channelThread
111THREAD_UPDATEThread was updatedThread
112THREAD_DELETEThread was deletedThread
121APPLICATION_COMMAND_PERMISSION_UPDATEPermissions were updated for a commandApplication Command Permission 1
130SOUNDBOARD_SOUND_CREATESoundboard sound was createdSoundboard Sound
131SOUNDBOARD_SOUND_UPDATESoundboard sound was updatedSoundboard Sound
132SOUNDBOARD_SOUND_DELETESoundboard sound was deletedSoundboard Sound
140AUTO_MODERATION_RULE_CREATEAutoMod rule was createdAutoMod Rule
141AUTO_MODERATION_RULE_UPDATEAutoMod rule was updatedAutoMod Rule
142AUTO_MODERATION_RULE_DELETEAutoMod rule was deletedAutoMod Rule
143AUTO_MODERATION_BLOCK_MESSAGEMessage was blocked by AutoMod
144AUTO_MODERATION_FLAG_TO_CHANNELMessage was flagged by AutoMod
145AUTO_MODERATION_USER_COMMUNICATION_DISABLEDMember was timed out by AutoMod
146AUTO_MODERATION_QUARANTINE_USERMember was quarantined by AutoMod
150CREATOR_MONETIZATION_REQUEST_CREATEDCreator monetization request was created
151CREATOR_MONETIZATION_TERMS_ACCEPTEDCreator monetization terms were accepted
163ONBOARDING_PROMPT_CREATEOnboarding prompt was createdOnboarding Prompt
164ONBOARDING_PROMPT_UPDATEOnboarding prompt was updatedOnboarding Prompt
165ONBOARDING_PROMPT_DELETEOnboarding prompt was deletedOnboarding Prompt
166ONBOARDING_CREATEOnboarding was initializedOnboarding
167ONBOARDING_UPDATEOnboarding was updatedOnboarding
171GUILD_HOME_FEATURE_ITEMMessage was featured in guild home
172GUILD_HOME_REMOVE_ITEMMessage was removed from guild home
180HARMFUL_LINKS_BLOCKED_MESSAGEMessage blocked by harmful links filter
190HOME_SETTINGS_CREATENew member welcome was initializedNew Member Welcome
191HOME_SETTINGS_UPDATENew member welcome was updatedNew Member Welcome
192VOICE_CHANNEL_STATUS_CREATEVoice channel status was updatedChannel
193VOICE_CHANNEL_STATUS_DELETEVoice channel status was deletedChannel
194CLYDE_AI_PROFILE_UPDATEClyde AI profile was updated
200GUILD_SCHEDULED_EVENT_EXCEPTION_CREATEException was created for a guild scheduled eventGuild Scheduled Event Exception
201GUILD_SCHEDULED_EVENT_EXCEPTION_UPDATEException was updated for a guild scheduled eventGuild Scheduled Event Exception
202GUILD_SCHEDULED_EVENT_EXCEPTION_DELETEException was deleted for a guild scheduled eventGuild Scheduled Event Exception
210GUILD_MEMBER_VERIFICATION_UPDATEMember verification settings were updatedMember Verification 1
211GUILD_PROFILE_UPDATEGuild profile was updatedGuild Profile 1
212PIN_PERMISSION_MIGRATION_COMPLETEMANAGE_MESSAGES permission was migrated to the new PIN_MESSAGES permission
213BYPASS_SLOWMODE_PERMISSION_MIGRATION_COMPLETEMANAGE_MESSAGES, MANAGE_CHANNEL and MANAGE_THREADS permissions were migrated to the new BYPASS_SLOWMODE permission

1 Object has exception(s) to available keys. See the exceptions section below for details.

Optional Audit Entry Info
FieldTypeDescriptionAction Type
application_idsnowflakeThe ID of the application whose permissions were targetedAPPLICATION_COMMAND_PERMISSION_UPDATE
auto_moderation_rule_namestringThe name of the AutoMod rule that was triggeredAUTO_MODERATION_BLOCK_MESSAGE, AUTO_MODERATION_FLAG_TO_CHANNEL, AUTO_MODERATION_USER_COMMUNICATION_DISABLED, AUTO_MODERATION_QUARANTINE_USER
auto_moderation_rule_trigger_typestringThe trigger type of the AutoMod rule that was triggeredAUTO_MODERATION_BLOCK_MESSAGE, AUTO_MODERATION_FLAG_TO_CHANNEL, AUTO_MODERATION_USER_COMMUNICATION_DISABLED, AUTO_MODERATION_QUARANTINE_USER
channel_idsnowflakeThe channel in which the entities were targetedMEMBER_MOVE, MESSAGE_PIN, MESSAGE_UNPIN, MESSAGE_DELETE, STAGE_INSTANCE_CREATE, STAGE_INSTANCE_UPDATE, STAGE_INSTANCE_DELETE
count?stringNumber of entities that were targetedMESSAGE_DELETE, MESSAGE_BULK_DELETE, MEMBER_DISCONNECT, MEMBER_MOVE
delete_member_days?stringNumber of days after which inactive members were kickedMEMBER_PRUNE
event_exception_idsnowflakeThe ID of the guild scheduled event exception that was targetedGUILD_SCHEDULED_EVENT_EXCEPTION_CREATE, GUILD_SCHEDULED_EVENT_EXCEPTION_UPDATE, GUILD_SCHEDULED_EVENT_EXCEPTION_DELETE
idsnowflakeThe ID of the overwritten entityCHANNEL_OVERWRITE_CREATE, CHANNEL_OVERWRITE_UPDATE, CHANNEL_OVERWRITE_DELETE
integration_type?stringThe type of integration which performed the actionMEMBER_KICK, MEMBER_ROLE_UPDATE
members_removed?stringNumber of members removed by the pruneMEMBER_PRUNE
message_idsnowflakeThe ID of the message that was targetedMESSAGE_PIN, MESSAGE_UNPIN
role_name?stringThe name of the role (only present if type is "0")CHANNEL_OVERWRITE_CREATE, CHANNEL_OVERWRITE_UPDATE, CHANNEL_OVERWRITE_DELETE
statusstringThe new status of the voice channelVOICE_CHANNEL_STATUS_UPDATE
type 1stringThe type of overwritten entityCHANNEL_OVERWRITE_CREATE, CHANNEL_OVERWRITE_UPDATE, CHANNEL_OVERWRITE_DELETE

1 Due to technical limitations, this field is always serialized as a string, not an integer.

Audit Log Change Object

Many audit log events include a changes array in their entry object. The structure for the individual changes varies based on the event type and its changed objects, so apps shouldn't depend on a single pattern of handling audit log events.

Audit Log Change Structure

Some events don't follow the same pattern as other audit log events. Details about these exceptions are explained in the next section.

FieldTypeDescription
new_value?mixed (matches object field's type)New value of the key
old_value?mixed (matches object field's type)Old value of the key
keystringName of the changed entity, with a few exceptions
Audit Log Change Exceptions

For most objects, the change keys may be any field on the changed object. The following table details the exceptions to this pattern.

Object ChangedChange Key ExceptionsChange Object Exceptions
AutoMod Rule$add_keyword_filter, $remove_keyword_filter, $add_regex_patterns, $remove_regex_patterns, $add_allow_list, $remove_allow_list as keysnew_value and old_value are arrays of strings representing the keywords, regex patterns, or allow list items that were added or removed
Application Command PermissionA snowflake is used as the keyThe changes array contains objects with a key field representing the entity whose command was affected (role, channel, or user ID), a previous permissions object (with an old_value key), and an updated permissions object (with a new_value key)
Guild MemberAdditional bypasses_verification key (instead of object's flags)new_value and old_value are booleans representing whether the member bypasses verification
Invite and Invite MetadataAdditional channel_id and inviter_id keys (instead of object's channel.id and inviter.id)
Partial Role$add and $remove as keysnew_value is an array of objects that contain the role id and name
Member Verificationverification_enabled and manual_approval_enabled as keysnew_value and old_value are booleans representing whether verification or manual approval is enabled
Guild ProfileAdditional server_tag key (instead of object's tag)

Partial Integration Object

Partial Integration Structure
FieldTypeDescription
idsnowflakeThe ID of the integration
namestringThe name of the integration
typestringThe type of integration
accountaccount objectThe integration's account information
application_id?snowflakeThe OAuth2 application for Discord integrations
Example Partial Integration
{
"id": "1029376264039039006",
"type": "discord",
"name": "Good University",
"account": {
"id": "971811349262917662",
"name": "Good University"
},
"application_id": "971811349262917662"
}

Partial Role Object

Partial Role Structure
FieldTypeDescription
idsnowflakeThe ID of the role
namestringThe name of the role
Example Partial Role
{
"name": "I am a role",
"id": "584120723283509258"
}

Endpoints

Get Guild Audit Log

GET/guilds/{guild.id}/audit-logs

Returns the audit log for the guild. Requires the VIEW_AUDIT_LOG permission.

Query String Params
FieldTypeDescription
before?snowflakeGet entries before this entry ID
after?snowflakeGet entries after this entry ID
limit?integerMax number of entries to return (1-100, default 50)
user_id?snowflakeGet actions made by a specific user
target_id?snowflakeGet actions affecting a specific entity
action_type?integerThe type of audit log event to filter by
Response Body
FieldTypeDescription
audit_log_entriesarray[audit log entry object]Audit log entries
application_commandsarray[application command object]Application commands referenced in the audit log
auto_moderation_rulesarray[automod rule object]AutoMod rules referenced in the audit log
guild_scheduled_eventsarray[guild scheduled event object]Guild scheduled events referenced in the audit log
integrationsarray[partial integration object]Partial integrations referenced in the audit log
threadsarray[channel object]Threads referenced in the audit log
usersarray[partial user object]Users referenced in the audit log
webhooksarray[webhook object]Webhooks referenced in the audit log