# List directory provisioning logs

`GET /v1/directories/{directory_id}/provisioning-logs` · permission `directories:read`

Lists the provisioning log of a SCIM directory, newest first. Every authenticated SCIM request the identity provider sent is one record: method, path template (the real ID is never in the path), resource type and ID, an operation summary without values, ignored attribute names, HTTP status, `scim_type`, duration, the client address prefix (IPv4 /24, IPv6 /48), the client class and whether the mass deprovision hold stopped the request. Request and response bodies, attribute values, the full IP address, the User-Agent and the token value are never stored and never returned.

Records are kept for your plan's log retention period (Free 7 days, Startup 14, Business 30, Enterprise 90). The order is always newest first; there is no `order` parameter. Records of a deleted directory remain readable with `GET /v1/logs?type=scim.request`.

## Request

| Field | Type | Required | Description |
|---|---|---|---|
| `directory_id` | path | yes | SCIM directory ID (`dir_…`). |
| `limit` | query | no | 1–100, default 20. |
| `after` | query | no | The cursor from `list_metadata.after` (older records). |
| `before` | query | no | The cursor from `list_metadata.before` (newer records). |
| `from` | query | no | Inclusive lower bound (RFC 3339). |
| `to` | query | no | Exclusive upper bound (RFC 3339). |

There is no request body.

## Response

`200 OK` with a page of records.

```json
{
  "data": [
    {
      "id": "evt_01j9xp4q6r8s0t2v4w6x8y0z2b",
      "occurred_at": "2026-10-20T12:00:00Z",
      "outcome": "success",
      "organization_id": "org_01j9xk1m3n5p7q9r1s3t5v7w9x",
      "token_id": "dst_01j9xn2p4q6r8s0t2v4w6x8y0z",
      "method": "PATCH",
      "path_template": "PATCH /Users/{id}",
      "resource_type": "User",
      "resource_id": "dsu_01j9xq5r7s9t1v3w5x7y9z1a3c",
      "operation_summary": ["replace:active"],
      "ignored_attributes": [],
      "status": 200,
      "scim_type": null,
      "duration_ms": 12,
      "client_ip_prefix": "203.0.113.0/24",
      "client_class": "okta",
      "held": false,
      "request_id": "0192f5e0-0000-7000-8000-000000000001",
      "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736"
    }
  ],
  "list_metadata": {
    "before": null,
    "after": null
  }
}
```

## Errors

| HTTP | code | When |
|---|---|---|
| 400 | `invalid_cursor` | The cursor is malformed or belongs to another request. |
| 400 | `range_outside_retention` | `from` is earlier than your plan's retention period. |
| 404 | `not_found` | The directory does not exist in this environment. |
| 422 | `validation_failed` | `limit` is out of range, `from` or `to` is not RFC 3339, `to` is not after `from`, or `order` was given (`unsupported`). |
| 401 | `unauthenticated` | The credential is missing, invalid or revoked. |
| 403 | `insufficient_permissions` | The credential lacks the required permission. |
| 429 | `rate_limited` | The rate limit was exceeded; retry after the `Retry-After` period. |
| 503 | `service_unavailable` | Directory sync or log search is temporarily unavailable or not configured in this deployment; retry after the `Retry-After` period. |

## Example

```bash
curl -i "https://api.eu.keenauth.com/v1/directories/dir_01j9xm2n4p6q8r0s2t4v6w8y0z/provisioning-logs?limit=20" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"
```

```bash
keenauth directories provisioning-logs list dir_01j9xm2n4p6q8r0s2t4v6w8y0z --from 2026-10-01T00:00:00Z
```

## Personal data

This endpoint carries personal data: directory (SCIM) users. [Personal data in the KeenAuth APIs](/docs/policies/personal-data) describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.