List directory provisioning logs

GET /v1/directories/{directory_id}/provisioning-logs · permission directories:read

Lists the provisioning log of a SCIM directory, newest first. Every authenticated SCIM request the identity provider sent is one record: method, path template (the real ID is never in the path), resource type and ID, an operation summary without values, ignored attribute names, HTTP status, scim_type, duration, the client address prefix (IPv4 /24, IPv6 /48), the client class and whether the mass deprovision hold stopped the request. Request and response bodies, attribute values, the full IP address, the User-Agent and the token value are never stored and never returned.

Records are kept for your plan's log retention period (Free 7 days, Startup 14, Business 30, Enterprise 90). The order is always newest first; there is no order parameter. Records of a deleted directory remain readable with GET /v1/logs?type=scim.request.

Request

Field Type Required Description
directory_id path yes SCIM directory ID (dir_…).
limit query no 1–100, default 20.
after query no The cursor from list_metadata.after (older records).
before query no The cursor from list_metadata.before (newer records).
from query no Inclusive lower bound (RFC 3339).
to query no Exclusive upper bound (RFC 3339).

There is no request body.

Response

200 OK with a page of records.

{
  "data": [
    {
      "id": "evt_01j9xp4q6r8s0t2v4w6x8y0z2b",
      "occurred_at": "2026-10-20T12:00:00Z",
      "outcome": "success",
      "organization_id": "org_01j9xk1m3n5p7q9r1s3t5v7w9x",
      "token_id": "dst_01j9xn2p4q6r8s0t2v4w6x8y0z",
      "method": "PATCH",
      "path_template": "PATCH /Users/{id}",
      "resource_type": "User",
      "resource_id": "dsu_01j9xq5r7s9t1v3w5x7y9z1a3c",
      "operation_summary": ["replace:active"],
      "ignored_attributes": [],
      "status": 200,
      "scim_type": null,
      "duration_ms": 12,
      "client_ip_prefix": "203.0.113.0/24",
      "client_class": "okta",
      "held": false,
      "request_id": "0192f5e0-0000-7000-8000-000000000001",
      "trace_id": "4bf92f3577b34da6a3ce929d0e0e4736"
    }
  ],
  "list_metadata": {
    "before": null,
    "after": null
  }
}

Errors

HTTP code When
400 invalid_cursor The cursor is malformed or belongs to another request.
400 range_outside_retention from is earlier than your plan's retention period.
404 not_found The directory does not exist in this environment.
422 validation_failed limit is out of range, from or to is not RFC 3339, to is not after from, or order was given (unsupported).
401 unauthenticated The credential is missing, invalid or revoked.
403 insufficient_permissions The credential lacks the required permission.
429 rate_limited The rate limit was exceeded; retry after the Retry-After period.
503 service_unavailable Directory sync or log search is temporarily unavailable or not configured in this deployment; retry after the Retry-After period.

Example

curl -i "https://api.eu.keenauth.com/v1/directories/dir_01j9xm2n4p6q8r0s2t4v6w8y0z/provisioning-logs?limit=20" \
  -H "Authorization: Bearer $KEENAUTH_SECRET_KEY"

keenauth directories provisioning-logs list dir_01j9xm2n4p6q8r0s2t4v6w8y0z --from 2026-10-01T00:00:00Z

Personal data

This endpoint carries personal data: directory (SCIM) users. Personal data in the KeenAuth APIs describes what is stored, how long it is kept and how it is deleted. Do not send special categories of personal data (health, biometric data, religion, political opinions, sexual orientation) in any field.