team.accessLogs method
We're still building and not all features are available quite yet. Enjoy this peek into the future!
Not ready for the future? Return to the past at api.slack.com.
Usage info
This method is used to retrieve the "access logs" for users on a workspace.
Each access log entry represents a user accessing Slack from a specific user, IP address, and user agent combination.
The team_id is only relevant when using an org-level token. This field will be ignored if the API call is sent using a workspace-level token.
Need to time travel? Set the before parameter to the oldest timestamp returned by the method to browse access logs from further back in time.
Response
The method's paginated response contains a list of access log entries. Each item in the logins array represents a number of possible user interactions, collated by the user, IP address, and user agent combination. These include actual logins as well as other API calls that are typically made when accessing Slack.
Each access log entry contains the user id and username that accessed Slack.
date_first is a Unix timestamp of the first access log entry for this user, IP address, and user agent combination.
date_last is the most recent for that combination.
count is the total number of access log entries for that combination.
ip is the IP address of the device used.
user_agent is the reported user agent string from the browser or client application.
isp is our best guess at the internet service provider owning the IP address.
country and region are also our best guesses on where the access originated, based on the IP address.
Pagination
The paging information contains the count of items returned, the total number of items reacted to, the page of results returned in this response, and the total number of pages available. Please note that the max count value is 1000 and the max page value is 100.
This method also supports cursor-based pagination to make it easier to incrementally collect information. To begin pagination, specify a limit value under 1000. Responses will include a top-level response_metadata attribute containing a next_cursor value. Use this value as a cursor parameter in a subsequent request along with limit and you may navigate through the collection page by virtual page.
If you encounter a 500 status or fatal_error code when calling this method, it is recommended to use cursor-based pagination.
Refer to pagination for more information.