Guild audit logs

An audit log entry records one change made to a guild and the account that made it. Only List guild audit logs and its Admin API counterpart read them.

Audit log reason

A route marked Audit reason accepts the X-Audit-Log-Reason request header, listed with the other standard request headers. FiveCord reads the value verbatim and never percent-decodes it, so a caller that percent-encodes the reason stores and reads back the percent-encoded form.

FiveCord trims the value. A value that is blank before trimming, empty after it, or longer than 512 characters after it counts as no reason at all. None of those values fails the request, so a reason that misses the bound is dropped and the operation still succeeds.

The channel and message routes that write entries record the header as well: Modify channel, Delete or leave channel, Set channel permission overwrite, Delete channel permission overwrite, Delete message, Bulk delete messages, Pin message, and Unpin message.

Two operations use a reason from the request body when the header supplies none:

• Create or replace guild ban uses the body reason.
• Modify guild member uses the trimmed timeout_reason when the body also has communication_disabled_until.

FiveCord never percent-decodes a body reason either. The operation writes the accepted reason onto its entry, returns it as the entry reason field, and sends it in the Guild Audit Log Entry Create Dispatch.

FiveCord resolves the reason again when it reads an entry. A MEMBER_BAN_ADD entry with a blank stored reason returns the ban reason from its change list, and a MEMBER_UPDATE entry with a blank stored reason returns the timeout reason stored with it, when it has one. The result is trimmed, and a blank result is omitted.

Some operations record no reason at all

Bot addition, the role FiveCord creates and assigns to a bot it adds with permissions, a Visionary role grant, a message deletion made by Delete message attachment, and a consolidated bulk deletion entry never have one.

Guild audit log response object

One page of audit history together with the accounts and webhooks it references. Only audit_log_entries is paginated.

Structure

Field	Type	Description
audit_log_entries1	array[guild audit log entry object]	The page of entries this request returned
users2	array[partial user object]	The accounts the returned entries name
webhooks3	array[audit log webhook object]	The webhooks a returned webhook action targets

¹ The page ordering is defined by the query parameters of the request that produced it

² Deduplicated by user ID, and a referenced value that is not a snowflake names no account

³ One object for each distinct webhook that a returned webhook action targets and that still exists, so a deleted webhook resolves to no object

users has the actor of every returned entry and each account the entry references:

• target_id of every action from MEMBER_KICK through MEMBER_DISCONNECT, and of BOT_ADD
• target_id of a channel overwrite action whose options.type is 1
• the owner_id change new_value of GUILD_UPDATE
• the moderator_id change old_value of MEMBER_BAN_REMOVE
• options.inviter_id of INVITE_DELETE
• the creator_id change old_value of WEBHOOK_DELETE, EMOJI_DELETE, and STICKER_DELETE

An account that can no longer be resolved is still returned, as the deleted-account representation with the username DeletedUser, the discriminator 0000, the global name Deleted User, a null avatar, a null avatar colour, and flags of 0.

Guild audit log entry object

One recorded guild change. An entry is immutable once written, except for a run of message deletion entries, which List guild audit logs can replace with a single consolidated entry.

Structure

Field	Type	Description
id	snowflake	The ID of the entry, whose snowflake timestamp is the time it was written
action_type	integer	Audit action value that identifies the recorded operation
user_id1	snowflake	The ID of the user that did the action
target_id2	?string	The ID of the affected entity
reason?3	string	The audit log reason recorded with the operation
options?4	audit log options object	The context fields this audit action records
changes?5	array[audit log change object]	The fields the mutation changed

¹ Every entry has the acting user ID, and an entry produced by consolidation has the actor of the consolidated run

² A decimal snowflake string for every action except INVITE_CREATE and INVITE_DELETE, where it is the invite code, and null for MESSAGE_BULK_DELETE

³ The field is omitted when no non-blank reason resolves as described under audit log reason, so an entry written by consolidation never has one

⁴ The field is omitted when the action recorded no option key that this registry publishes

⁵ The field is omitted when the action records no field change, so it is never returned as an empty array

An entry expires 45 days after the write

Entries remain available for 45 days. A consolidated entry starts a new 45-day period.

Example

{
  "id": "1501314428688998184",
  "action_type": 24,
  "user_id": "1489002177550843905",
  "target_id": "1489002177550843906",
  "reason": "Nickname violated the rules",
  "changes": [{"key": "nick", "old_value": "spam bot", "new_value": null}]
}

Audit actions

The Value column is the numeric action_type, which is also the value the action_type query filter accepts. Each description names what target_id identifies and which audit log options the action records. The overwrite options are id, type, channel_id, and role_name¹⁰. The invite options are max_age, max_uses, temporary, channel_id⁷, and inviter_id⁷.

Value	Name	Description
1	GUILD_UPDATE1	Guild settings or ownership were changed. target_id is the guild, and the action records no options
10	CHANNEL_CREATE	Guild channel was created. target_id is the channel, and the action records type
11	CHANNEL_UPDATE	Guild channel was changed. target_id is the channel, and the action records type
12	CHANNEL_DELETE	Guild channel was deleted. target_id is the channel, and the action records type
13	CHANNEL_OVERWRITE_CREATE	Channel permission overwrite was created. target_id is the role or member, and the action records the overwrite options
14	CHANNEL_OVERWRITE_UPDATE	Channel permission overwrite was changed. target_id is the role or member, and the action records the overwrite options
15	CHANNEL_OVERWRITE_DELETE	Channel permission overwrite was deleted. target_id is the role or member, and the action records the overwrite options
20	MEMBER_KICK2	Member was removed by a moderator. target_id is the user, and the action records no options
21	MEMBER_PRUNE3	Inactive members were pruned. target_id is nothing, and the action records no options
22	MEMBER_BAN_ADD	Guild ban was created or replaced. target_id is the user, and the action records delete_message_seconds4
23	MEMBER_BAN_REMOVE	Guild ban was removed. target_id is the user, and the action records no options
24	MEMBER_UPDATE	Guild member state was changed. target_id is the user, and the action records no options
25	MEMBER_ROLE_UPDATE	One role was added to or removed from a member. target_id is the user, and the action records role_name5
26	MEMBER_MOVE6	Member voice session was moved to another channel. target_id is the user, and the action records channel_id and count
27	MEMBER_DISCONNECT6	Member voice session was disconnected. target_id is the user, and the action records channel_id and count
28	BOT_ADD	Bot was added to the guild. target_id is the user, and the action records temporary
30	ROLE_CREATE	Role was created. target_id is the role, and the action records no options
31	ROLE_UPDATE	Role was changed. target_id is the role, and the action records role_name
32	ROLE_DELETE	Role was deleted. target_id is the role, and the action records no options
40	INVITE_CREATE	Invite was created. target_id is the invite code, and the action records the invite options
41	INVITE_UPDATE8	Invite was changed. target_id is the invite code, and the action records no options
42	INVITE_DELETE	Invite was deleted. target_id is the invite code, and the action records the invite options
50	WEBHOOK_CREATE	Webhook was created. target_id is the webhook, and the action records channel_id7
51	WEBHOOK_UPDATE	Webhook was changed. target_id is the webhook, and the action records channel_id7
52	WEBHOOK_DELETE	Webhook was deleted. target_id is the webhook, and the action records channel_id7
60	EMOJI_CREATE	Emoji was created. target_id is the emoji, and the action records no options
61	EMOJI_UPDATE	Emoji was changed. target_id is the emoji, and the action records no options
62	EMOJI_DELETE	Emoji was deleted. target_id is the emoji, and the action records no options
72	MESSAGE_DELETE	Single message was deleted. target_id is the message, and the action records channel_id
73	MESSAGE_BULK_DELETE9	Several messages were deleted in one operation. target_id is nothing, and the action records channel_id and count
74	MESSAGE_PIN	Message was pinned. target_id is the message, and the action records channel_id and message_id
75	MESSAGE_UNPIN	Message was unpinned. target_id is the message, and the action records channel_id and message_id
90	STICKER_CREATE	Sticker was created. target_id is the sticker, and the action records no options
91	STICKER_UPDATE	Sticker was changed. target_id is the sticker, and the action records no options
92	STICKER_DELETE	Sticker was deleted. target_id is the sticker, and the action records no options

¹ Recorded by Modify guild, by Modify guild custom invite URL, and by Transfer guild ownership, and target_id is the guild in every case

² A kick entry is always recorded with no change list, so the removed membership state is not published through the entry

³ The value is defined by the wire contract and is accepted by the action_type filter, and no current guild operation records it

⁴ The option is recorded when the resolved message deletion window of the ban is positive. An older ban entry can have the deprecated delete_member_days option

⁵ Recorded when the role exists at the write. The role ID is the difference between the roles change values in the guild member change fields

⁶ count is always 1, and channel_id is the destination channel for a move and the vacated channel for a disconnect. A move into the channel the session already occupies records no entry

⁷ The option is recorded only when the recorded entity has that value, so an invite with no channel or no inviter records neither, and a webhook with no channel records no option at all

⁸ The filter accepts this value, and no current guild operation records this action

⁹ A bulk deletion entry is recorded either by a bulk message deletion operation or by the consolidation described under List guild audit logs

¹⁰ Recorded for an overwrite whose target is a role other than @everyone, when that role exists at the write

An update that changes nothing records no entry

GUILD_UPDATE, CHANNEL_UPDATE, CHANNEL_OVERWRITE_UPDATE, MEMBER_UPDATE, MEMBER_ROLE_UPDATE, MEMBER_MOVE, ROLE_UPDATE, WEBHOOK_UPDATE, EMOJI_UPDATE, and STICKER_UPDATE need a change other than ip. GUILD_UPDATE also ignores guild_id, member_count, and the image width and height fields. A reason alone records nothing.

Audit log options object

Every field is present only for the actions listed against it in the audit actions registry. Only the keys in this registry are published, and the response omits options entirely when an entry recorded none of them.

Structure

Field	Type	Description
channel_id	string	The decimal ID of the channel the action concerns
count1	number	The number of entities the action affected
delete_member_days2	string	The whole days of the banned member’s messages the ban deleted
delete_message_seconds3	number	The seconds of the banned member’s messages the ban deleted
id	string	The decimal ID of the role or member an overwrite applies to
integration_type4	number	The type of the integration the entry names
message_id	string	The decimal ID of the single message the action concerns
members_removed4	number	The number of memberships the action removed
role_name5	string	The name of the role the action concerns, as it was when the entry was written
type6	number	The channel type, or the permission overwrite type
inviter_id	string	The decimal ID of the user that created the invite
max_age	number	The configured invite lifetime in seconds
max_uses	number	The configured maximum use count
temporary	boolean	Whether the recorded entity is temporary
uses4	number	The invite use count recorded with the action

¹ The value is the length of the consolidated run for MESSAGE_BULK_DELETE and is always 1 for the voice actions

² Deprecated, and present only on a ban entry recorded before delete_message_seconds. Its value is the legacy delete_message_days body field of Create or replace guild ban, so a ban that sent only delete_message_seconds has "0"

³ Present when the resolved deletion window of Create or replace guild ban is positive, whichever body field set it

⁴ The field is defined by the wire contract and no current guild operation records it

⁵ Recorded by MEMBER_ROLE_UPDATE, ROLE_UPDATE, and an overwrite action whose target is a role other than @everyone

⁶ The value is a channel type for the channel actions and a permission overwrite type for the overwrite actions

Audit log change object

One field a mutation changed, with the value on each side of the change.

Structure

Field	Type	Description
key1	string	The name of the field that changed, drawn from the change fields of the entity the action targets
old_value?2	audit log change value	The value the field held before the mutation
new_value?2	audit log change value	The value the field holds after the mutation

¹ A change whose key is ip is never published through this resource, and changes is omitted entirely when no other change remains

² A creation has only new_value, a deletion has only old_value, and a modification has both, so a change object always has at least one of the two

A change value is a string, a JSON number, a boolean, null, an array of strings, an array of numbers, or an object with added and removed string arrays. The last shape comes only from the permissions_diff key of a role modification.

A 64-bit domain value is a decimal string

FiveCord serialises a permission mask or a snowflake as a decimal string. A bounded number such as a position or a colour remains a JSON number.

A change list holds only the differing fields

An update records one change object per differing field, so an unchanged field is absent. The field that holds the entity’s own ID, such as channel_id or role_id, never appears in an update change list, though it does appear in a creation or deletion list, where only one side of the comparison exists.

Change fields

Each table below names the fields an action of that family can record.

Guild change fields

Recorded by GUILD_UPDATE.

Field	Type	Description
guild_id1	string	The decimal ID of the guild itself
name	string	The name the guild was given by this change (1-100 characters)
owner_id	string	The decimal ID of the guild owner
vanity_url_code	?string	The configured custom invite code, or null when the guild has none
icon_hash	?string	The guild icon hash, or null when the guild has no icon
banner_hash	?string	The guild banner hash, or null when the guild has no banner
banner_width	?number	The guild banner width in pixels, or null when the guild has no banner
banner_height	?number	The guild banner height in pixels, or null when the guild has no banner
splash_hash	?string	The guild splash hash, or null when the guild has no splash
splash_width	?number	The guild splash width in pixels, or null when the guild has no splash
splash_height	?number	The guild splash height in pixels, or null when the guild has no splash
splash_card_alignment	number	The splash card alignment recorded with the change
embed_splash_hash	?string	The guild embed splash hash, or null when the guild has no embed splash
embed_splash_width	?number	The guild embed splash width in pixels, or null when the guild has no embed splash
embed_splash_height	?number	The guild embed splash height in pixels, or null when the guild has no embed splash
features2	array[string]	The guild features held at this side of the change, in ascending order
verification_level	number	The verification level recorded with the change
mfa_level	number	The MFA level recorded with the change
nsfw_level	number	The NSFW level recorded with the change
nsfw	boolean	Whether the guild is marked age restricted
content_warning_level	number	The guild content warning level recorded with the change
content_warning_text	?string	The configured content warning text, or null when the guild sets none
explicit_content_filter	number	The guild explicit content filter level recorded with the change
default_message_notifications	number	The default message notification level recorded with the change
system_channel_id	?string	The decimal ID of the configured system channel, or null when the guild sets none
system_channel_flags	number	The system channel flags mask recorded with the change
rules_channel_id3	?string	The decimal ID of the configured rules channel, or null when the guild sets none
afk_channel_id	?string	The decimal ID of the configured AFK voice channel, or null when the guild sets none
afk_timeout	number	The AFK timeout in seconds
disabled_operations3	number	The disabled guild operations mask recorded with the change
member_count3	number	The member count recorded with the mutation
message_history_cutoff	?ISO8601 timestamp	The configured message history cutoff, or null when the guild sets none

¹ The field holds the same value on both sides of every guild action, so it never produces a change object

² A change object appears only when a feature was added or removed

³ No current guild operation records the field

Modify guild records every field in this table except guild_id, owner_id, vanity_url_code, rules_channel_id, disabled_operations, and member_count. Transfer guild ownership records only owner_id, and Modify guild custom invite URL records only vanity_url_code.

Channel change fields

Recorded by CHANNEL_CREATE, CHANNEL_UPDATE, and CHANNEL_DELETE.

Field	Type	Description
channel_id	string	The decimal ID of the channel itself
type	number	The channel type recorded with the change
name	?string	The name the channel was given by this change
topic	?string	The topic the channel was given by this change, or null when it has none
url1	?string	The destination URL of the channel, or null when it has none
parent_id	?string	The decimal ID of the parent category, or null when the channel sits at the top level
position	number	The position of the channel among its siblings
nsfw	?boolean	Whether the channel is marked age restricted, or null when it has no override
content_warning_level	number	The content warning level recorded with the change
content_warning_text	?string	The configured content warning text, or null when the channel sets none
rate_limit_per_user	number	The slowmode interval in seconds
user_limit	?number	The configured voice occupancy limit
voice_connection_limit	?number	The configured per-user voice connection limit
bitrate	?number	The voice bitrate in bits per second
rtc_region	?string	The pinned voice region, or null when the channel is routed automatically
permission_overwrite_count2	number	The number of permission overwrites the channel has

¹ Recorded only for a GUILD_LINK channel type

² No current channel operation records the field. An individual overwrite mutation records its own permission overwrite entry

Changing permission_overwrites through Modify channel records overwrite entries and adds no change to the CHANNEL_UPDATE entry.

Permission overwrite change fields

Recorded by the channel overwrite actions. Every value in this family is a string.

Field	Type	Description
id	string	The decimal ID of the role or member the overwrite applies to
type	string	The decimal permission overwrite type
allow	string	The decimal permission mask the overwrite grants
deny	string	The decimal permission mask the overwrite denies

Guild member change fields

Recorded by MEMBER_UPDATE and MEMBER_ROLE_UPDATE.

Field	Type	Description
user_id	string	The decimal ID of the member itself
nick	?string	The nickname the member holds in this guild, or null when none is set
roles	array[string]	The assigned role IDs as decimal strings, in ascending string order
avatar_hash	?string	The guild avatar hash, or null when the member has no guild avatar
banner_hash	?string	The guild banner hash, or null when the member has no guild banner
bio	?string	The guild profile bio, or null when none is set
pronouns	?string	The guild profile pronouns, or null when none is set
accent_color	?number	The guild profile accent colour, or null when none is set
deaf	boolean	Whether a moderator has deafened the member
mute	boolean	Whether a moderator has muted the member
communication_disabled_until	?ISO8601 timestamp	The time the communication restriction expires, or null when the member is not restricted
temporary	boolean	Whether the membership is temporary

Voice move change fields

Recorded by MEMBER_MOVE and MEMBER_DISCONNECT.

Field	Type	Description
channel_id1	string	The decimal ID of the voice channel the session occupied

¹ A move records the previous channel as old_value and the destination as new_value, while a disconnect records only old_value

Guild ban change fields

Recorded by MEMBER_BAN_ADD and MEMBER_BAN_REMOVE.

Field	Type	Description
user_id	string	The decimal ID of the banned user
moderator_id	string	The decimal ID of the user that issued the ban
banned_at	ISO8601 timestamp	The time the ban was issued
expires_at	?ISO8601 timestamp	The expiry of a temporary ban, or null for a permanent ban
reason1	?string	The stored ban reason

¹ The body reason when the request sent one, and the X-Audit-Log-Reason value otherwise. The entry reason is the header when one was sent, so the two differ when a request sends both with different values

Guild role change fields

Recorded by ROLE_CREATE, ROLE_UPDATE, and ROLE_DELETE.

Field	Type	Description
role_id	string	The decimal ID of the role itself
name	string	The name the role was given by this change (1-100 characters)
permissions	string	The decimal permission mask the role grants
position	number	The position of the role in the guild hierarchy
hoist_position	?number	The separate hoisting position, or null when the role has none
color	number	The colour recorded for the role
icon_hash	?string	The role icon hash, or null when the role has no icon
unicode_emoji	?string	The role Unicode emoji, or null when the role has none
hoist	boolean	Whether the role is displayed separately
mentionable	boolean	Whether the role is mentionable
permissions_diff1	object	The permission names this change added and removed

¹ Recorded only by Modify guild role, and only when the mask changed. The value is an object with added and removed string arrays of permission names

permissions_diff arrives as new_value with no old_value, and the same change list still has the permissions change.

Modify guild role positions records one ROLE_UPDATE entry for each role that moved, with only the position change. FiveCord orders the roles other than @everyone by position descending, then by ID ascending, before and after the write. The largest set of roles that keep their relative order counts as unmoved, and where several sets qualify, the set whose roles come earliest in the new order is used. A request that only renumbers positions records no entry.

Modify role hoist positions and Reset role hoist positions apply the same rule to the member list order, with only the hoist_position change in each entry. That order is the hoisted roles other than @everyone, by hoist_position descending with position used when a role has no hoist position, then by ID ascending. A role that is not hoisted has an entry whenever its hoist_position changed.

Invite change fields

Recorded by INVITE_CREATE and INVITE_DELETE.

Field	Type	Description
code	string	The code that identifies the invite
channel_id	?string	The decimal ID of the channel the invite points at
guild_id	?string	The decimal ID of the guild the invite belongs to
inviter_id	?string	The decimal ID of the user that created the invite
uses	number	The use count recorded with the change
max_uses	number	The configured maximum use count
max_age	number	The configured invite lifetime in seconds
temporary	boolean	Whether accepting the invite grants a temporary membership
created_at	ISO8601 timestamp	The time the invite was created

Webhook change fields

Recorded by WEBHOOK_CREATE, WEBHOOK_UPDATE, and WEBHOOK_DELETE.

Field	Type	Description
id	string	The decimal ID of the webhook itself
guild_id	?string	The decimal ID of the guild the webhook belongs to
channel_id	?string	The decimal ID of the channel the webhook posts to
name	string	The name the webhook posts under (1-80 characters)
creator_id	?string	The decimal ID of the user that created the webhook
avatar_hash	?string	The webhook avatar hash, or null when no avatar is set
type1	number	The kind of webhook the change recorded

¹ The value is 1 for an incoming webhook and 2 for a channel follower webhook

Emoji change fields

Recorded by EMOJI_CREATE, EMOJI_UPDATE, and EMOJI_DELETE.

Field	Type	Description
emoji_id	string	The decimal ID of the emoji itself
name	string	The name the emoji was given by this change (2-32 characters)
animated	boolean	Whether the emoji is animated
creator_id	string	The decimal ID of the user that created the emoji

Sticker change fields

Recorded by STICKER_CREATE, STICKER_UPDATE, and STICKER_DELETE.

Field	Type	Description
sticker_id	string	The decimal ID of the sticker itself
name	string	The name the sticker was given by this change (2-30 characters)
description	?string	The sticker description, or null when it has none
animated	boolean	Whether the sticker is animated
creator_id	string	The decimal ID of the user that created the sticker

Audit log webhook object

A reduced webhook object. It omits the execution token, application ID, and creating user, and it names the avatar hash avatar_hash where the full object names it avatar.

Structure

Field	Type	Description
id	snowflake	The ID of the webhook
type1	integer	The kind of webhook this record describes
guild_id	?snowflake	The ID of the guild containing the webhook
channel_id	?snowflake	The ID of the channel the webhook sends messages to
name	string	The name the webhook posts under
avatar_hash	?string	The avatar hash of the webhook, or null when no avatar is set

¹ The value is 1 for an incoming webhook and 2 for a channel follower webhook

List guild audit logs

GET/v1/guilds/{guild_id}/audit-logsBot

Returns one page of guild audit history as a guild audit log response object. Requires VIEW_AUDIT_LOG in the target guild, and no MFA elevation applies.

A guild ID that names no guild returns 404 UNKNOWN_GUILD. A non-member of an existing guild returns 403 MISSING_PERMISSIONS, so guild existence is visible to any authenticated caller.

Path parameters

Field	Type	Description
guild_id	snowflake	The ID of the guild whose audit log is read

Query parameters

Field	Type	Description
limit?1	integer	The maximum number of entries to return (0-100, default 50)
before?2	snowflake	The cursor selecting entries older than this audit entry ID
after?2	snowflake	The cursor selecting entries newer than this audit entry ID
user_id?3	snowflake	The acting user ID the page is filtered by
action_type?3	integer	The audit action value the page is filtered by

¹ A negative value and a value above 100 are both rejected, and the accepted value 0 is processed as 1

² The cursors are mutually exclusive, and supplying both returns 400 INVALID_FORM_BODY with CANNOT_SPECIFY_BOTH_BEFORE_AND_AFTER against before

³ Supplying either filter disables message deletion consolidation for the request, so a page filtered by actor or action returns the unconsolidated entries

The read is ordered from newest to oldest by entry ID. before selects entries below the cursor and after selects entries above it, both read in that same descending order. An after page therefore begins with the newest entry above the cursor.

Consolidated entries have new IDs but retain the position of the run they replace. Sort the page by ID if a strictly descending array is required.

A stored update entry that fails the no-change rule is skipped and does not count toward limit. A page holds fewer entries than limit only when the guild has no further matching entries in that direction.

Response

Status	Body	Condition
200	guild audit log response object	Page was returned
400	error response	Both cursors were supplied, or a filter value is invalid
4031	error response	Guild is unavailable, or VIEW_AUDIT_LOG is absent
404	error response	Guild does not exist and the request returns UNKNOWN_GUILD

¹ The error code is MISSING_ACCESS for a guild with UNAVAILABLE_FOR_EVERYONE, or UNAVAILABLE_FOR_EVERYONE_BUT_STAFF without the instance staff flag, and MISSING_PERMISSIONS otherwise

An unfiltered read consolidates message deletion entries

Without user_id or action_type, runs of two or more consecutive MESSAGE_DELETE entries sharing one actor and one channel become a single MESSAGE_BULK_DELETE entry.

Side effects

A consolidated entry has a new ID, options.count equal to the number of replaced entries and no reason. It emits Guild Audit Log Entry Create to guild sessions holding VIEW_AUDIT_LOG.

Rate limit

20 requests per 10 seconds for each authenticated user and guild ID, on the guild:audit_logs::guild_id bucket.