Audit logs are used to provide details of user activity for various services and capabilities. Each action recorded in a log contains metadata that indicates the action type, date and time, the email ID of the user who performed the action, and additional attributes relevant to the action type. The /audit/events
endpoint in the Audit Query API allows you to programmatically retrieve event data for your organization’s activity in Platform.
The API endpoint used in this guide is part of the Audit Query API. Before continuing, please review the getting started guide for links to related documentation, a guide to reading the sample API calls in this document, and important information regarding required headers that are needed to successfully make calls to any Experience Platform API.
You can retrieve events data by making a GET request to the /audit/events
endpoint, specifying the events you wish to retrieve in the payload.
API format
GET /audit/events
The Audit Query API supports the use of query parameters to page and filter results when listing events.
Parameter | Description |
---|---|
limit |
The maximum number of records to be returned in the response. The default limit is 50. |
start |
A pointer to the first item for the returned search results. To access the next page of results, this parameter should increment by the same amount indicated by limit. Example: To access the next page of results for a request with limit=50, use the parameter start=50, then start=100 for the page after that, and so on. |
queryId |
When making a query to the /audit/events endpoint, the response includes a queryId string property. To make the same query in a separate call, you can include the Id value as a single query parameter instead of manually configuring the search parameters again. |
Request
curl -X POST \
https://platform.adobe.io/data/foundation/audit/events?limit=10
-H 'Authorization: Bearer {ACCESS_TOKEN}' \
-H 'x-api-key: {API_KEY}' \
-H 'x-gw-ims-org-id: {ORG_ID}' \
-H 'x-sandbox-name: {SANDBOX_NAME}' \
-H 'x-request-id: {TRACING_ID}' \
Response
A successful response returns the resulting datapoints for the metrics and filters specified in the request.
{
"_embedded": {
"customerAuditLogList": [
{
"userEmail": "{USER_ID}",
"userIpAddresses": [ ],
"eventType": "Core",
"id": "32b72208-3035-4bc6-b434-39e34401a864",
"version": "1.0",
"imsOrgId": "{ORGANIZATION_ID}",
"sandboxName": "prod",
"region": "VA7",
"requestId": "5NphpgUQdQnjTWOcS9DSMs2wD1EUMlYG",
"authId": "96715f98-d100-4575-8491-ebbcea654eb9",
"permissionResource": "Sandbox",
"permissionType": "RESET",
"assetType": "Sandbox",
"assetId": "prod",
"assetName": "prod",
"action": "Reset",
"status": "Allow",
"failureCode": "",
"timestamp": "2021-08-04T21:58:09.745+0000"
},
{
"userEmail": "{USER_ID}",
"userIpAddresses": [ ],
"eventType": "Core",
"id": "a178736a-8fa1-47da-bac5-b0d9e741e414",
"version": "1.0",
"imsOrgId": "{ORGANIZATION_ID}",
"sandboxName": "prod",
"region": "VA7",
"requestId": "7AlGIAhWvaEzYWHLzvuf26AAFAkqSyKg",
"authId": "60fc1077-4aef-4e1f-a5ff-f64183e060f4",
"permissionResource": "Sandbox",
"permissionType": "RESET",
"assetType": "Sandbox",
"assetId": "prod",
"assetName": "prod",
"action": "Reset",
"status": "Allow",
"failureCode": "",
"timestamp": "2021-08-04T21:28:00.301+0000"
},
{
"userEmail": "{USER_ID}",
"userIpAddresses": [ ],
"eventType": "Core",
"id": "ccfe8c77-9b93-481d-a561-0b2edf3b77dc",
"version": "1.0",
"imsOrgId": "{ORGANIZATION_ID}",
"sandboxName": "prod",
"region": "VA7",
"requestId": "hArqS4CAa8wfRPnKuxV4yaA82atxwzYu",
"authId": "80b7d887-9338-4cd5-9d79-2483b03f0160",
"permissionResource": "Sandbox",
"permissionType": "RESET",
"assetType": "Sandbox",
"assetId": "prod",
"assetName": "prod",
"action": "Reset",
"status": "Allow",
"failureCode": "",
"timestamp": "2021-08-04T20:58:07.750+0000"
}
]
},
"_links": {
"self": {
"href": "https://platform.adobe.io/data/foundation/audit/events?limit=10&start=0&property=type%253D%253Dcore"
},
"next": {
"href": "https://platform.adobe.io/data/foundation/audit/events?queryId=cXVlcnlJZD0xYjA4MDM4MV81ZWNkXzRjNTZfYTM2N18zYWExOWI5YzNhNTlfMTYyODExNDY5MTg1NSZ0b3RhbEVsZW1lbnRzPTI2&start=10&limit=10"
},
"page": {
"href": "https://platform.adobe.io/data/foundation/audit/events?queryId=cXVlcnlJZD0xYjA4MDM4MV81ZWNkXzRjNTZfYTM2N18zYWExOWI5YzNhNTlfMTYyODExNDY5MTg1NSZ0b3RhbEVsZW1lbnRzPTI2&limit=10{&start}",
"templated": true
}
},
"page": {
"size": 10,
"totalElements": 3,
"totalPages": 1,
"number": 1
},
"queryId": "cXVlcnlJZD0xYjA4MDM4MV81ZWNkXzRjNTZfYTM2N18zYWExOWI5YzNhNTlfMTYyODExNDY5MTg1NSZ0b3RhbEVsZW1lbnRzPTI2"
}
Property | Description |
---|---|
customerAuditLogList |
An array whose objects represent each of the events specified in the request. Each object contains information about the filter configuration and returned event data. |
userEmail |
The email of the user who performed the event. |
eventType |
The type of event. The types of events include Core and Enhanced . |
imsOrgId |
The ID of the organization that the event took place under. |
permissionResource |
The product or capability that provided the permission perform the action. A resource can be any of the following:
|
permissionType |
The permission type involved with the action. |
assetType |
The type of Platform resource that the action was performed on. |
assetId |
A unique identifier for the Platform resource that the action was performed on. |
assetName |
The name of the Platform resource that the action was performed on. |
action |
The type of action that was recorded for the event. An action can be any of the following:
|
status |
The status of the action. A status can be any of the following: Allow Deny Failure Success |