Query raw operational audit log entries

Request

Queries the raw operational audit log for entries that match the specified filter and paging parameters. The maximum allowed value for the take parameter is 100.

Note

This endpoint is used exclusively for operational events, encompassing entity updates for M.Job, M.Target, M.JobDescription, M.Agent, and M.AgentActivity entities.

Security

OAuth2

Path

entityIdinteger, (int64)(NullableOfInt64)

The identifier of the entity to filter audit records.

Example:12345

Query

EventTypesArray of strings(String[])

The event types to filter the logs.

Example:EventTypes=EntityUpdated&EventTypes=EntityCreated&EventTypes=PackageExported&EventTypes=downloadordercompleted&EventTypes=Original Updated&EventTypes=

DefinitionNamesArray of strings(String[])

The definition names to filter the logs.

Example:DefinitionNames=M.Asset&DefinitionNames=User&DefinitionNames=M.Job&DefinitionNames=M.Asset&DefinitionNames=User&DefinitionNames=M.Job

UserIdsArray of integers, (int64)(Int64[])

The user IDs to filter the logs.

Example:UserIds=10001&UserIds=10002&UserIds=10003&UserIds=10001&UserIds=10002&UserIds=10003

UserNamesArray of strings(String[])

The usernames to filter the logs.

Example:UserNames=admin&UserNames=user1&UserNames=editor&UserNames=admin&UserNames=user1&UserNames=editor

MessageIdinteger, (int64)(NullableOfInt64)

The message ID to filter the logs.

Example:MessageId=123456

PropertiesArray of strings(String[])

The properties' names to filter the logs.

Example:Properties=Title&Properties=Description&Properties=Status&Properties=Title&Properties=Description&Properties=Status

RelationsArray of strings(String[])

The relations' names to filter the logs.

Example:Relations=AssetToAssetType&Relations=UserToUserProfile&Relations=AssetToAssetType&Relations=UserToUserProfile

Culturestring(String)

The culture to filter the logs.

Example:Culture=en-US

ScrollIdstring(String)

The ID of the scroll session to get the next results for.

Example:ScrollId=scroll-session-abc123

ScrollTimestring, (date-span)(NullableOfTimeSpan)

The time to keep the scroll session active.

Example:ScrollTime=00:05:00

FullTextstring(String)

The full-text search term to filter audit records.

Example:FullText=user login

Rawstring(String)

The raw query string for advanced filtering.

EntityIdinteger, (int64)(NullableOfInt64)

The identifier of the entity to filter audit records.

Example:EntityId=12345

Fromstring, (date-time)(NullableOfDateTime)

The start date of the range filter.

Example:From=2025-01-01

Tostring, (date-time)(NullableOfDateTime)

The end date of the range filter.

Example:To=2025-01-31

Skipinteger, (int32)(NullableOfInt32)

The number of items to skip for pagination. Null if negative.

Default:0

Example:Skip=0

Takeinteger, (int32)(NullableOfInt32)

The number of items to take for pagination. Null if negative.

Default:25

Example:Take=25

Sortstring(String)

The field name to sort by.

Example:Sort=timestamp

Orderstring(SortOrder)

The sort order (ascending or descending).

Enum:"ascending""descending"

Ascendingboolean(Boolean)

Whether the sort order is ascending.

Range.Beginstring, (date-time)(DateTime)

Range.Endstring, (date-time)(DateTime)

curl -i -X GET \
  'https://your-server/api/audit/raw/operational/query/12345?EventTypes=EntityUpdated%2CEntityCreated%2CPackageExported%2Cdownloadordercompleted%2COriginal%20Updated%2CPolicySaved%2CEntityDefinitionCreated%2CEntityDefinitionUpdated%2CEntityDefinitionDeleted&DefinitionNames=M.Asset%2CUser%2CM.Job&UserIds=10001%2C10002%2C10003&UserNames=admin%2Cuser1%2Ceditor&MessageId=123456&Properties=Title%2CDescription%2CStatus&Relations=AssetToAssetType%2CUserToUserProfile&Culture=en-US&ScrollId=scroll-session-abc123&ScrollTime=00%3A05%3A00&FullText=user%20login&Raw=string&EntityId=12345&From=2025-01-01&To=2025-01-31&Skip=0&Take=25&Sort=timestamp&Order=ascending&Ascending=true&Range.Begin=2019-08-24T14%3A15%3A22Z&Range.End=2019-08-24T14%3A15%3A22Z' \
  -H 'Authorization: Bearer <YOUR_TOKEN_HERE>'

Responses

Successful operation

Bodyapplication/json

itemsArray of objects or null(ListOfRawAuditResource)

Gets or sets the list of items.

total_itemsinteger or null, (int64)(NullableOfInt64)

Gets or sets the total number of items.

returned_itemsinteger or null, (int64)(NullableOfInt64)

Gets or sets the number of returned items.

offsetinteger or null, (int32)(NullableOfInt32)

Gets or sets the offset of the items.

nextobject(Link)

Represents a link to a resource.

previousobject(Link)

Represents a link to a resource.

identifierstring or null(String)

Gets or sets the identifier of the resource.

selfobject(Link)

Represents a link to a resource.

property name*any(JToken)additional property

Response

{
  "items": [
    { … }
  ],
  "total_items": 0,
  "returned_items": 0,
  "offset": 0,
  "next": {
    "href": "string",
    "filename_properties": [ … ],
    "title": "string",
    "templated": false
  },
  "previous": {
    "href": "string",
    "filename_properties": [ … ],
    "title": "string",
    "templated": false
  },
  "identifier": "string",
  "self": {
    "href": "string",
    "filename_properties": [ … ],
    "title": "string",
    "templated": false
  },
  "property1": null,
  "property2": null
}