Data APIAudit

List Data Audit Events

Lists data audit events that match query parameters.

Authentication

AuthorizationBearer

Access token, prefixed by Bearer .

Query parameters

filterOps.context.changeIDstringOptional
ID for the audit event. Use this to uniquely identify a specific audit record.
filterOps.context.requestIDstringOptional
ID for the request that caused the event. Use to correlate multiple audit events triggered by a single API request.
filterOps.context.sessionIDstringOptional
ID for the session in which the request was sent. Present when a session context is available.
filterOps.context.actorstringOptional

Member who sent the request. Depending on actorType, this may be a user ID or a service account ID. For users this is their email address.

filterOps.context.actorTypeenumOptional
Type of member who sent the request.
Allowed values:
filterOps.context.accessTypeenumOptional
Type of access for the request.
Allowed values:
filterOps.context.ipAddressstringOptional
IP Address of the client that made the request.
filterOps.context.originstringOptional

HTTP Origin request header (including scheme, hostname, and port) of the request. Present only for browser-originated requests. Absent for server-to-server API calls.

filterOps.context.authModeenumOptional

Authentication mode the actor used. OKTA_JWT: Federated identity via Okta SSO. SERVICE_ACCOUNT_JWT: Service account JWT (machine-to-machine). PAT_JWT: Personal Access Token issued as a JWT. API_KEY: Static API key.

Allowed values:
filterOps.context.jwtIDstringOptional

ID of the JWT token (the jti claim). Identifies the specific token used for this request.

filterOps.context.bearerTokenContextIDstringOptional
User context embedded in the bearer token. Present when a bearer token encodes additional user context.
filterOps.parentAccountIDstringOptional
Resources with the specified parent account ID.
filterOps.accountIDstringRequired
filterOps.workspaceIDstringOptional
Resources with the specified workspace ID.
filterOps.vaultIDstringOptional
Resources with the specified vault ID.
filterOps.resourceIDsstringOptional

Resources with a specified ID. If a resource matches at least one ID, the associated event is returned. Format is a comma-separated list of “<resourceType>/<resourceID>”. For example, “VAULT/12345, USER/67890”.

Response

OK
eventlist of objects
Events matching the query.
nextOpsobject

Errors

400
Bad Request Error
401
Unauthorized Error
404
Not Found Error
500
Internal Server Error