---
title: "Search Audit Trail Data"
method: POST
path: "/restapi/v1.0/account/{accountId}/audit-trail/search"
tags: ["Audit Trail"]
---

# Search Audit Trail Data

`POST /restapi/v1.0/account/{accountId}/audit-trail/search`

Returns the audit trail data with specific filters applied.
Audit trail searching is limited to the last 10,000 records or last 180 days, whichever comes first.

## Path parameters

- `accountId` string, required

## Request body

- AccountHistorySearchPublicRequest
  - `eventTimeFrom` string, date-time — The beginning of the time range to return records in ISO 8601 format in UTC timezone, default is "eventTimeFrom"-24 hours
  - `eventTimeTo` string, date-time — The end of the time range to return records in ISO 8601 format in UTC timezone, default is the current time
  - `initiatorIds` string[] — List of extension IDs of change initiators.
  - `page` integer — Page number in the result set
  - `perPage` integer — Number of records to be returned per page.
  - `targetIds` string[] — List of extension (user) IDs affected by this action.
  - `siteId` string — Site ID to apply as a filter
  - `actionIds` string[] — List of action IDs (exact keys) to search for (alternatively "excludeActionIds" option can be used).
  - `searchString` string — The (sub)string to search, applied to the following fields: - initiator.name - initiator.role - initiator.extensionNumber - target.name - target.extensionNumber - details.parameters.value
  - `excludeActionIds` string[] — List of action IDs (exact keys) to exclude from your search (alternatively "actionIds" option can be used).

## Response `200`

List of Account History Records

- AccountHistorySearchPublicResponse
  - `records` AccountHistoryPublicRecord[] — List of records
    - `id` string — Internal record identifier
    - `eventTime` string, date-time — Timestamp of an event (provided by a client), RFC3339 date-time format, UTC time zone.
    - `initiator` AccountHistoryRecordPublicInitiator — Event initiator info
      - `extensionId` string — Current user extension identifier
      - `extensionNumber` string — Current user extension (short) number
      - `name` string — Current user full name
      - `role` string — Current user role
    - `actionId` string — Action type
    - `eventType` string — Operation: "CREATE", "UPDATE", "DELETE" or custom
    - `accountId` string — Account identifier which is related with the particular record.
    - `accountName` string — Account (company) name
    - `target` AccountHistoryRecordTarget — Action target object (company/extension)
      - `objectId` string — Extension identifier of the affected entity or "0" for Company level
      - `objectType` 'Extension' | 'Account' | 'Company' | 'Template' — Type of the entity.
      - `name` string — Target extension name
      - `extensionNumber` string — Target extension (short) number of the affected entity (if the objectType is EXTENSION).
      - `siteId` string — Target extension site identifier (if any)
    - `clientIp` string — IP-address of a client.
    - `comment` string — Custom top-level comment
    - `details` AccountHistoryRecordPublicDetails
      - `parameters` AccountHistoryRecordDetailsParameters[] — Event details (additional parameters)
        - `key` string, required
        - `value` string, required
  - `paging` AccountHistoryPaging
    - `page` integer — The current page number. 1-indexed, so the first page is 1 by default. May be omitted if result is empty (because non-existent page was specified or perPage=0 was requested)
    - `perPage` integer — Current page size, describes how many items are in each page. Matches "perPage" parameter from the request
    - `total` integer — Total number of pages in a dataset. May be omitted for some resources due to performance reasons
    - `totalFound` integer — Total number of elements in a dataset. May be omitted for some resources due to performance reasons

## Other responses

- `400` — General response with **HTTP 400 "Bad request"** status.<br> Reasons: unparsable request, path, query or body parameters are invalid. The error description may contain reference to particular parameter(s) which haven't passed the validation.
- `403` — General response with **HTTP 403 "Forbidden"** status.<br> Reasons: the requested operation is forbidden because of certain resource state, lack of permissions, feature unavailability, etc.
- `404` — General response with **HTTP 404 "Not found"** status.<br> Reasons: the entity with given ID (typically specified in a path parameter), is not found or inaccessible
- `500` — General response with **HTTP 500 "Internal Server Error"** status.<br> Reasons: general server-side error.
- `503` — General response with **HTTP 503 "Service not available"** status.<br> Reasons: server cannot process the request because of being overloaded, misconfiguration or other issues.

---

[API](https://skmtc.net/ringcentral/apis/ringcentral-api.md) · [All operations](https://skmtc.net/ringcentral/apis/ringcentral-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ringcentral/ringcentral-api/revisions/8d602198ec97/schema)