Search audit events

By default, the most recent 100 results will be returned.

Adding filters to the request

For each filter to add, use the following format:

parameterName=value
        

Use & to separate multiple filter values:

parameter1Name=parameter1Value&parameter2Name=parameter2Value
        

Valid filter parameters

You can filter the included events based on the following parameters:

<i>event_category</i> - The general category of event. For example, to filter the results to only include events related to permission sets:

event_category=PermissionSet
        

You can provide multiple event category values. For example, to filter the results to include events related to both assigned permissions and permission sets:

event_category=PermissionSet&event_category=AssignedPermissions
        

<i>event_type</i> - The specific type of event. To get the available event types, refer to Solar.Core.Enums.AuditEvents.AuditEventType. For example, to filter the results to only include when a permission set was created:

event_type=PermissionSetCreated
        

You can provide multiple event type values. For example, to filter the results to include both when a permission set was created and when a permission set was updated:

event_type=PermissionSetCreated&event_type=PermissionSetUpdated
        

<i>outcome</i> - Whether the event was successful (<i>Success</i>) or failed (<i>Fail</i>). For example, to filter the results to only include successful events:

outcome=Success
        

<i>created_before</i> - Used to only include events that occurred before the specified timestamp.

The timestamp uses the ISO 8601 format (<i>yyyy-MM-dd'T'HH:mm:ssZ</i>). For example, to filter the results to only include events that occurred before 6:30 PM UTC on August 1, 2023:

created_before=2023-08-01T18:30:00Z
        

<i>created_after</i> - Used to only include events that occurred after the specified timestamp.

The timestamp uses the ISO 8601 format (<i>yyyy-MM-dd'T'HH:mm:ssZ</i>). For example, to filter the results to only include events that occurred after 10:00 AM UTC on July 27, 2023:

created_after=2023-07-27T10:00:00Z
        

<i>include_unidentified_events</i> - For self-hosted instances, whether to include events that do not have an identified user. By default, is false. These events might be server-generated or might be related to an unauthenticated action. To include events that do not have an identified user:

include_unidentified_events=true
        

Sample requests:

First 100 results by most recent:

GET /api/audit-events/search
        

Returns the first 20 results for permission set events that were successful:

GET /api/audit-events/search?limit=20&event_category=PermissionSet&outcome=Success

Required Permissions

• Global: Manage Users And Groups, View All Datasets