Skip to main content

Uniphore Help Center Portal

Search Audit Log

Use the audit search request to get either a complete list of your system audit logs or filter that list for logs matching specific conditions

Endpoint

Method: POST

URL: /audit/V1/search

Query Parameters

Parameter Name

Data Type

Description

Required/Optional

size

Integer

The audit log can be split into pages to make it easier to use, the size parameter determines how many audit log entries will be displayed per page, and therefore how many audit log entries you will receive in the response.

For example a value of 30 would display 30 audit log entries per page, splitting your audit log into pages of 30.

Optional, defaults to 20.

sort

String

Sort your results by specifying what parameter in the response to sort by, and then what order to sort them in, this is in the form parameter,order.

See content Sub-parameters for a list of valid parameters to sort by.

Valid orders: descending (desc) or ascending (asc).

For example setting sort to createdDate,desc will sort the audit log using the createdDate description for each audit log entry, and order them in a descending order.

Optional

Request Parameter

Parameter Name

Data Type

Description

Required/Optional

startDate

Date-Time

As your full audit log can be substantial and cover a wide timeframe, use startDate to determine when (date and time) to show your audit log from in this request.

Format: YYYY-MM-DDT00:00:00.000

For example your full audit log could start on June 14th 2024 at 13:00, but you only want to display audit log entries from June 29th 2024 at 16:00. For this, you would enter a value of 2024-07-29T16:00:00.000.

Required

endDate

Date-Time

As your full audit log can be substantial and cover a wide timeframe, use endDate to determine when (date and time) to show your audit log up to in this request.

Format: YYYY-MM-DDT00:00:00.000

For example, your full audit log would end at the most recent audit log entry, but you only want to display audit log entries up to June 29th 2024 at 16:00. For this, you would enter a value of 2024-07-29T16:00:00.000.

Required

searchText

String

Enter text to filter the audit log by, and the audit log only displays entries that contain the specified text.

Optional

activityType

String

Filter your audit log by activityType. Enter one or more audit log activity type to only display audit log entries with a matching activityType. Activity types categorize audit log entries.

Use the get audit filters request to view audit log activity types in your system.

Optional

actionType

String

Filter your audit log by actionType. Enter a system action type to only display audit log entries with a matching actionType.

Use the get audit filters request to view audit log action types in your system.

Optional

success

Boolean

Filter your audit log by whether or not the action that resulted in the audit log entry was successful (SUCCESS) or unsuccessful (FAILURE).

Optional

nextPageToken

String

The audit log is split into pages, with page length determined by the size parameter in the request query. At the end of each response nextPageToken is populated with a value to be used in a subsequent request body to retrieve the next page of the audit log.

Optional

Response and Error Code

Response Code

Condition

200

OK

400

Bad Request (it's likely that one or more required parameters is missing)

Response Parameter

The response of a successful post audit search request will provide the parameters listed in the table below, the content, pageable, and sort array parameters have sub-parameters that are covered in more detail in their own table.

For an example response, see Sample Response.

Parameter Name

Data Type

Description

content

Array

The log entries in the current page, these are the details for each system action, see content Sub-parameters for information on each of the parameters for each log entry.

nextPageToken

String

The audit log is split into pages, with page length determined by the size parameter in the request query. nextPageToken is populated with a value to be used in a subsequent request body to retrieve the next page of the audit log.

total

Number

The total number of audit log records in your system.

totalRelation

String

A quick way to tell if your audit log has reached the maximum of 10,000 logs that can be fetched by this request. A value of eq means your audit log contains fewer than 10,000 logs, a value of gt means your audit log has surpassed 10,000 logs.

content sub-parameters

Parameter

Data Type

Description

Id

String

The ID of the specific audit log entry.

timestamp

Number

The epoch time (the number of seconds that have elapsed since January 1, 1970 (midnight UTC/GMT) not counting leap seconds) for the action that caused the audit log to be created.

activityType

String

The type of activity in the system that generated the log entry, for example, "SEARCH_AND_REPLAY".

To get a list of possible activity types, use the get audit filters request.

actionType

String

The type of action performed that led to the audit log entry being created.

actionDescription

String

A user-friendly description of the action that led to the audit log entry.

actionInput

String

The information that was entered into the system to complete the action that led to the audit log entry.

actionOutput

String

A description of the action taken by the system in response to the action input.

tenantId

String

The ID of your tenant, the tenant the audit log entry displayed belongs to.

emailId

String

The user's email address whose activity in the system generated the log entry, if applicable.

userId

Integer

The user ID of the user whose activity in the system generated the log entry, if applicable.

createdDate

Number

The epoch time for when the specific audit log entry was created.

success

Boolean

Whether or not the action that resulted in the audit log entry was successful (true) or unsuccessful (false).

createdBy

String

Who or what caused the audit log to be created, typically the user who performed the action, or SYSTEM for when the action is a result of an automated process, such as policies.

traceId

String

An internal reference field used to track specific logs during development. As a customer, your logs do not populate this field.

Sample Request
/audit/V1/search?size=30&sort=createDate,desc

{
    "startDate":"2026-01-26T00:00:00.000Z",
    "endDate":"2026-01-27T23:59:59.999Z",
    "searchText":"",
    "activityType":["USER_MANAGEMENT","POLICY_MANAGEMENT"],
    "actionType":[],
    "success":"",
    "nextPageToken":"WyIxNzY5NTE5MjY1MDAwIiwiMTc2OTUxOTI2NTg2NCJd"
}

Sample Response

Note

The below sample response has been shortened for document formatting purposes, where content only shows two audit log entries rather than the 30 specified in size.

 {
    "content": [
        {
            "id": "qSPX_psBSMhcaCypl9w1",
            "timestamp": 1769507100465,
            "activityType": "USER_MANAGEMENT",
            "actionType": "USER_PREFERENCE_LIST",
            "actionDescription": "List of private and public preferences viewable by the user.",
            "actionInput": "",
            "actionOutput": "{preferences=(Count: 5)}",
            "tenantId": "26837380-45f1-4f96-85ed-b8d1h656r66h",
            "emailId": "john.doe@uniphore.com",
            "userId": "auth0|683fdbd6hr5b2e04458f876c",
            "createdDate": 1769507100000,
            "success": true,
            "createdBy": "john.doe@uniphore.com",
            "traceId": ""
        },
        {
            "id": "yqDX_psBFm-PXj-dmRpZ",
            "timestamp": 1769507100981,
            "activityType": "POLICY_MANAGEMENT",
            "actionType": "POLICY_PURGE_ACTION",
            "actionDescription": "Purge",
            "actionInput": "{tenantId=26298780-45f1-4f96-85ed-b8d9e656f32d, policyId=101, policyName=Purge Capital 2}",
            "actionOutput": " | AuditLog status: LOCKED and count: 35",
            "tenantId": "26298780-45f1-4f96-85ed-b8d9e656f32d",
            "emailId": "SYSTEM",
            "userId": "SYSTEM",
            "createdDate": 1769507100000,
            "success": false,
            "createdBy": "SYSTEM",
            "traceId": ""
        }
    ],
    "nextPageToken": "WyIxNzY5NTE5MjY1MDAwIiwiMTc2OTUvULP5kGm4jCJd",
    "total": 450,
    "totalRelation": "eq"
}