Audit Logs

Audit logs are an append-only record of every configuration change and account event in Celigo. Each entry captures who performed an action, what resource was affected, when it happened, and what changed — down to field-level diffs for updates. Use them for compliance, change tracking, and troubleshooting.

Notes:

• History is retained for a minimum of one year.
• Sensitive values (tokens, passwords) appear masked as ******.
• CSV downloads are capped at ~20,000 rows per file; use hasMore to paginate.
• byUser is populated at read time — it reflects the user's current name and email, not the values at the time of the action.

Audit entry schema

Query audit logs

get

/v1/audit

Search audit log entries across all resources in the current account. Use this to answer "what changed?" across the account — filter by resource type, user, source, action, or time range. Results are ordered newest-first.

Filtering by resourceType + _resourceId returns entries for that exact resource only — to include descendants (e.g. an integration's flows and exports), use GET /v1/{resourceType}/{_id}/audit instead. _resourceId requires resourceType to also be set.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Query parameters

limitinteger · min: 1 · max: 1000Optional

Maximum number of audit entries to return.

Default: 1000Example: 100

afterstringOptional

Opaque pagination cursor for the next page. Take it from the after value in the Link response header's rel="next" URL rather than constructing it.

Example: W3siJGRhdGUiOiIyMDI2LTA1LTAxVDAwOjAwOjAwLjAwMFoifSwiNjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIl0

resourceTypestring · enumOptional

Filter by resource type (singular form). Unsupported values are rejected with 422 audit_not_supported.

Example: connectionPossible values:

_resourceIdstring · objectIdOptional

Filter by a specific resource id. Requires resourceType to also be set.

Example: 60a2c4e6f321d800129a1a3c

_byUserIdstringOptional

Filter by user id, or pass support to filter actions performed by Celigo support.

Example: 624cb0346309dc3a543733a2

sourcestring · enumOptional

Filter by source. Unsupported values are rejected with 422 invalid_audit_field.

Example: uiPossible values:

fieldPathstringOptional

Restrict the fieldChanges of returned entries to changes on this field path. The value is not validated against known paths — an unknown path simply matches nothing.

Example: http.auth.token.token

actionstring · enumOptional

Filter by action/event.

Example: updatePossible values:

fromstring · date-timeOptional

Start timestamp (ISO-8601).

Example: 2025-01-01T00:00:00.000Z

tostring · date-timeOptional

End timestamp (ISO-8601).

Example: 2025-12-31T23:59:59.999Z

Responses

200

Audit entries

application/json

204

No audit entries found

400

Bad request. The server could not understand the request because of malformed syntax or invalid parameters.

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

422

Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.

application/json

get/v1/audit

GET /v1/audit HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

[
  {
    "_id": "69fe3b7833f18c171d7e91b9",
    "resourceType": "connection",
    "_resourceId": "69497ca1b40d3e24522a7f3c",
    "source": "system",
    "fieldChanges": [
      {
        "fieldPath": "http.auth.token.token",
        "oldValue": "******",
        "newValue": "******"
      }
    ],
    "event": "update",
    "time": "2026-05-08T19:37:27.436Z",
    "byUser": {
      "_id": "624cb0346309dc3a543733a2",
      "email": "[e-mail]",
      "name": "Jane Doe"
    }
  },
  {
    "_id": "69f6367c3469e3f559a8cac9",
    "resourceType": "connection",
    "_resourceId": "69f6367b3469e3f559a8cabf",
    "source": "api",
    "fieldChanges": [],
    "event": "create",
    "time": "2026-05-02T17:38:04.021Z",
    "deletedInfo": {
      "name": "My HTTP Connection"
    },
    "byUser": {
      "_id": "624cb0346309dc3a543733a2",
      "email": "[e-mail]",
      "name": "Jane Doe"
    }
  }
]

Query audit logs with multi-select filters

post

/v1/audit

The POST variant of the account-wide audit query, for filters the GET query string cannot express: each body filter is an array that matches entries with any of the listed values, and resourceName scopes results to an explicit list of resources. Response shape and ordering are identical to GET /v1/audit.

Pagination, sorting, and time bounds stay in the query string — sending them in the body fails with 400 invalid_request_body.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Query parameters

limitinteger · min: 1 · max: 1000Optional

Maximum number of audit entries to return.

Default: 1000Example: 100

afterstringOptional

Opaque pagination cursor for the next page. Take it from the after value in the Link response header's rel="next" URL rather than constructing it. Mutually exclusive with before.

Example: W3siJGRhdGUiOiIyMDI2LTA1LTAxVDAwOjAwOjAwLjAwMFoifSwiNjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIl0

beforestringOptional

Opaque pagination cursor for the previous page, from the Link response header. Mutually exclusive with after — sending both returns 422.

sort_bystring · enumOptional

Field to sort by. Only time is accepted; other values return 422.

Default: timePossible values:

sort_orderstring · enumOptional

Sort direction for time.

Default: descPossible values:

fromstring · date-timeOptional

Start timestamp (ISO-8601).

Example: 2025-01-01T00:00:00.000Z

tostring · date-timeOptional

End timestamp (ISO-8601).

Example: 2025-12-31T23:59:59.999Z

Body

Multi-select audit filters for the POST query endpoints. Every filter is an array — send multiple values to match any of them. Pagination (after, before, limit, sort_order, sort_by) and time bounds (from, to) belong in the query string, not this body — including them here fails with 400 invalid_request_body.

Responses

200

Audit entries

application/json

204

No audit entries match the filters.

400

Pagination parameters were sent in the request body.

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

422

A filter value is invalid, a filter that must be an array was sent as another type, or the after/before cursor is malformed.

application/json

post/v1/audit

POST /v1/audit HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 68

{
  "resourceType": [
    "connection",
    "agent"
  ],
  "action": [
    "create",
    "update"
  ]
}

[
  {
    "_id": "69fe3b7833f18c171d7e91b9",
    "resourceType": "connection",
    "_resourceId": "69497ca1b40d3e24522a7f3c",
    "source": "api",
    "fieldChanges": [
      {
        "fieldPath": "http.auth.token.token",
        "oldValue": "******",
        "newValue": "******"
      }
    ],
    "event": "update",
    "time": "2026-05-08T19:37:27.436Z",
    "byUser": {
      "_id": "624cb0346309dc3a543733a2",
      "email": "[e-mail]",
      "name": "Jane Doe"
    }
  }
]

Get signed URL to download audit logs CSV (all documents)

get

/v1/audit/signedURL

Generates a signed URL for downloading a CSV export of audit logs across all documents. The CSV columns are: Time, Source, User, Resource, Name/ID, Action, Field, Old value, New value, Support.

The signed URL expires after 15 minutes. When hasMore is true, pass the last CSV row's timestamp as to to fetch the next batch.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Query parameters

resourceTypestring · enumOptional

Optional filter by resource type (singular form).

Possible values:

_byUserIdstringOptional

Optional filter by the user who performed the actions.

Example: 624cb0346309dc3a543733a2

_resourceIdstring · objectIdOptional

Optional filter by resource id.

Example: 60a2c4e6f321d800129a1a3c

fromstring · date-timeOptional

Start timestamp (ISO-8601).

Example: 2025-01-01T00:00:00.000Z

tostring · date-timeOptional

End timestamp (ISO-8601).

Example: 2025-12-31T23:59:59.999Z

actionstring · enumOptional

Action/event filter.

Possible values:

sourcestring · enumOptional

Source filter.

Possible values:

Responses

200

Signed URL response

application/json

Response containing a signed URL for downloading an audit CSV export.

Each CSV is capped at roughly 20 000 rows. When hasMore is true, pass the timestamp of the last row as the to query parameter on the next request to fetch the next batch.

signedURLstringOptional

Signed URL to download the CSV. The link expires after 15 minutes.

Example: https://integrator-userdata-delete-30.s3.us-east-1.amazonaws.com/audit/624cb034630a1b2c3d4e5f60/audit-export.csv?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&X-Amz-Credential=AKIAEXAMPLE123%2F20260613%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260613T120000Z&X-Amz-SignedHeaders=host&X-Amz-Signature=4f9b2c1e8a3d7f0b5c6e9a2d4f8b1c3e7a0d5f2b9c4e6a8d1f3b7c0e5a9d2f4b

hasMorebooleanOptional

true when the result set exceeded the per-file row limit (~20 000 rows) and additional batches remain. To paginate, take the timestamp of the last CSV row and pass it as the to query parameter on your next request.

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

422

Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.

application/json

get/v1/audit/signedURL

GET /v1/audit/signedURL HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

{
  "signedURL": "https://integrator-userdata-delete-30.s3.us-east-1.amazonaws.com/audit/624cb034630.../audit-export.csv?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&...",
  "hasMore": false
}

Get signed URL for audit CSV with multi-select filters

post

/v1/audit/signedURL

The POST variant of the CSV signed-URL download, accepting the same multi-select filter body as POST /v1/audit. The response is identical to the GET variant: a signed URL valid for ~15 minutes plus hasMore for batching.

Sorting and time bounds stay in the query string — sending from/to or pagination keys in the body fails with 400.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Query parameters

sort_orderstring · enumOptional

Sort direction for the CSV rows by time.

Default: descPossible values:

fromstring · date-timeOptional

Start timestamp (ISO-8601).

Example: 2025-01-01T00:00:00.000Z

tostring · date-timeOptional

End timestamp (ISO-8601).

Example: 2025-12-31T23:59:59.999Z

Body

Multi-select audit filters for the POST query endpoints. Every filter is an array — send multiple values to match any of them. Pagination (after, before, limit, sort_order, sort_by) and time bounds (from, to) belong in the query string, not this body — including them here fails with 400 invalid_request_body.

Responses

200

Signed URL response

application/json

Response containing a signed URL for downloading an audit CSV export.

Each CSV is capped at roughly 20 000 rows. When hasMore is true, pass the timestamp of the last row as the to query parameter on the next request to fetch the next batch.

signedURLstringOptional

Signed URL to download the CSV. The link expires after 15 minutes.

Example: https://integrator-userdata-delete-30.s3.us-east-1.amazonaws.com/audit/624cb034630a1b2c3d4e5f60/audit-export.csv?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&X-Amz-Credential=AKIAEXAMPLE123%2F20260613%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260613T120000Z&X-Amz-SignedHeaders=host&X-Amz-Signature=4f9b2c1e8a3d7f0b5c6e9a2d4f8b1c3e7a0d5f2b9c4e6a8d1f3b7c0e5a9d2f4b

hasMorebooleanOptional

true when the result set exceeded the per-file row limit (~20 000 rows) and additional batches remain. To paginate, take the timestamp of the last CSV row and pass it as the to query parameter on your next request.

400

Pagination or time-bound parameters were sent in the request body.

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

422

Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.

application/json

post/v1/audit/signedURL

POST /v1/audit/signedURL HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 18

{
  "source": [
    "api"
  ]
}

{
  "signedURL": "https://integrator-userdata-delete-30.s3.us-east-1.amazonaws.com/audit/624cb034630.../audit-export.csv?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&...",
  "hasMore": false
}

Get audit log for a resource (and descendants)

get

/v1/{resourceType}/{_id}/audit

Returns audit log entries for a specific resource and its descendants. For example, querying an integration returns changes to the integration, its flows, exports, imports, and connections.

For account-wide searches, use GET /v1/audit instead.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

resourceTypestring · enumRequired

Plural resource type.

Example: integrationsPossible values:

_idstring · objectIdRequired

Resource id.

Example: 60a2c4e6f321d800129a1a3c

Query parameters

limitinteger · min: 1 · max: 1000Optional

Maximum number of audit entries to return.

Default: 1000Example: 100

afterstringOptional

Opaque pagination cursor for the next page. Take it from the after value in the Link response header's rel="next" URL rather than constructing it.

Example: W3siJGRhdGUiOiIyMDI2LTA1LTAxVDAwOjAwOjAwLjAwMFoifSwiNjAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwIl0

fromstring · date-timeOptional

Start timestamp (ISO-8601).

Example: 2025-01-01T00:00:00.000Z

tostring · date-timeOptional

End timestamp (ISO-8601).

Example: 2025-12-31T23:59:59.999Z

actionstring · enumOptional

Filter by action/event.

Example: updatePossible values:

sourcestring · enumOptional

Filter by source.

Example: uiPossible values:

_byUserIdstringOptional

Filter by the user who performed the action.

Example: 624cb0346309dc3a543733a2

Responses

200

Audit entries

application/json

204

No audit entries found

400

Bad request. The server could not understand the request because of malformed syntax or invalid parameters.

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

404

Not found. The requested resource does not exist or is not visible to the caller.

application/json

422

Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.

application/json

get/v1/{resourceType}/{_id}/audit

GET /v1/{resourceType}/{_id}/audit HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*

[
  {
    "_id": "69f63df97009ea11abf0cb97",
    "resourceType": "ediprofile",
    "_resourceId": "690146d901d66a7545038179",
    "source": "api",
    "fieldChanges": [
      {
        "fieldPath": "tpInterchangeId",
        "oldValue": "9253390501 test",
        "newValue": "9253390501"
      }
    ],
    "event": "update",
    "time": "2026-05-02T18:10:01.832Z",
    "byUser": {
      "_id": "624cb0346309dc3a543733a2",
      "email": "[e-mail]",
      "name": "Jane Doe"
    }
  }
]

Query a resource's audit log with multi-select filters

post

/v1/{resourceType}/{_id}/audit

The POST variant of the resource-and-descendants audit query, accepting the same multi-select filter body as POST /v1/audit. Body filters apply within the resource's descendant set — e.g. filter an integration's audit trail to specific actions or sources. Response shape matches the GET variant.

Pagination, sorting, and time bounds stay in the query string — sending them in the body fails with 400 invalid_request_body.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

resourceTypestring · enumRequired

Plural resource type.

Example: integrationsPossible values:

_idstring · objectIdRequired

Resource id.

Example: 60a2c4e6f321d800129a1a3c

Query parameters

limitinteger · min: 1 · max: 1000Optional

Maximum number of audit entries to return.

Default: 1000Example: 100

afterstringOptional

Opaque pagination cursor for the next page. Take it from the after value in the Link response header's rel="next" URL rather than constructing it. Mutually exclusive with before.

beforestringOptional

Opaque pagination cursor for the previous page, from the Link response header. Mutually exclusive with after — sending both returns 422.

sort_bystring · enumOptional

Field to sort by. Only time is accepted; other values return 422.

Default: timePossible values:

sort_orderstring · enumOptional

Sort direction for time.

Default: descPossible values:

fromstring · date-timeOptional

Start timestamp (ISO-8601).

Example: 2025-01-01T00:00:00.000Z

tostring · date-timeOptional

End timestamp (ISO-8601).

Example: 2025-12-31T23:59:59.999Z

Body

Multi-select audit filters for the POST query endpoints. Every filter is an array — send multiple values to match any of them. Pagination (after, before, limit, sort_order, sort_by) and time bounds (from, to) belong in the query string, not this body — including them here fails with 400 invalid_request_body.

Responses

200

Audit entries

application/json

204

No audit entries match the filters.

400

Pagination parameters were sent in the request body, or the path is invalid (_id malformed, or a resource type without audit support).

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

404

Not found. The requested resource does not exist or is not visible to the caller.

application/json

422

A filter value is invalid, a filter that must be an array was sent as another type, or the after/before cursor is malformed.

application/json

post/v1/{resourceType}/{_id}/audit

POST /v1/{resourceType}/{_id}/audit HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 30

{
  "action": [
    "create",
    "update"
  ]
}

[
  {
    "_id": "69f63df97009ea11abf0cb97",
    "resourceType": "ediprofile",
    "_resourceId": "690146d901d66a7545038179",
    "source": "api",
    "fieldChanges": [
      {
        "fieldPath": "tpInterchangeId",
        "oldValue": "9253390501 test",
        "newValue": "9253390501"
      }
    ],
    "event": "update",
    "time": "2026-05-02T18:10:01.832Z",
    "byUser": {
      "_id": "624cb0346309dc3a543733a2",
      "email": "[e-mail]",
      "name": "Jane Doe"
    }
  }
]

Get signed URL to download audit logs CSV (for selected resources)

post

/v1/{resourceType}/audit/signedURL

Generates a signed URL for downloading a CSV export of audit logs for specific resources and their descendants.

The signed URL expires after 15 minutes. When hasMore is true, pass the last CSV row's timestamp as to in the request body to fetch the next batch.

Authorizations

AuthorizationstringRequired

Bearer authentication header of the form Bearer <token>.

Path parameters

resourceTypestring · enumRequired

Plural resource type.

Possible values:

Body

Request body for POST /v1/{resourceType}/audit/signedURL.

_resourceIdsstring[]Required

List of resource ids to include in the audit export.

fromstring · date-timeOptional

Start timestamp (ISO-8601).

Example: 2025-01-01T00:00:00.000Z

tostring · date-timeOptional

End timestamp (ISO-8601).

Example: 2025-12-31T23:59:59.999Z

actionstring · enumOptional

Event/action filter.

Possible values:

resourceTypestring · enumOptional

Resource type filter (singular form).

Possible values:

sourcestring · enumOptional

Source filter.

Possible values:

_byUserIdstringOptional

Filter by actor user id (or support).

Example: 624cb0346309dc3a543733a2

Responses

200

Signed URL response

application/json

Response containing a signed URL for downloading an audit CSV export.

Each CSV is capped at roughly 20 000 rows. When hasMore is true, pass the timestamp of the last row as the to query parameter on the next request to fetch the next batch.

signedURLstringOptional

Signed URL to download the CSV. The link expires after 15 minutes.

Example: https://integrator-userdata-delete-30.s3.us-east-1.amazonaws.com/audit/624cb034630a1b2c3d4e5f60/audit-export.csv?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&X-Amz-Credential=AKIAEXAMPLE123%2F20260613%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260613T120000Z&X-Amz-SignedHeaders=host&X-Amz-Signature=4f9b2c1e8a3d7f0b5c6e9a2d4f8b1c3e7a0d5f2b9c4e6a8d1f3b7c0e5a9d2f4b

hasMorebooleanOptional

true when the result set exceeded the per-file row limit (~20 000 rows) and additional batches remain. To paginate, take the timestamp of the last CSV row and pass it as the to query parameter on your next request.

400

Bad request. The server could not understand the request because of malformed syntax or invalid parameters.

application/json

401

Unauthorized. The request lacks a valid bearer token, or the provided token failed to authenticate.

Note: the 401 response is produced by the auth middleware before the request reaches the endpoint handler, so it does not follow the standard {errors: [...]} envelope. Instead the body is a bare {message: string} object with no code, no errors array. Callers handling 401s should key off the HTTP status and the message string, not try to destructure an errors[].

application/json

422

Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.

application/json

post/v1/{resourceType}/audit/signedURL

POST /v1/{resourceType}/audit/signedURL HTTP/1.1
Host: api.integrator.io
Authorization: Bearer YOUR_SECRET_TOKEN
Content-Type: application/json
Accept: */*
Content-Length: 72

{
  "_resourceIds": [
    "60a2c4e6f321d800129a1a3c",
    "60a2c4e6f321d800129a1a4d"
  ]
}

{
  "signedURL": "https://integrator-userdata-delete-30.s3.us-east-1.amazonaws.com/audit/624cb034630.../audit-export.csv?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Expires=900&...",
  "hasMore": false
}