> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/api/api-reference/audit-logs.md).

# Audit Logs

Audit logs are an append-only record of every configuration change and account event in Celigo. Each entry captures who performed an action, what resource was affected, when it happened, and what changed — down to field-level diffs for updates. Use them for compliance, change tracking, and troubleshooting.

Notes:

* History is retained for a minimum of one year.
* Sensitive values (tokens, passwords) appear masked as `******`.
* CSV downloads are capped at \~20,000 rows per file; use `hasMore` to paginate.
* `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.

### Audit entry schema

## The AuditEntry object

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"components":{"schemas":{"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to.","enum":["accesstoken","agent","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`)."},"oldValue":{"description":"Previous value (may be any JSON type)."},"newValue":{"description":"New value (may be any JSON type)."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}}}}}
```

## Query audit logs

> Search audit log entries across all resources in the current account.\
> Use this to answer "what changed?" across the account — filter by resource\
> type, user, source, action, or time range. Results are ordered newest-first.\
> \
> Filtering by \`resourceType\` + \`\_resourceId\` returns entries for that\
> exact resource only — to include descendants (e.g. an integration's\
> flows and exports), use \`GET /v1/{resourceType}/{\_id}/audit\` instead.\
> \`\_resourceId\` requires \`resourceType\` to also be set.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to.","enum":["accesstoken","agent","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`)."},"oldValue":{"description":"Previous value (may be any JSON type)."},"newValue":{"description":"New value (may be any JSON type)."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/audit":{"get":{"summary":"Query audit logs","operationId":"getAuditLogs","tags":["Audit Logs"],"description":"Search audit log entries across all resources in the current account.\nUse this to answer \"what changed?\" across the account — filter by resource\ntype, user, source, action, or time range. Results are ordered newest-first.\n\nFiltering by `resourceType` + `_resourceId` returns entries for that\nexact resource only — to include descendants (e.g. an integration's\nflows and exports), use `GET /v1/{resourceType}/{_id}/audit` instead.\n`_resourceId` requires `resourceType` to also be set.","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":1000,"default":1000},"description":"Maximum number of audit entries to return."},{"name":"after","in":"query","required":false,"description":"Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`\nresponse header's `rel=\"next\"` URL rather than constructing it.","schema":{"type":"string"}},{"name":"resourceType","in":"query","required":false,"schema":{"type":"string","enum":["accesstoken","agent","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","user"]},"description":"Filter by resource type (singular form). Unsupported values are\nrejected with 422 `audit_not_supported`."},{"name":"_resourceId","in":"query","required":false,"schema":{"type":"string","format":"objectId"},"description":"Filter by a specific resource id. Requires `resourceType` to also be set."},{"name":"_byUserId","in":"query","required":false,"description":"Filter by user id, or pass `support` to filter actions performed by Celigo support.","schema":{"type":"string"}},{"name":"source","in":"query","required":false,"schema":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"description":"Filter by source. Unsupported values are rejected with 422\n`invalid_audit_field`."},{"name":"fieldPath","in":"query","required":false,"schema":{"type":"string"},"description":"Restrict the `fieldChanges` of returned entries to changes on this\nfield path. The value is not validated against known paths — an\nunknown path simply matches nothing."},{"name":"action","in":"query","required":false,"schema":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"description":"Filter by action/event."},{"name":"from","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"Start timestamp (ISO-8601)."},{"name":"to","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"End timestamp (ISO-8601)."}],"responses":{"200":{"description":"Audit entries","headers":{"Link":{"description":"RFC 5988 pagination link. Includes `<...>; rel=\"next\"` with an\n`after` cursor when more entries exist; absent on the final page.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AuditEntry"}}}}},"204":{"description":"No audit entries found"},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```

## Query audit logs with multi-select filters

> The POST variant of the account-wide audit query, for filters the GET\
> query string cannot express: each body filter is an array that matches\
> entries with any of the listed values, and \`resourceName\` scopes results\
> to an explicit list of resources. Response shape and ordering are\
> identical to \`GET /v1/audit\`.\
> \
> Pagination, sorting, and time bounds stay in the query string — sending\
> them in the body fails with 400 \`invalid\_request\_body\`.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"AuditQueryFilters":{"type":"object","description":"Multi-select audit filters for the POST query endpoints. Every filter is\nan array — send multiple values to match any of them. Pagination\n(`after`, `before`, `limit`, `sort_order`, `sort_by`) and time bounds\n(`from`, `to`) belong in the query string, not this body — including\nthem here fails with 400 `invalid_request_body`.","properties":{"resourceType":{"type":"array","description":"Match entries for any of these resource types (singular form).","items":{"type":"string","enum":["accesstoken","agent","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","user"]}},"source":{"type":"array","description":"Match entries produced by any of these sources.","items":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]}},"action":{"type":"array","description":"Match entries recording any of these actions.","items":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]}},"resourceName":{"type":"array","description":"Restrict results to specific resources, each identified by its id and\ntype. Entries missing either key, or naming a type without audit\nsupport, fail with 422.","items":{"type":"object","required":["_resourceId","resourceType"],"properties":{"_resourceId":{"type":"string","format":"objectId","description":"Id of the resource to include."},"resourceType":{"type":"string","description":"Singular resource type of `_resourceId`."}}}}}},"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to.","enum":["accesstoken","agent","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`)."},"oldValue":{"description":"Previous value (may be any JSON type)."},"newValue":{"description":"New value (may be any JSON type)."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}}}},"paths":{"/v1/audit":{"post":{"summary":"Query audit logs with multi-select filters","operationId":"queryAuditLogs","tags":["Audit Logs"],"description":"The POST variant of the account-wide audit query, for filters the GET\nquery string cannot express: each body filter is an array that matches\nentries with any of the listed values, and `resourceName` scopes results\nto an explicit list of resources. Response shape and ordering are\nidentical to `GET /v1/audit`.\n\nPagination, sorting, and time bounds stay in the query string — sending\nthem in the body fails with 400 `invalid_request_body`.","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":1000,"default":1000},"description":"Maximum number of audit entries to return."},{"name":"after","in":"query","required":false,"description":"Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`\nresponse header's `rel=\"next\"` URL rather than constructing it. Mutually exclusive\nwith `before`.","schema":{"type":"string"}},{"name":"before","in":"query","required":false,"description":"Opaque pagination cursor for the previous page, from the `Link` response\nheader. Mutually exclusive with `after` — sending both returns 422.","schema":{"type":"string"}},{"name":"sort_by","in":"query","required":false,"description":"Field to sort by. Only `time` is accepted; other values return 422.","schema":{"type":"string","enum":["time"],"default":"time"}},{"name":"sort_order","in":"query","required":false,"description":"Sort direction for `time`.","schema":{"type":"string","enum":["asc","desc"],"default":"desc"}},{"name":"from","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"Start timestamp (ISO-8601)."},{"name":"to","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"End timestamp (ISO-8601)."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditQueryFilters"}}}},"responses":{"200":{"description":"Audit entries","headers":{"Link":{"description":"RFC 5988 pagination link. Includes `<...>; rel=\"next\"` with an\n`after` cursor when more entries exist; absent on the final page.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AuditEntry"}}}}},"204":{"description":"No audit entries match the filters."},"400":{"description":"Pagination parameters were sent in the request body.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"$ref":"#/components/responses/401-unauthorized"},"422":{"description":"A filter value is invalid, a filter that must be an array was sent as\nanother type, or the `after`/`before` cursor is malformed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## Get signed URL to download audit logs CSV (all documents)

> Generates a signed URL for downloading a CSV export of audit logs across all\
> documents. The CSV columns are: Time, Source, User, Resource, Name/ID, Action,\
> Field, Old value, New value, Support.\
> \
> The signed URL expires after 15 minutes. When \`hasMore\` is true, pass\
> the last CSV row's timestamp as \`to\` to fetch the next batch.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"SignedUrlResponse":{"type":"object","description":"Response containing a signed URL for downloading an audit CSV export.\n\nEach CSV is capped at roughly 20 000 rows. When `hasMore` is `true`,\npass the timestamp of the last row as the `to` query parameter on the\nnext request to fetch the next batch.","properties":{"signedURL":{"type":"string","description":"Signed URL to download the CSV. The link expires after 15 minutes."},"hasMore":{"type":"boolean","description":"`true` when the result set exceeded the per-file row limit (~20 000 rows)\nand additional batches remain. To paginate, take the timestamp of the\nlast CSV row and pass it as the `to` query parameter on your next request."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/audit/signedURL":{"get":{"summary":"Get signed URL to download audit logs CSV (all documents)","operationId":"getAuditSignedUrlAll","tags":["Audit Logs"],"description":"Generates a signed URL for downloading a CSV export of audit logs across all\ndocuments. The CSV columns are: Time, Source, User, Resource, Name/ID, Action,\nField, Old value, New value, Support.\n\nThe signed URL expires after 15 minutes. When `hasMore` is true, pass\nthe last CSV row's timestamp as `to` to fetch the next batch.","parameters":[{"name":"resourceType","in":"query","required":false,"schema":{"type":"string","enum":["accesstoken","agent","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","user"]},"description":"Optional filter by resource type (singular form)."},{"name":"_byUserId","in":"query","required":false,"schema":{"type":"string"},"description":"Optional filter by the user who performed the actions."},{"name":"_resourceId","in":"query","required":false,"schema":{"type":"string","format":"objectId"},"description":"Optional filter by resource id."},{"name":"from","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"Start timestamp (ISO-8601)."},{"name":"to","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"End timestamp (ISO-8601)."},{"name":"action","in":"query","required":false,"schema":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"description":"Action/event filter."},{"name":"source","in":"query","required":false,"schema":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"description":"Source filter."}],"responses":{"200":{"description":"Signed URL response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignedUrlResponse"}}}},"401":{"$ref":"#/components/responses/401-unauthorized"},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```

## Get signed URL for audit CSV with multi-select filters

> The POST variant of the CSV signed-URL download, accepting the same\
> multi-select filter body as \`POST /v1/audit\`. The response is identical\
> to the GET variant: a signed URL valid for \~15 minutes plus \`hasMore\`\
> for batching.\
> \
> Sorting and time bounds stay in the query string — sending \`from\`/\`to\`\
> or pagination keys in the body fails with 400.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"AuditQueryFilters":{"type":"object","description":"Multi-select audit filters for the POST query endpoints. Every filter is\nan array — send multiple values to match any of them. Pagination\n(`after`, `before`, `limit`, `sort_order`, `sort_by`) and time bounds\n(`from`, `to`) belong in the query string, not this body — including\nthem here fails with 400 `invalid_request_body`.","properties":{"resourceType":{"type":"array","description":"Match entries for any of these resource types (singular form).","items":{"type":"string","enum":["accesstoken","agent","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","user"]}},"source":{"type":"array","description":"Match entries produced by any of these sources.","items":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]}},"action":{"type":"array","description":"Match entries recording any of these actions.","items":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]}},"resourceName":{"type":"array","description":"Restrict results to specific resources, each identified by its id and\ntype. Entries missing either key, or naming a type without audit\nsupport, fail with 422.","items":{"type":"object","required":["_resourceId","resourceType"],"properties":{"_resourceId":{"type":"string","format":"objectId","description":"Id of the resource to include."},"resourceType":{"type":"string","description":"Singular resource type of `_resourceId`."}}}}}},"SignedUrlResponse":{"type":"object","description":"Response containing a signed URL for downloading an audit CSV export.\n\nEach CSV is capped at roughly 20 000 rows. When `hasMore` is `true`,\npass the timestamp of the last row as the `to` query parameter on the\nnext request to fetch the next batch.","properties":{"signedURL":{"type":"string","description":"Signed URL to download the CSV. The link expires after 15 minutes."},"hasMore":{"type":"boolean","description":"`true` when the result set exceeded the per-file row limit (~20 000 rows)\nand additional batches remain. To paginate, take the timestamp of the\nlast CSV row and pass it as the `to` query parameter on your next request."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/audit/signedURL":{"post":{"summary":"Get signed URL for audit CSV with multi-select filters","operationId":"queryAuditSignedUrlAll","tags":["Audit Logs"],"description":"The POST variant of the CSV signed-URL download, accepting the same\nmulti-select filter body as `POST /v1/audit`. The response is identical\nto the GET variant: a signed URL valid for ~15 minutes plus `hasMore`\nfor batching.\n\nSorting and time bounds stay in the query string — sending `from`/`to`\nor pagination keys in the body fails with 400.","parameters":[{"name":"sort_order","in":"query","required":false,"description":"Sort direction for the CSV rows by time.","schema":{"type":"string","enum":["asc","desc"],"default":"desc"}},{"name":"from","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"Start timestamp (ISO-8601)."},{"name":"to","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"End timestamp (ISO-8601)."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditQueryFilters"}}}},"responses":{"200":{"description":"Signed URL response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignedUrlResponse"}}}},"400":{"description":"Pagination or time-bound parameters were sent in the request body.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"$ref":"#/components/responses/401-unauthorized"},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```

## Get audit log for a resource (and descendants)

> Returns audit log entries for a specific resource and its descendants. For example,\
> querying an integration returns changes to the integration, its flows, exports,\
> imports, and connections.\
> \
> For account-wide searches, use \`GET /v1/audit\` instead.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to.","enum":["accesstoken","agent","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`)."},"oldValue":{"description":"Previous value (may be any JSON type)."},"newValue":{"description":"New value (may be any JSON type)."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/{resourceType}/{_id}/audit":{"get":{"summary":"Get audit log for a resource (and descendants)","operationId":"getAuditForResource","tags":["Audit Logs"],"description":"Returns audit log entries for a specific resource and its descendants. For example,\nquerying an integration returns changes to the integration, its flows, exports,\nimports, and connections.\n\nFor account-wide searches, use `GET /v1/audit` instead.","parameters":[{"name":"resourceType","in":"path","required":true,"schema":{"type":"string","enum":["accesstokens","agents","apis","asynchelpers","connections","ediprofiles","exports","filedefinitions","flows","groups","iclients","idpconfigs","imports","integrations","lookupcaches","mcpoauthproviders","mcpservers","revisions","roles","scripts","ssoclients","stacks","syncs","tools"]},"description":"Plural resource type."},{"name":"_id","in":"path","required":true,"description":"Resource id.","schema":{"type":"string","format":"objectId"}},{"name":"limit","in":"query","required":false,"description":"Maximum number of audit entries to return.","schema":{"type":"integer","minimum":1,"maximum":1000,"default":1000}},{"name":"after","in":"query","required":false,"description":"Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`\nresponse header's `rel=\"next\"` URL rather than constructing it.","schema":{"type":"string"}},{"name":"from","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"Start timestamp (ISO-8601)."},{"name":"to","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"End timestamp (ISO-8601)."},{"name":"action","in":"query","required":false,"schema":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"description":"Filter by action/event."},{"name":"source","in":"query","required":false,"schema":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"description":"Filter by source."},{"name":"_byUserId","in":"query","required":false,"schema":{"type":"string"},"description":"Filter by the user who performed the action."}],"responses":{"200":{"description":"Audit entries","headers":{"Link":{"description":"RFC 5988 pagination link. Includes `<...>; rel=\"next\"` with an\n`after` cursor when more entries exist; absent on the final page.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AuditEntry"}}}}},"204":{"description":"No audit entries found"},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"404":{"$ref":"#/components/responses/404-not-found"},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```

## Query a resource's audit log with multi-select filters

> The POST variant of the resource-and-descendants audit query, accepting\
> the same multi-select filter body as \`POST /v1/audit\`. Body filters apply\
> within the resource's descendant set — e.g. filter an integration's audit\
> trail to specific actions or sources. Response shape matches the GET\
> variant.\
> \
> Pagination, sorting, and time bounds stay in the query string — sending\
> them in the body fails with 400 \`invalid\_request\_body\`.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"AuditQueryFilters":{"type":"object","description":"Multi-select audit filters for the POST query endpoints. Every filter is\nan array — send multiple values to match any of them. Pagination\n(`after`, `before`, `limit`, `sort_order`, `sort_by`) and time bounds\n(`from`, `to`) belong in the query string, not this body — including\nthem here fails with 400 `invalid_request_body`.","properties":{"resourceType":{"type":"array","description":"Match entries for any of these resource types (singular form).","items":{"type":"string","enum":["accesstoken","agent","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","user"]}},"source":{"type":"array","description":"Match entries produced by any of these sources.","items":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]}},"action":{"type":"array","description":"Match entries recording any of these actions.","items":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]}},"resourceName":{"type":"array","description":"Restrict results to specific resources, each identified by its id and\ntype. Entries missing either key, or naming a type without audit\nsupport, fail with 422.","items":{"type":"object","required":["_resourceId","resourceType"],"properties":{"_resourceId":{"type":"string","format":"objectId","description":"Id of the resource to include."},"resourceType":{"type":"string","description":"Singular resource type of `_resourceId`."}}}}}},"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to.","enum":["accesstoken","agent","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`)."},"oldValue":{"description":"Previous value (may be any JSON type)."},"newValue":{"description":"New value (may be any JSON type)."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/{resourceType}/{_id}/audit":{"post":{"summary":"Query a resource's audit log with multi-select filters","operationId":"queryAuditForResource","tags":["Audit Logs"],"description":"The POST variant of the resource-and-descendants audit query, accepting\nthe same multi-select filter body as `POST /v1/audit`. Body filters apply\nwithin the resource's descendant set — e.g. filter an integration's audit\ntrail to specific actions or sources. Response shape matches the GET\nvariant.\n\nPagination, sorting, and time bounds stay in the query string — sending\nthem in the body fails with 400 `invalid_request_body`.","parameters":[{"name":"resourceType","in":"path","required":true,"schema":{"type":"string","enum":["accesstokens","agents","apis","asynchelpers","connections","ediprofiles","exports","filedefinitions","flows","groups","iclients","idpconfigs","imports","integrations","lookupcaches","mcpoauthproviders","mcpservers","revisions","roles","scripts","ssoclients","stacks","syncs","tools"]},"description":"Plural resource type."},{"name":"_id","in":"path","required":true,"description":"Resource id.","schema":{"type":"string","format":"objectId"}},{"name":"limit","in":"query","required":false,"description":"Maximum number of audit entries to return.","schema":{"type":"integer","minimum":1,"maximum":1000,"default":1000}},{"name":"after","in":"query","required":false,"description":"Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`\nresponse header's `rel=\"next\"` URL rather than constructing it. Mutually exclusive\nwith `before`.","schema":{"type":"string"}},{"name":"before","in":"query","required":false,"description":"Opaque pagination cursor for the previous page, from the `Link` response\nheader. Mutually exclusive with `after` — sending both returns 422.","schema":{"type":"string"}},{"name":"sort_by","in":"query","required":false,"description":"Field to sort by. Only `time` is accepted; other values return 422.","schema":{"type":"string","enum":["time"],"default":"time"}},{"name":"sort_order","in":"query","required":false,"description":"Sort direction for `time`.","schema":{"type":"string","enum":["asc","desc"],"default":"desc"}},{"name":"from","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"Start timestamp (ISO-8601)."},{"name":"to","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"End timestamp (ISO-8601)."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditQueryFilters"}}}},"responses":{"200":{"description":"Audit entries","headers":{"Link":{"description":"RFC 5988 pagination link. Includes `<...>; rel=\"next\"` with an\n`after` cursor when more entries exist; absent on the final page.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AuditEntry"}}}}},"204":{"description":"No audit entries match the filters."},"400":{"description":"Pagination parameters were sent in the request body, or the path is\ninvalid (`_id` malformed, or a resource type without audit support).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"$ref":"#/components/responses/401-unauthorized"},"404":{"$ref":"#/components/responses/404-not-found"},"422":{"description":"A filter value is invalid, a filter that must be an array was sent as\nanother type, or the `after`/`before` cursor is malformed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## Get signed URL to download audit logs CSV (for selected resources)

> Generates a signed URL for downloading a CSV export of audit logs for specific\
> resources and their descendants.\
> \
> The signed URL expires after 15 minutes. When \`hasMore\` is true, pass\
> the last CSV row's timestamp as \`to\` in the request body to fetch the\
> next batch.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"AuditDownloadRequest":{"type":"object","description":"Request body for `POST /v1/{resourceType}/audit/signedURL`.","properties":{"_resourceIds":{"type":"array","description":"List of resource ids to include in the audit export.","items":{"type":"string"}},"from":{"type":"string","format":"date-time","description":"Start timestamp (ISO-8601)."},"to":{"type":"string","format":"date-time","description":"End timestamp (ISO-8601)."},"action":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"],"description":"Event/action filter."},"resourceType":{"type":"string","description":"Resource type filter (singular form).","enum":["accesstoken","agent","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","user"]},"source":{"type":"string","enum":["ui","api","system","connector","script","sso","cli","mcp","ora"],"description":"Source filter."},"_byUserId":{"type":"string","description":"Filter by actor user id (or `support`)."}},"required":["_resourceIds"]},"SignedUrlResponse":{"type":"object","description":"Response containing a signed URL for downloading an audit CSV export.\n\nEach CSV is capped at roughly 20 000 rows. When `hasMore` is `true`,\npass the timestamp of the last row as the `to` query parameter on the\nnext request to fetch the next batch.","properties":{"signedURL":{"type":"string","description":"Signed URL to download the CSV. The link expires after 15 minutes."},"hasMore":{"type":"boolean","description":"`true` when the result set exceeded the per-file row limit (~20 000 rows)\nand additional batches remain. To paginate, take the timestamp of the\nlast CSV row and pass it as the `to` query parameter on your next request."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/{resourceType}/audit/signedURL":{"post":{"summary":"Get signed URL to download audit logs CSV (for selected resources)","operationId":"getAuditSignedUrlForResources","tags":["Audit Logs"],"description":"Generates a signed URL for downloading a CSV export of audit logs for specific\nresources and their descendants.\n\nThe signed URL expires after 15 minutes. When `hasMore` is true, pass\nthe last CSV row's timestamp as `to` in the request body to fetch the\nnext batch.","parameters":[{"name":"resourceType","in":"path","required":true,"schema":{"type":"string","enum":["accesstokens","agents","apis","asynchelpers","connections","ediprofiles","exports","filedefinitions","flows","groups","iclients","idpconfigs","imports","integrations","lookupcaches","mcpoauthproviders","mcpservers","revisions","roles","scripts","ssoclients","stacks","syncs","tools"]},"description":"Plural resource type."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditDownloadRequest"}}}},"responses":{"200":{"description":"Signed URL response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignedUrlResponse"}}}},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://developer.celigo.com/api/api-reference/audit-logs.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.