> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/api/api-reference/monitoring/audit-logs.md).

# Audit Logs

Audit logs are an append-only record of every configuration change and account event in Celigo. Each entry captures who performed an action, what resource was affected, when it happened, and what changed — down to field-level diffs for updates. Use them for compliance, change tracking, and troubleshooting.

Notes:

* On a `platform` license, queries reach back as many years as the license's `auditLogRetentionYears`, but a query without `from` or `to` returns only the last year.
* Sensitive values (tokens, passwords) appear masked as `******`.
* CSV downloads are capped at \~20,000 rows per file; use `hasMore` to paginate.
* `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.

### Audit entry schema

## The AuditEntry object

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"components":{"schemas":{"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to. `fileserver` and\n`mcpoauthprovider` appear only in returned entries and cannot be used as a\n`resourceType` filter. MCP OAuth providers have no per-resource audit route\neither, so their entries are read from `GET /v1/audit` without a\n`resourceType` filter.","enum":["accesstoken","agent","agentgroup","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","fileserver","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"resourceName":{"type":"string","readOnly":true,"description":"Display name of the alert, present on `alert` entries only: `<type label> - <flow name>`\nfor a flow-level alert, `<type label> - All flows (<integration name>)` for an\nintegration-level alert."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type. `signinDenied` appears only in returned entries — it is\nrecorded when a network policy blocks a sign-in and cannot be used as an\n`action` filter.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs","signinDenied"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry. A value of about 10 KB or more is left\nout, so `oldValue` or `newValue` can be absent even on an `update`; the entry still carries\nthe `fieldPath`.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`). On `alert` entries a recipient\nchange is reported as `recipients`, with `oldValue` and `newValue` listing the recipients'\nemail addresses instead of user ids."},"oldValue":{"description":"Previous value (may be any JSON type). Omitted when the value is about 10 KB or larger."},"newValue":{"description":"New value (may be any JSON type). Omitted when the value is about 10 KB or larger."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related and alert events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}}}}}
```

## Query audit logs

> Search audit log entries across all resources in the current account.\
> Use this to answer "what changed?" across the account — filter by resource\
> type, user, source, action, or time range. Results are ordered newest-first.\
> \
> Filtering by \`resourceType\` + \`\_resourceId\` returns entries for that\
> exact resource only — to include descendants (e.g. an integration's\
> flows and exports), use \`GET /v1/{resourceType}/{\_id}/audit\` instead.\
> \`\_resourceId\` requires \`resourceType\` to also be set.\
> \
> Only the account owner and administrators can query the account-wide\
> log: manage, monitor and integration-level users get 403, and an API\
> token with limited scope gets 401 \`token\_restricted\_access\`. Those\
> users can still read the history of a resource they can see, through\
> \`GET /v1/{resourceType}/{\_id}/audit\`.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- On a `platform` license, queries reach back as many years as the license's `auditLogRetentionYears`, but a query without `from` or `to` returns only the last year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"parameters":{"From":{"name":"from","in":"query","required":false,"description":"Only return entries at or after this timestamp. On a `platform` license, leaving it out limits\nthe range to the year before `to` (or the last year when `to` is omitted too), and a value older\nthan the audit window — the license's `auditLogRetentionYears` — starts the range at the\nwindow's edge instead of failing. A future value fails with 422 `invalid_time_period`.","schema":{"type":"string","format":"date-time"}},"To":{"name":"to","in":"query","required":false,"description":"Only return entries at or before this timestamp. A future value, or one older than the\naccount's audit window, fails with 422 `invalid_time_period`; the message names the window in\nyears (the license's `auditLogRetentionYears` on a `platform` license). A value earlier than\n`from` fails with 422 `invalid_time_range`.","schema":{"type":"string","format":"date-time"}}},"schemas":{"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to. `fileserver` and\n`mcpoauthprovider` appear only in returned entries and cannot be used as a\n`resourceType` filter. MCP OAuth providers have no per-resource audit route\neither, so their entries are read from `GET /v1/audit` without a\n`resourceType` filter.","enum":["accesstoken","agent","agentgroup","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","fileserver","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"resourceName":{"type":"string","readOnly":true,"description":"Display name of the alert, present on `alert` entries only: `<type label> - <flow name>`\nfor a flow-level alert, `<type label> - All flows (<integration name>)` for an\nintegration-level alert."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type. `signinDenied` appears only in returned entries — it is\nrecorded when a network policy blocks a sign-in and cannot be used as an\n`action` filter.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs","signinDenied"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry. A value of about 10 KB or more is left\nout, so `oldValue` or `newValue` can be absent even on an `update`; the entry still carries\nthe `fieldPath`.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`). On `alert` entries a recipient\nchange is reported as `recipients`, with `oldValue` and `newValue` listing the recipients'\nemail addresses instead of user ids."},"oldValue":{"description":"Previous value (may be any JSON type). Omitted when the value is about 10 KB or larger."},"newValue":{"description":"New value (may be any JSON type). Omitted when the value is about 10 KB or larger."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related and alert events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized-or-scoped-token":{"description":"Unauthorized: the request has no valid bearer token (a bare `{message}` body, as on every\nroute), or the token is an API token with limited scope. The account-wide audit query\ntakes only a full-access API token, a personal access token, or a signed-in session; a\nscoped token is refused with `token_restricted_access` in the standard `{errors: [...]}`\nenvelope.","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","description":"The auth middleware's bare body for a missing or invalid token.","properties":{"message":{"type":"string","description":"`Unauthorized` (no Authorization header) or `Bearer Authentication Failed`."}},"required":["message"]}]}}}},"403-administrator-only":{"description":"The caller is a manage, monitor or integration-level user. The account-wide audit log is\nfor the account owner and administrators; other users read one resource's history with\n`GET /v1/{resourceType}/{_id}/audit` instead.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422-invalid-audit-query":{"description":"A query value is invalid: a filter outside the audit vocabulary (`invalid_audit_field`), a\n`from` or `to` that is not ISO 8601 (`invalid_timestamp_format`), a bound in the future or a `to`\nolder than the account's audit window (`invalid_time_period`), or a `from` later than `to`\n(`invalid_time_range`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/audit":{"get":{"summary":"Query audit logs","operationId":"getAuditLogs","tags":["Audit Logs"],"description":"Search audit log entries across all resources in the current account.\nUse this to answer \"what changed?\" across the account — filter by resource\ntype, user, source, action, or time range. Results are ordered newest-first.\n\nFiltering by `resourceType` + `_resourceId` returns entries for that\nexact resource only — to include descendants (e.g. an integration's\nflows and exports), use `GET /v1/{resourceType}/{_id}/audit` instead.\n`_resourceId` requires `resourceType` to also be set.\n\nOnly the account owner and administrators can query the account-wide\nlog: manage, monitor and integration-level users get 403, and an API\ntoken with limited scope gets 401 `token_restricted_access`. Those\nusers can still read the history of a resource they can see, through\n`GET /v1/{resourceType}/{_id}/audit`.","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":1000,"default":1000},"description":"Maximum number of audit entries to return."},{"name":"after","in":"query","required":false,"description":"Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`\nresponse header's `rel=\"next\"` URL rather than constructing it.","schema":{"type":"string"}},{"name":"resourceType","in":"query","required":false,"schema":{"type":"string","enum":["accesstoken","agent","agentgroup","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"description":"Filter by resource type (singular form). Unsupported values are\nrejected with 422 `audit_not_supported`."},{"name":"_resourceId","in":"query","required":false,"schema":{"type":"string","format":"objectId"},"description":"Filter by a specific resource id. Requires `resourceType` to also be set."},{"name":"_byUserId","in":"query","required":false,"description":"Filter by user id, or pass `support` to filter actions performed by Celigo support.","schema":{"type":"string"}},{"name":"source","in":"query","required":false,"schema":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"description":"Filter by source. Unsupported values are rejected with 422\n`invalid_audit_field`."},{"name":"fieldPath","in":"query","required":false,"schema":{"type":"string"},"description":"Restrict the `fieldChanges` of returned entries to changes on this\nfield path. The match is exact on the stored dot-path — `authTypeMFA`\ndoes not match `authTypeMFA.trustDeviceForPeriod` — with no prefix or\nwildcard form, and the filter stands alone or combines with\n`resourceType`. The value is not validated against known paths — an\nunknown path simply matches nothing. Account-setting changes are\n`user` entries reached this way, one stored path each: company MFA\n`authTypeMFA.dontAllowTrustedDevices` and\n`authTypeMFA.trustDeviceForPeriod`; end-user MFA `endUserMfa.required`,\n`endUserMfa.disallowTrustedDevices` and `endUserMfa.trustedDeviceDays`;\na user's own MFA\n`authTypeMFA.enabled`, `authTypeMFA.trustedDevices`,\n`authTypeMFA.secret` and `authTypeMFA._allowResetByUserId`; API\nManagement setup `apim.subdomain` and `apim.serviceAccountEmail`;\nexecution logging `logging.retentionPeriod` and\n`logging.storePayload`; AI settings\n`aiSettings.intelligentDocumentProcessing`; the account alias\n`accountAlias`; the API Builder timeout `timeoutPeriod`; a member's\naccess `accessLevel`, `disabled` and `accountMFARequired`."},{"name":"action","in":"query","required":false,"schema":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"description":"Filter by action/event."},{"$ref":"#/components/parameters/From"},{"$ref":"#/components/parameters/To"}],"responses":{"200":{"description":"Audit entries","headers":{"Link":{"description":"RFC 5988 pagination link. Includes `<...>; rel=\"next\"` with an\n`after` cursor when more entries exist; absent on the final page.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AuditEntry"}}}}},"204":{"description":"No audit entries found"},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized-or-scoped-token"},"403":{"$ref":"#/components/responses/403-administrator-only"},"422":{"$ref":"#/components/responses/422-invalid-audit-query"}}}}}}
```

## Query audit logs with multi-select filters

> The POST variant of the account-wide audit query, for filters the GET\
> query string cannot express: each body filter is an array that matches\
> entries with any of the listed values, and \`resourceName\` scopes results\
> to an explicit list of resources. Response shape and ordering are\
> identical to \`GET /v1/audit\`.\
> \
> Pagination, sorting, and time bounds stay in the query string — sending\
> them in the body fails with 400 \`invalid\_request\_body\`. The same callers\
> are refused as on \`GET /v1/audit\`.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- On a `platform` license, queries reach back as many years as the license's `auditLogRetentionYears`, but a query without `from` or `to` returns only the last year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"parameters":{"From":{"name":"from","in":"query","required":false,"description":"Only return entries at or after this timestamp. On a `platform` license, leaving it out limits\nthe range to the year before `to` (or the last year when `to` is omitted too), and a value older\nthan the audit window — the license's `auditLogRetentionYears` — starts the range at the\nwindow's edge instead of failing. A future value fails with 422 `invalid_time_period`.","schema":{"type":"string","format":"date-time"}},"To":{"name":"to","in":"query","required":false,"description":"Only return entries at or before this timestamp. A future value, or one older than the\naccount's audit window, fails with 422 `invalid_time_period`; the message names the window in\nyears (the license's `auditLogRetentionYears` on a `platform` license). A value earlier than\n`from` fails with 422 `invalid_time_range`.","schema":{"type":"string","format":"date-time"}}},"schemas":{"AuditQueryFilters":{"type":"object","description":"Multi-select audit filters for the POST query endpoints. Every filter is\nan array — send multiple values to match any of them. Pagination\n(`after`, `before`, `limit`, `sort_order`, `sort_by`) and time bounds\n(`from`, `to`) belong in the query string, not this body — including\nthem here fails with 400 `invalid_request_body`.","properties":{"resourceType":{"type":"array","description":"Match entries for any of these resource types (singular form).","items":{"type":"string","enum":["accesstoken","agent","agentgroup","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]}},"source":{"type":"array","description":"Match entries produced by any of these sources.","items":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]}},"action":{"type":"array","description":"Match entries recording any of these actions.","items":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]}},"resourceName":{"type":"array","description":"Restrict results to specific resources, each identified by its id and\ntype. Entries missing either key, or naming a type without audit\nsupport, fail with 422.","items":{"type":"object","required":["_resourceId","resourceType"],"properties":{"_resourceId":{"type":"string","format":"objectId","description":"Id of the resource to include."},"resourceType":{"type":"string","description":"Singular resource type of `_resourceId`."}}}}}},"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to. `fileserver` and\n`mcpoauthprovider` appear only in returned entries and cannot be used as a\n`resourceType` filter. MCP OAuth providers have no per-resource audit route\neither, so their entries are read from `GET /v1/audit` without a\n`resourceType` filter.","enum":["accesstoken","agent","agentgroup","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","fileserver","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"resourceName":{"type":"string","readOnly":true,"description":"Display name of the alert, present on `alert` entries only: `<type label> - <flow name>`\nfor a flow-level alert, `<type label> - All flows (<integration name>)` for an\nintegration-level alert."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type. `signinDenied` appears only in returned entries — it is\nrecorded when a network policy blocks a sign-in and cannot be used as an\n`action` filter.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs","signinDenied"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry. A value of about 10 KB or more is left\nout, so `oldValue` or `newValue` can be absent even on an `update`; the entry still carries\nthe `fieldPath`.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`). On `alert` entries a recipient\nchange is reported as `recipients`, with `oldValue` and `newValue` listing the recipients'\nemail addresses instead of user ids."},"oldValue":{"description":"Previous value (may be any JSON type). Omitted when the value is about 10 KB or larger."},"newValue":{"description":"New value (may be any JSON type). Omitted when the value is about 10 KB or larger."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related and alert events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"401-unauthorized-or-scoped-token":{"description":"Unauthorized: the request has no valid bearer token (a bare `{message}` body, as on every\nroute), or the token is an API token with limited scope. The account-wide audit query\ntakes only a full-access API token, a personal access token, or a signed-in session; a\nscoped token is refused with `token_restricted_access` in the standard `{errors: [...]}`\nenvelope.","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","description":"The auth middleware's bare body for a missing or invalid token.","properties":{"message":{"type":"string","description":"`Unauthorized` (no Authorization header) or `Bearer Authentication Failed`."}},"required":["message"]}]}}}},"403-administrator-only":{"description":"The caller is a manage, monitor or integration-level user. The account-wide audit log is\nfor the account owner and administrators; other users read one resource's history with\n`GET /v1/{resourceType}/{_id}/audit` instead.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/audit":{"post":{"summary":"Query audit logs with multi-select filters","operationId":"queryAuditLogs","tags":["Audit Logs"],"description":"The POST variant of the account-wide audit query, for filters the GET\nquery string cannot express: each body filter is an array that matches\nentries with any of the listed values, and `resourceName` scopes results\nto an explicit list of resources. Response shape and ordering are\nidentical to `GET /v1/audit`.\n\nPagination, sorting, and time bounds stay in the query string — sending\nthem in the body fails with 400 `invalid_request_body`. The same callers\nare refused as on `GET /v1/audit`.","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":1000,"default":1000},"description":"Maximum number of audit entries to return."},{"name":"after","in":"query","required":false,"description":"Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`\nresponse header's `rel=\"next\"` URL rather than constructing it. Mutually exclusive\nwith `before`.","schema":{"type":"string"}},{"name":"before","in":"query","required":false,"description":"Opaque pagination cursor for the previous page, from the `Link` response\nheader. Mutually exclusive with `after` — sending both returns 422.","schema":{"type":"string"}},{"name":"sort_by","in":"query","required":false,"description":"Field to sort by. Only `time` is accepted; other values return 422.","schema":{"type":"string","enum":["time"],"default":"time"}},{"name":"sort_order","in":"query","required":false,"description":"Sort direction for `time`.","schema":{"type":"string","enum":["asc","desc"],"default":"desc"}},{"$ref":"#/components/parameters/From"},{"$ref":"#/components/parameters/To"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditQueryFilters"}}}},"responses":{"200":{"description":"Audit entries","headers":{"Link":{"description":"RFC 5988 pagination link. Includes `<...>; rel=\"next\"` with an\n`after` cursor when more entries exist; absent on the final page.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AuditEntry"}}}}},"204":{"description":"No audit entries match the filters."},"400":{"description":"Pagination parameters were sent in the request body.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"$ref":"#/components/responses/401-unauthorized-or-scoped-token"},"403":{"$ref":"#/components/responses/403-administrator-only"},"422":{"description":"A filter value is invalid, a filter that must be an array was sent as\nanother type, the `after`/`before` cursor is malformed, or a time bound is\noutside the account's audit window (`invalid_time_period`) or reversed\n(`invalid_time_range`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## Get signed URL to download audit logs CSV (all documents)

> Generates a signed URL for downloading a CSV export of audit logs across all\
> documents. The CSV columns are: Time, Source, User, Resource, Name/ID, Action,\
> Field, Old value, New value, Support. The same callers are refused as on\
> \`GET /v1/audit\`: only the account owner and administrators can export the\
> account-wide log.\
> \
> The signed URL expires after 15 minutes. When \`hasMore\` is true, pass\
> the last CSV row's timestamp as \`to\` to fetch the next batch, keeping the\
> same \`from\`: without one, the batch covers only the year before \`to\`.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- On a `platform` license, queries reach back as many years as the license's `auditLogRetentionYears`, but a query without `from` or `to` returns only the last year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"parameters":{"From":{"name":"from","in":"query","required":false,"description":"Only return entries at or after this timestamp. On a `platform` license, leaving it out limits\nthe range to the year before `to` (or the last year when `to` is omitted too), and a value older\nthan the audit window — the license's `auditLogRetentionYears` — starts the range at the\nwindow's edge instead of failing. A future value fails with 422 `invalid_time_period`.","schema":{"type":"string","format":"date-time"}},"To":{"name":"to","in":"query","required":false,"description":"Only return entries at or before this timestamp. A future value, or one older than the\naccount's audit window, fails with 422 `invalid_time_period`; the message names the window in\nyears (the license's `auditLogRetentionYears` on a `platform` license). A value earlier than\n`from` fails with 422 `invalid_time_range`.","schema":{"type":"string","format":"date-time"}}},"schemas":{"SignedUrlResponse":{"type":"object","description":"Response containing a signed URL for downloading an audit CSV export.\n\nEach CSV is capped at roughly 20 000 rows. When `hasMore` is `true`,\npass the timestamp of the last row as the `to` query parameter on the\nnext request to fetch the next batch.","properties":{"signedURL":{"type":"string","description":"Signed URL to download the CSV. The link expires after 15 minutes."},"hasMore":{"type":"boolean","description":"`true` when the result set exceeded the per-file row limit (~20 000 rows)\nand additional batches remain. To paginate, take the timestamp of the\nlast CSV row and pass it as the `to` query parameter on your next request."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"401-unauthorized-or-scoped-token":{"description":"Unauthorized: the request has no valid bearer token (a bare `{message}` body, as on every\nroute), or the token is an API token with limited scope. The account-wide audit query\ntakes only a full-access API token, a personal access token, or a signed-in session; a\nscoped token is refused with `token_restricted_access` in the standard `{errors: [...]}`\nenvelope.","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","description":"The auth middleware's bare body for a missing or invalid token.","properties":{"message":{"type":"string","description":"`Unauthorized` (no Authorization header) or `Bearer Authentication Failed`."}},"required":["message"]}]}}}},"403-administrator-only":{"description":"The caller is a manage, monitor or integration-level user. The account-wide audit log is\nfor the account owner and administrators; other users read one resource's history with\n`GET /v1/{resourceType}/{_id}/audit` instead.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422-invalid-audit-query":{"description":"A query value is invalid: a filter outside the audit vocabulary (`invalid_audit_field`), a\n`from` or `to` that is not ISO 8601 (`invalid_timestamp_format`), a bound in the future or a `to`\nolder than the account's audit window (`invalid_time_period`), or a `from` later than `to`\n(`invalid_time_range`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/audit/signedURL":{"get":{"summary":"Get signed URL to download audit logs CSV (all documents)","operationId":"getAuditSignedUrlAll","tags":["Audit Logs"],"description":"Generates a signed URL for downloading a CSV export of audit logs across all\ndocuments. The CSV columns are: Time, Source, User, Resource, Name/ID, Action,\nField, Old value, New value, Support. The same callers are refused as on\n`GET /v1/audit`: only the account owner and administrators can export the\naccount-wide log.\n\nThe signed URL expires after 15 minutes. When `hasMore` is true, pass\nthe last CSV row's timestamp as `to` to fetch the next batch, keeping the\nsame `from`: without one, the batch covers only the year before `to`.","parameters":[{"name":"resourceType","in":"query","required":false,"schema":{"type":"string","enum":["accesstoken","agent","agentgroup","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpserver","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"description":"Optional filter by resource type (singular form)."},{"name":"_byUserId","in":"query","required":false,"schema":{"type":"string"},"description":"Optional filter by the user who performed the actions."},{"name":"_resourceId","in":"query","required":false,"schema":{"type":"string","format":"objectId"},"description":"Optional filter by resource id."},{"$ref":"#/components/parameters/From"},{"$ref":"#/components/parameters/To"},{"name":"action","in":"query","required":false,"schema":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"description":"Action/event filter."},{"name":"source","in":"query","required":false,"schema":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"description":"Source filter."}],"responses":{"200":{"description":"Signed URL response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignedUrlResponse"}}}},"401":{"$ref":"#/components/responses/401-unauthorized-or-scoped-token"},"403":{"$ref":"#/components/responses/403-administrator-only"},"422":{"$ref":"#/components/responses/422-invalid-audit-query"}}}}}}
```

## Get signed URL for audit CSV with multi-select filters

> The POST variant of the CSV signed-URL download, accepting the same\
> multi-select filter body as \`POST /v1/audit\`. The response is identical\
> to the GET variant: a signed URL valid for \~15 minutes plus \`hasMore\`\
> for batching.\
> \
> Sorting and time bounds stay in the query string — sending \`from\`/\`to\`\
> or pagination keys in the body fails with 400.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- On a `platform` license, queries reach back as many years as the license's `auditLogRetentionYears`, but a query without `from` or `to` returns only the last year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"parameters":{"From":{"name":"from","in":"query","required":false,"description":"Only return entries at or after this timestamp. On a `platform` license, leaving it out limits\nthe range to the year before `to` (or the last year when `to` is omitted too), and a value older\nthan the audit window — the license's `auditLogRetentionYears` — starts the range at the\nwindow's edge instead of failing. A future value fails with 422 `invalid_time_period`.","schema":{"type":"string","format":"date-time"}},"To":{"name":"to","in":"query","required":false,"description":"Only return entries at or before this timestamp. A future value, or one older than the\naccount's audit window, fails with 422 `invalid_time_period`; the message names the window in\nyears (the license's `auditLogRetentionYears` on a `platform` license). A value earlier than\n`from` fails with 422 `invalid_time_range`.","schema":{"type":"string","format":"date-time"}}},"schemas":{"AuditQueryFilters":{"type":"object","description":"Multi-select audit filters for the POST query endpoints. Every filter is\nan array — send multiple values to match any of them. Pagination\n(`after`, `before`, `limit`, `sort_order`, `sort_by`) and time bounds\n(`from`, `to`) belong in the query string, not this body — including\nthem here fails with 400 `invalid_request_body`.","properties":{"resourceType":{"type":"array","description":"Match entries for any of these resource types (singular form).","items":{"type":"string","enum":["accesstoken","agent","agentgroup","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]}},"source":{"type":"array","description":"Match entries produced by any of these sources.","items":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]}},"action":{"type":"array","description":"Match entries recording any of these actions.","items":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]}},"resourceName":{"type":"array","description":"Restrict results to specific resources, each identified by its id and\ntype. Entries missing either key, or naming a type without audit\nsupport, fail with 422.","items":{"type":"object","required":["_resourceId","resourceType"],"properties":{"_resourceId":{"type":"string","format":"objectId","description":"Id of the resource to include."},"resourceType":{"type":"string","description":"Singular resource type of `_resourceId`."}}}}}},"SignedUrlResponse":{"type":"object","description":"Response containing a signed URL for downloading an audit CSV export.\n\nEach CSV is capped at roughly 20 000 rows. When `hasMore` is `true`,\npass the timestamp of the last row as the `to` query parameter on the\nnext request to fetch the next batch.","properties":{"signedURL":{"type":"string","description":"Signed URL to download the CSV. The link expires after 15 minutes."},"hasMore":{"type":"boolean","description":"`true` when the result set exceeded the per-file row limit (~20 000 rows)\nand additional batches remain. To paginate, take the timestamp of the\nlast CSV row and pass it as the `to` query parameter on your next request."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"401-unauthorized-or-scoped-token":{"description":"Unauthorized: the request has no valid bearer token (a bare `{message}` body, as on every\nroute), or the token is an API token with limited scope. The account-wide audit query\ntakes only a full-access API token, a personal access token, or a signed-in session; a\nscoped token is refused with `token_restricted_access` in the standard `{errors: [...]}`\nenvelope.","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","description":"The auth middleware's bare body for a missing or invalid token.","properties":{"message":{"type":"string","description":"`Unauthorized` (no Authorization header) or `Bearer Authentication Failed`."}},"required":["message"]}]}}}},"403-administrator-only":{"description":"The caller is a manage, monitor or integration-level user. The account-wide audit log is\nfor the account owner and administrators; other users read one resource's history with\n`GET /v1/{resourceType}/{_id}/audit` instead.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422-invalid-audit-query":{"description":"A query value is invalid: a filter outside the audit vocabulary (`invalid_audit_field`), a\n`from` or `to` that is not ISO 8601 (`invalid_timestamp_format`), a bound in the future or a `to`\nolder than the account's audit window (`invalid_time_period`), or a `from` later than `to`\n(`invalid_time_range`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/audit/signedURL":{"post":{"summary":"Get signed URL for audit CSV with multi-select filters","operationId":"queryAuditSignedUrlAll","tags":["Audit Logs"],"description":"The POST variant of the CSV signed-URL download, accepting the same\nmulti-select filter body as `POST /v1/audit`. The response is identical\nto the GET variant: a signed URL valid for ~15 minutes plus `hasMore`\nfor batching.\n\nSorting and time bounds stay in the query string — sending `from`/`to`\nor pagination keys in the body fails with 400.","parameters":[{"name":"sort_order","in":"query","required":false,"description":"Sort direction for the CSV rows by time.","schema":{"type":"string","enum":["asc","desc"],"default":"desc"}},{"$ref":"#/components/parameters/From"},{"$ref":"#/components/parameters/To"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditQueryFilters"}}}},"responses":{"200":{"description":"Signed URL response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignedUrlResponse"}}}},"400":{"description":"Pagination or time-bound parameters were sent in the request body.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"$ref":"#/components/responses/401-unauthorized-or-scoped-token"},"403":{"$ref":"#/components/responses/403-administrator-only"},"422":{"$ref":"#/components/responses/422-invalid-audit-query"}}}}}}
```

## Get audit log for a resource (and descendants)

> Returns audit log entries for a specific resource and its descendants. For example,\
> querying an integration returns changes to the integration, its flows, exports,\
> imports, and connections, and querying a flow returns changes to the flow, its exports\
> and imports, their connections, and the scripts those steps reference.\
> \
> Users, environments, and notifications have no descendants, so their history is\
> the record's own entries. A user's history covers changes to that user, such as\
> the invite, access-level and MFA changes, and the removal; sign-ins and sign-outs\
> carry no \`\_resourceId\`, so only the account-wide log (\`GET /v1/audit\`) returns\
> them.\
> \
> For account-wide searches, use \`GET /v1/audit\` instead.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- On a `platform` license, queries reach back as many years as the license's `auditLogRetentionYears`, but a query without `from` or `to` returns only the last year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"parameters":{"From":{"name":"from","in":"query","required":false,"description":"Only return entries at or after this timestamp. On a `platform` license, leaving it out limits\nthe range to the year before `to` (or the last year when `to` is omitted too), and a value older\nthan the audit window — the license's `auditLogRetentionYears` — starts the range at the\nwindow's edge instead of failing. A future value fails with 422 `invalid_time_period`.","schema":{"type":"string","format":"date-time"}},"To":{"name":"to","in":"query","required":false,"description":"Only return entries at or before this timestamp. A future value, or one older than the\naccount's audit window, fails with 422 `invalid_time_period`; the message names the window in\nyears (the license's `auditLogRetentionYears` on a `platform` license). A value earlier than\n`from` fails with 422 `invalid_time_range`.","schema":{"type":"string","format":"date-time"}}},"schemas":{"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to. `fileserver` and\n`mcpoauthprovider` appear only in returned entries and cannot be used as a\n`resourceType` filter. MCP OAuth providers have no per-resource audit route\neither, so their entries are read from `GET /v1/audit` without a\n`resourceType` filter.","enum":["accesstoken","agent","agentgroup","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","fileserver","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"resourceName":{"type":"string","readOnly":true,"description":"Display name of the alert, present on `alert` entries only: `<type label> - <flow name>`\nfor a flow-level alert, `<type label> - All flows (<integration name>)` for an\nintegration-level alert."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type. `signinDenied` appears only in returned entries — it is\nrecorded when a network policy blocks a sign-in and cannot be used as an\n`action` filter.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs","signinDenied"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry. A value of about 10 KB or more is left\nout, so `oldValue` or `newValue` can be absent even on an `update`; the entry still carries\nthe `fieldPath`.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`). On `alert` entries a recipient\nchange is reported as `recipients`, with `oldValue` and `newValue` listing the recipients'\nemail addresses instead of user ids."},"oldValue":{"description":"Previous value (may be any JSON type). Omitted when the value is about 10 KB or larger."},"newValue":{"description":"New value (may be any JSON type). Omitted when the value is about 10 KB or larger."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related and alert events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422-invalid-audit-query":{"description":"A query value is invalid: a filter outside the audit vocabulary (`invalid_audit_field`), a\n`from` or `to` that is not ISO 8601 (`invalid_timestamp_format`), a bound in the future or a `to`\nolder than the account's audit window (`invalid_time_period`), or a `from` later than `to`\n(`invalid_time_range`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/{resourceType}/{_id}/audit":{"get":{"summary":"Get audit log for a resource (and descendants)","operationId":"getAuditForResource","tags":["Audit Logs"],"description":"Returns audit log entries for a specific resource and its descendants. For example,\nquerying an integration returns changes to the integration, its flows, exports,\nimports, and connections, and querying a flow returns changes to the flow, its exports\nand imports, their connections, and the scripts those steps reference.\n\nUsers, environments, and notifications have no descendants, so their history is\nthe record's own entries. A user's history covers changes to that user, such as\nthe invite, access-level and MFA changes, and the removal; sign-ins and sign-outs\ncarry no `_resourceId`, so only the account-wide log (`GET /v1/audit`) returns\nthem.\n\nFor account-wide searches, use `GET /v1/audit` instead.","parameters":[{"name":"resourceType","in":"path","required":true,"schema":{"type":"string","enum":["accesstokens","agents","agentgroups","alerts","apis","asynchelpers","connections","ediprofiles","environments","exports","filedefinitions","flows","groups","iclients","idpconfigs","imports","integrations","lookupcaches","mcpservers","networkpolicies","notifications","revisions","roles","scripts","ssoclients","stacks","syncs","tools","topics","users"]},"description":"Plural resource type."},{"name":"_id","in":"path","required":true,"description":"Resource id.","schema":{"type":"string","format":"objectId"}},{"name":"limit","in":"query","required":false,"description":"Maximum number of audit entries to return.","schema":{"type":"integer","minimum":1,"maximum":1000,"default":1000}},{"name":"after","in":"query","required":false,"description":"Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`\nresponse header's `rel=\"next\"` URL rather than constructing it.","schema":{"type":"string"}},{"$ref":"#/components/parameters/From"},{"$ref":"#/components/parameters/To"},{"name":"action","in":"query","required":false,"schema":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"description":"Filter by action/event."},{"name":"source","in":"query","required":false,"schema":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"description":"Filter by source."},{"name":"_byUserId","in":"query","required":false,"schema":{"type":"string"},"description":"Filter by the user who performed the action."}],"responses":{"200":{"description":"Audit entries","headers":{"Link":{"description":"RFC 5988 pagination link. Includes `<...>; rel=\"next\"` with an\n`after` cursor when more entries exist; absent on the final page.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AuditEntry"}}}}},"204":{"description":"No audit entries found"},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"404":{"$ref":"#/components/responses/404-not-found"},"422":{"$ref":"#/components/responses/422-invalid-audit-query"}}}}}}
```

## Query a resource's audit log with multi-select filters

> The POST variant of the resource-and-descendants audit query, accepting\
> the same multi-select filter body as \`POST /v1/audit\`. Body filters apply\
> within the resource's descendant set — e.g. filter an integration's audit\
> trail to specific actions or sources. Response shape matches the GET\
> variant.\
> \
> Pagination, sorting, and time bounds stay in the query string — sending\
> them in the body fails with 400 \`invalid\_request\_body\`.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- On a `platform` license, queries reach back as many years as the license's `auditLogRetentionYears`, but a query without `from` or `to` returns only the last year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"parameters":{"From":{"name":"from","in":"query","required":false,"description":"Only return entries at or after this timestamp. On a `platform` license, leaving it out limits\nthe range to the year before `to` (or the last year when `to` is omitted too), and a value older\nthan the audit window — the license's `auditLogRetentionYears` — starts the range at the\nwindow's edge instead of failing. A future value fails with 422 `invalid_time_period`.","schema":{"type":"string","format":"date-time"}},"To":{"name":"to","in":"query","required":false,"description":"Only return entries at or before this timestamp. A future value, or one older than the\naccount's audit window, fails with 422 `invalid_time_period`; the message names the window in\nyears (the license's `auditLogRetentionYears` on a `platform` license). A value earlier than\n`from` fails with 422 `invalid_time_range`.","schema":{"type":"string","format":"date-time"}}},"schemas":{"AuditQueryFilters":{"type":"object","description":"Multi-select audit filters for the POST query endpoints. Every filter is\nan array — send multiple values to match any of them. Pagination\n(`after`, `before`, `limit`, `sort_order`, `sort_by`) and time bounds\n(`from`, `to`) belong in the query string, not this body — including\nthem here fails with 400 `invalid_request_body`.","properties":{"resourceType":{"type":"array","description":"Match entries for any of these resource types (singular form).","items":{"type":"string","enum":["accesstoken","agent","agentgroup","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]}},"source":{"type":"array","description":"Match entries produced by any of these sources.","items":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]}},"action":{"type":"array","description":"Match entries recording any of these actions.","items":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]}},"resourceName":{"type":"array","description":"Restrict results to specific resources, each identified by its id and\ntype. Entries missing either key, or naming a type without audit\nsupport, fail with 422.","items":{"type":"object","required":["_resourceId","resourceType"],"properties":{"_resourceId":{"type":"string","format":"objectId","description":"Id of the resource to include."},"resourceType":{"type":"string","description":"Singular resource type of `_resourceId`."}}}}}},"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to. `fileserver` and\n`mcpoauthprovider` appear only in returned entries and cannot be used as a\n`resourceType` filter. MCP OAuth providers have no per-resource audit route\neither, so their entries are read from `GET /v1/audit` without a\n`resourceType` filter.","enum":["accesstoken","agent","agentgroup","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","fileserver","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"resourceName":{"type":"string","readOnly":true,"description":"Display name of the alert, present on `alert` entries only: `<type label> - <flow name>`\nfor a flow-level alert, `<type label> - All flows (<integration name>)` for an\nintegration-level alert."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type. `signinDenied` appears only in returned entries — it is\nrecorded when a network policy blocks a sign-in and cannot be used as an\n`action` filter.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs","signinDenied"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry. A value of about 10 KB or more is left\nout, so `oldValue` or `newValue` can be absent even on an `update`; the entry still carries\nthe `fieldPath`.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`). On `alert` entries a recipient\nchange is reported as `recipients`, with `oldValue` and `newValue` listing the recipients'\nemail addresses instead of user ids."},"oldValue":{"description":"Previous value (may be any JSON type). Omitted when the value is about 10 KB or larger."},"newValue":{"description":"New value (may be any JSON type). Omitted when the value is about 10 KB or larger."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related and alert events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/{resourceType}/{_id}/audit":{"post":{"summary":"Query a resource's audit log with multi-select filters","operationId":"queryAuditForResource","tags":["Audit Logs"],"description":"The POST variant of the resource-and-descendants audit query, accepting\nthe same multi-select filter body as `POST /v1/audit`. Body filters apply\nwithin the resource's descendant set — e.g. filter an integration's audit\ntrail to specific actions or sources. Response shape matches the GET\nvariant.\n\nPagination, sorting, and time bounds stay in the query string — sending\nthem in the body fails with 400 `invalid_request_body`.","parameters":[{"name":"resourceType","in":"path","required":true,"schema":{"type":"string","enum":["accesstokens","agents","agentgroups","alerts","apis","asynchelpers","connections","ediprofiles","environments","exports","filedefinitions","flows","groups","iclients","idpconfigs","imports","integrations","lookupcaches","mcpservers","networkpolicies","notifications","revisions","roles","scripts","ssoclients","stacks","syncs","tools","topics","users"]},"description":"Plural resource type."},{"name":"_id","in":"path","required":true,"description":"Resource id.","schema":{"type":"string","format":"objectId"}},{"name":"limit","in":"query","required":false,"description":"Maximum number of audit entries to return.","schema":{"type":"integer","minimum":1,"maximum":1000,"default":1000}},{"name":"after","in":"query","required":false,"description":"Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`\nresponse header's `rel=\"next\"` URL rather than constructing it. Mutually exclusive\nwith `before`.","schema":{"type":"string"}},{"name":"before","in":"query","required":false,"description":"Opaque pagination cursor for the previous page, from the `Link` response\nheader. Mutually exclusive with `after` — sending both returns 422.","schema":{"type":"string"}},{"name":"sort_by","in":"query","required":false,"description":"Field to sort by. Only `time` is accepted; other values return 422.","schema":{"type":"string","enum":["time"],"default":"time"}},{"name":"sort_order","in":"query","required":false,"description":"Sort direction for `time`.","schema":{"type":"string","enum":["asc","desc"],"default":"desc"}},{"$ref":"#/components/parameters/From"},{"$ref":"#/components/parameters/To"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditQueryFilters"}}}},"responses":{"200":{"description":"Audit entries","headers":{"Link":{"description":"RFC 5988 pagination link. Includes `<...>; rel=\"next\"` with an\n`after` cursor when more entries exist; absent on the final page.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AuditEntry"}}}}},"204":{"description":"No audit entries match the filters."},"400":{"description":"Pagination parameters were sent in the request body, or the path is\ninvalid (`_id` malformed, or a resource type without audit support).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"$ref":"#/components/responses/401-unauthorized"},"404":{"$ref":"#/components/responses/404-not-found"},"422":{"description":"A filter value is invalid, a filter that must be an array was sent as\nanother type, the `after`/`before` cursor is malformed, or a time bound is\noutside the account's audit window (`invalid_time_period`) or reversed\n(`invalid_time_range`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## Get signed URL to download audit logs CSV (for selected resources)

> Generates a signed URL for downloading a CSV export of audit logs for specific\
> resources and their descendants.\
> \
> The signed URL expires after 15 minutes. When \`hasMore\` is true, pass\
> the last CSV row's timestamp as \`to\` in the request body to fetch the\
> next batch, keeping the same \`from\`: without one, the batch covers only\
> the year before \`to\`.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- On a `platform` license, queries reach back as many years as the license's `auditLogRetentionYears`, but a query without `from` or `to` returns only the last year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"AuditDownloadRequest":{"type":"object","description":"Request body for `POST /v1/{resourceType}/audit/signedURL`.","properties":{"_resourceIds":{"type":"array","description":"List of resource ids to include in the audit export.","items":{"type":"string"}},"from":{"type":"string","format":"date-time","description":"Only include entries at or after this timestamp. On a `platform` license, leaving it out\nlimits the export to the year before `to` (or the last year), and a value older than the\naudit window — the license's `auditLogRetentionYears` — starts it at the window's edge\ninstead of failing. A future value fails with 422 `invalid_time_period`."},"to":{"type":"string","format":"date-time","description":"Only include entries at or before this timestamp. A future value, or one older than the\naccount's audit window, fails with 422 `invalid_time_period`; one earlier than `from`\nfails with 422 `invalid_time_range`."},"action":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"],"description":"Event/action filter."},"resourceType":{"type":"string","description":"Resource type filter (singular form).","enum":["accesstoken","agent","agentgroup","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"source":{"type":"string","enum":["ui","api","system","connector","script","sso","cli","mcp","ora"],"description":"Source filter."},"_byUserId":{"type":"string","description":"Filter by actor user id (or `support`)."}},"required":["_resourceIds"]},"SignedUrlResponse":{"type":"object","description":"Response containing a signed URL for downloading an audit CSV export.\n\nEach CSV is capped at roughly 20 000 rows. When `hasMore` is `true`,\npass the timestamp of the last row as the `to` query parameter on the\nnext request to fetch the next batch.","properties":{"signedURL":{"type":"string","description":"Signed URL to download the CSV. The link expires after 15 minutes."},"hasMore":{"type":"boolean","description":"`true` when the result set exceeded the per-file row limit (~20 000 rows)\nand additional batches remain. To paginate, take the timestamp of the\nlast CSV row and pass it as the `to` query parameter on your next request."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"422-invalid-audit-query":{"description":"A query value is invalid: a filter outside the audit vocabulary (`invalid_audit_field`), a\n`from` or `to` that is not ISO 8601 (`invalid_timestamp_format`), a bound in the future or a `to`\nolder than the account's audit window (`invalid_time_period`), or a `from` later than `to`\n(`invalid_time_range`).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/{resourceType}/audit/signedURL":{"post":{"summary":"Get signed URL to download audit logs CSV (for selected resources)","operationId":"getAuditSignedUrlForResources","tags":["Audit Logs"],"description":"Generates a signed URL for downloading a CSV export of audit logs for specific\nresources and their descendants.\n\nThe signed URL expires after 15 minutes. When `hasMore` is true, pass\nthe last CSV row's timestamp as `to` in the request body to fetch the\nnext batch, keeping the same `from`: without one, the batch covers only\nthe year before `to`.","parameters":[{"name":"resourceType","in":"path","required":true,"schema":{"type":"string","enum":["accesstokens","agents","agentgroups","alerts","apis","asynchelpers","connections","ediprofiles","environments","exports","filedefinitions","flows","groups","iclients","idpconfigs","imports","integrations","lookupcaches","mcpservers","networkpolicies","notifications","revisions","roles","scripts","ssoclients","stacks","syncs","tools","topics","users"]},"description":"Plural resource type."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditDownloadRequest"}}}},"responses":{"200":{"description":"Signed URL response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignedUrlResponse"}}}},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"422":{"$ref":"#/components/responses/422-invalid-audit-query"}}}}}}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://developer.celigo.com/api/api-reference/monitoring/audit-logs.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.