> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/api/api-reference/monitoring/audit-logs.md).

# Audit Logs

Audit logs are an append-only record of every configuration change and account event in Celigo. Each entry captures who performed an action, what resource was affected, when it happened, and what changed — down to field-level diffs for updates. Use them for compliance, change tracking, and troubleshooting.

Notes:

* History is retained for a minimum of one year.
* Sensitive values (tokens, passwords) appear masked as `******`.
* CSV downloads are capped at \~20,000 rows per file; use `hasMore` to paginate.
* `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.

### Audit entry schema

## The AuditEntry object

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"components":{"schemas":{"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to. `fileserver` appears only in\nreturned entries and cannot be used as a `resourceType` filter.","enum":["accesstoken","agent","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","fileserver","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type. `signinDenied` appears only in returned entries — it is\nrecorded when a network policy blocks a sign-in and cannot be used as an\n`action` filter.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs","signinDenied"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`)."},"oldValue":{"description":"Previous value (may be any JSON type)."},"newValue":{"description":"New value (may be any JSON type)."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}}}}}
```

## Query audit logs

> Search audit log entries across all resources in the current account.\
> Use this to answer "what changed?" across the account — filter by resource\
> type, user, source, action, or time range. Results are ordered newest-first.\
> \
> Filtering by \`resourceType\` + \`\_resourceId\` returns entries for that\
> exact resource only — to include descendants (e.g. an integration's\
> flows and exports), use \`GET /v1/{resourceType}/{\_id}/audit\` instead.\
> \`\_resourceId\` requires \`resourceType\` to also be set.\
> \
> Only the account owner and administrators can query the account-wide\
> log: manage, monitor and integration-level users get 403, and an API\
> token with limited scope gets 401 \`token\_restricted\_access\`. Those\
> users can still read the history of a resource they can see, through\
> \`GET /v1/{resourceType}/{\_id}/audit\`.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to. `fileserver` appears only in\nreturned entries and cannot be used as a `resourceType` filter.","enum":["accesstoken","agent","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","fileserver","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type. `signinDenied` appears only in returned entries — it is\nrecorded when a network policy blocks a sign-in and cannot be used as an\n`action` filter.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs","signinDenied"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`)."},"oldValue":{"description":"Previous value (may be any JSON type)."},"newValue":{"description":"New value (may be any JSON type)."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized-or-scoped-token":{"description":"Unauthorized: the request has no valid bearer token (a bare `{message}` body, as on every\nroute), or the token is an API token with limited scope. The account-wide audit query\ntakes only a full-access API token, a personal access token, or a signed-in session; a\nscoped token is refused with `token_restricted_access` in the standard `{errors: [...]}`\nenvelope.","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","description":"The auth middleware's bare body for a missing or invalid token.","properties":{"message":{"type":"string","description":"`Unauthorized` (no Authorization header) or `Bearer Authentication Failed`."}},"required":["message"]}]}}}},"403-administrator-only":{"description":"The caller is a manage, monitor or integration-level user. The account-wide audit log is\nfor the account owner and administrators; other users read one resource's history with\n`GET /v1/{resourceType}/{_id}/audit` instead.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/audit":{"get":{"summary":"Query audit logs","operationId":"getAuditLogs","tags":["Audit Logs"],"description":"Search audit log entries across all resources in the current account.\nUse this to answer \"what changed?\" across the account — filter by resource\ntype, user, source, action, or time range. Results are ordered newest-first.\n\nFiltering by `resourceType` + `_resourceId` returns entries for that\nexact resource only — to include descendants (e.g. an integration's\nflows and exports), use `GET /v1/{resourceType}/{_id}/audit` instead.\n`_resourceId` requires `resourceType` to also be set.\n\nOnly the account owner and administrators can query the account-wide\nlog: manage, monitor and integration-level users get 403, and an API\ntoken with limited scope gets 401 `token_restricted_access`. Those\nusers can still read the history of a resource they can see, through\n`GET /v1/{resourceType}/{_id}/audit`.","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":1000,"default":1000},"description":"Maximum number of audit entries to return."},{"name":"after","in":"query","required":false,"description":"Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`\nresponse header's `rel=\"next\"` URL rather than constructing it.","schema":{"type":"string"}},{"name":"resourceType","in":"query","required":false,"schema":{"type":"string","enum":["accesstoken","agent","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"description":"Filter by resource type (singular form). Unsupported values are\nrejected with 422 `audit_not_supported`."},{"name":"_resourceId","in":"query","required":false,"schema":{"type":"string","format":"objectId"},"description":"Filter by a specific resource id. Requires `resourceType` to also be set."},{"name":"_byUserId","in":"query","required":false,"description":"Filter by user id, or pass `support` to filter actions performed by Celigo support.","schema":{"type":"string"}},{"name":"source","in":"query","required":false,"schema":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"description":"Filter by source. Unsupported values are rejected with 422\n`invalid_audit_field`."},{"name":"fieldPath","in":"query","required":false,"schema":{"type":"string"},"description":"Restrict the `fieldChanges` of returned entries to changes on this\nfield path. The value is not validated against known paths — an\nunknown path simply matches nothing."},{"name":"action","in":"query","required":false,"schema":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"description":"Filter by action/event."},{"name":"from","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"Start timestamp (ISO-8601)."},{"name":"to","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"End timestamp (ISO-8601)."}],"responses":{"200":{"description":"Audit entries","headers":{"Link":{"description":"RFC 5988 pagination link. Includes `<...>; rel=\"next\"` with an\n`after` cursor when more entries exist; absent on the final page.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AuditEntry"}}}}},"204":{"description":"No audit entries found"},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized-or-scoped-token"},"403":{"$ref":"#/components/responses/403-administrator-only"},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```

## Query audit logs with multi-select filters

> The POST variant of the account-wide audit query, for filters the GET\
> query string cannot express: each body filter is an array that matches\
> entries with any of the listed values, and \`resourceName\` scopes results\
> to an explicit list of resources. Response shape and ordering are\
> identical to \`GET /v1/audit\`.\
> \
> Pagination, sorting, and time bounds stay in the query string — sending\
> them in the body fails with 400 \`invalid\_request\_body\`. The same callers\
> are refused as on \`GET /v1/audit\`.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"AuditQueryFilters":{"type":"object","description":"Multi-select audit filters for the POST query endpoints. Every filter is\nan array — send multiple values to match any of them. Pagination\n(`after`, `before`, `limit`, `sort_order`, `sort_by`) and time bounds\n(`from`, `to`) belong in the query string, not this body — including\nthem here fails with 400 `invalid_request_body`.","properties":{"resourceType":{"type":"array","description":"Match entries for any of these resource types (singular form).","items":{"type":"string","enum":["accesstoken","agent","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]}},"source":{"type":"array","description":"Match entries produced by any of these sources.","items":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]}},"action":{"type":"array","description":"Match entries recording any of these actions.","items":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]}},"resourceName":{"type":"array","description":"Restrict results to specific resources, each identified by its id and\ntype. Entries missing either key, or naming a type without audit\nsupport, fail with 422.","items":{"type":"object","required":["_resourceId","resourceType"],"properties":{"_resourceId":{"type":"string","format":"objectId","description":"Id of the resource to include."},"resourceType":{"type":"string","description":"Singular resource type of `_resourceId`."}}}}}},"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to. `fileserver` appears only in\nreturned entries and cannot be used as a `resourceType` filter.","enum":["accesstoken","agent","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","fileserver","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type. `signinDenied` appears only in returned entries — it is\nrecorded when a network policy blocks a sign-in and cannot be used as an\n`action` filter.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs","signinDenied"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`)."},"oldValue":{"description":"Previous value (may be any JSON type)."},"newValue":{"description":"New value (may be any JSON type)."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"401-unauthorized-or-scoped-token":{"description":"Unauthorized: the request has no valid bearer token (a bare `{message}` body, as on every\nroute), or the token is an API token with limited scope. The account-wide audit query\ntakes only a full-access API token, a personal access token, or a signed-in session; a\nscoped token is refused with `token_restricted_access` in the standard `{errors: [...]}`\nenvelope.","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","description":"The auth middleware's bare body for a missing or invalid token.","properties":{"message":{"type":"string","description":"`Unauthorized` (no Authorization header) or `Bearer Authentication Failed`."}},"required":["message"]}]}}}},"403-administrator-only":{"description":"The caller is a manage, monitor or integration-level user. The account-wide audit log is\nfor the account owner and administrators; other users read one resource's history with\n`GET /v1/{resourceType}/{_id}/audit` instead.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/audit":{"post":{"summary":"Query audit logs with multi-select filters","operationId":"queryAuditLogs","tags":["Audit Logs"],"description":"The POST variant of the account-wide audit query, for filters the GET\nquery string cannot express: each body filter is an array that matches\nentries with any of the listed values, and `resourceName` scopes results\nto an explicit list of resources. Response shape and ordering are\nidentical to `GET /v1/audit`.\n\nPagination, sorting, and time bounds stay in the query string — sending\nthem in the body fails with 400 `invalid_request_body`. The same callers\nare refused as on `GET /v1/audit`.","parameters":[{"name":"limit","in":"query","required":false,"schema":{"type":"integer","minimum":1,"maximum":1000,"default":1000},"description":"Maximum number of audit entries to return."},{"name":"after","in":"query","required":false,"description":"Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`\nresponse header's `rel=\"next\"` URL rather than constructing it. Mutually exclusive\nwith `before`.","schema":{"type":"string"}},{"name":"before","in":"query","required":false,"description":"Opaque pagination cursor for the previous page, from the `Link` response\nheader. Mutually exclusive with `after` — sending both returns 422.","schema":{"type":"string"}},{"name":"sort_by","in":"query","required":false,"description":"Field to sort by. Only `time` is accepted; other values return 422.","schema":{"type":"string","enum":["time"],"default":"time"}},{"name":"sort_order","in":"query","required":false,"description":"Sort direction for `time`.","schema":{"type":"string","enum":["asc","desc"],"default":"desc"}},{"name":"from","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"Start timestamp (ISO-8601)."},{"name":"to","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"End timestamp (ISO-8601)."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditQueryFilters"}}}},"responses":{"200":{"description":"Audit entries","headers":{"Link":{"description":"RFC 5988 pagination link. Includes `<...>; rel=\"next\"` with an\n`after` cursor when more entries exist; absent on the final page.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AuditEntry"}}}}},"204":{"description":"No audit entries match the filters."},"400":{"description":"Pagination parameters were sent in the request body.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"$ref":"#/components/responses/401-unauthorized-or-scoped-token"},"403":{"$ref":"#/components/responses/403-administrator-only"},"422":{"description":"A filter value is invalid, a filter that must be an array was sent as\nanother type, or the `after`/`before` cursor is malformed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## Get signed URL to download audit logs CSV (all documents)

> Generates a signed URL for downloading a CSV export of audit logs across all\
> documents. The CSV columns are: Time, Source, User, Resource, Name/ID, Action,\
> Field, Old value, New value, Support. The same callers are refused as on\
> \`GET /v1/audit\`: only the account owner and administrators can export the\
> account-wide log.\
> \
> The signed URL expires after 15 minutes. When \`hasMore\` is true, pass\
> the last CSV row's timestamp as \`to\` to fetch the next batch.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"SignedUrlResponse":{"type":"object","description":"Response containing a signed URL for downloading an audit CSV export.\n\nEach CSV is capped at roughly 20 000 rows. When `hasMore` is `true`,\npass the timestamp of the last row as the `to` query parameter on the\nnext request to fetch the next batch.","properties":{"signedURL":{"type":"string","description":"Signed URL to download the CSV. The link expires after 15 minutes."},"hasMore":{"type":"boolean","description":"`true` when the result set exceeded the per-file row limit (~20 000 rows)\nand additional batches remain. To paginate, take the timestamp of the\nlast CSV row and pass it as the `to` query parameter on your next request."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"401-unauthorized-or-scoped-token":{"description":"Unauthorized: the request has no valid bearer token (a bare `{message}` body, as on every\nroute), or the token is an API token with limited scope. The account-wide audit query\ntakes only a full-access API token, a personal access token, or a signed-in session; a\nscoped token is refused with `token_restricted_access` in the standard `{errors: [...]}`\nenvelope.","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","description":"The auth middleware's bare body for a missing or invalid token.","properties":{"message":{"type":"string","description":"`Unauthorized` (no Authorization header) or `Bearer Authentication Failed`."}},"required":["message"]}]}}}},"403-administrator-only":{"description":"The caller is a manage, monitor or integration-level user. The account-wide audit log is\nfor the account owner and administrators; other users read one resource's history with\n`GET /v1/{resourceType}/{_id}/audit` instead.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/audit/signedURL":{"get":{"summary":"Get signed URL to download audit logs CSV (all documents)","operationId":"getAuditSignedUrlAll","tags":["Audit Logs"],"description":"Generates a signed URL for downloading a CSV export of audit logs across all\ndocuments. The CSV columns are: Time, Source, User, Resource, Name/ID, Action,\nField, Old value, New value, Support. The same callers are refused as on\n`GET /v1/audit`: only the account owner and administrators can export the\naccount-wide log.\n\nThe signed URL expires after 15 minutes. When `hasMore` is true, pass\nthe last CSV row's timestamp as `to` to fetch the next batch.","parameters":[{"name":"resourceType","in":"query","required":false,"schema":{"type":"string","enum":["accesstoken","agent","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"description":"Optional filter by resource type (singular form)."},{"name":"_byUserId","in":"query","required":false,"schema":{"type":"string"},"description":"Optional filter by the user who performed the actions."},{"name":"_resourceId","in":"query","required":false,"schema":{"type":"string","format":"objectId"},"description":"Optional filter by resource id."},{"name":"from","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"Start timestamp (ISO-8601)."},{"name":"to","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"End timestamp (ISO-8601)."},{"name":"action","in":"query","required":false,"schema":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"description":"Action/event filter."},{"name":"source","in":"query","required":false,"schema":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"description":"Source filter."}],"responses":{"200":{"description":"Signed URL response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignedUrlResponse"}}}},"401":{"$ref":"#/components/responses/401-unauthorized-or-scoped-token"},"403":{"$ref":"#/components/responses/403-administrator-only"},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```

## Get signed URL for audit CSV with multi-select filters

> The POST variant of the CSV signed-URL download, accepting the same\
> multi-select filter body as \`POST /v1/audit\`. The response is identical\
> to the GET variant: a signed URL valid for \~15 minutes plus \`hasMore\`\
> for batching.\
> \
> Sorting and time bounds stay in the query string — sending \`from\`/\`to\`\
> or pagination keys in the body fails with 400.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"AuditQueryFilters":{"type":"object","description":"Multi-select audit filters for the POST query endpoints. Every filter is\nan array — send multiple values to match any of them. Pagination\n(`after`, `before`, `limit`, `sort_order`, `sort_by`) and time bounds\n(`from`, `to`) belong in the query string, not this body — including\nthem here fails with 400 `invalid_request_body`.","properties":{"resourceType":{"type":"array","description":"Match entries for any of these resource types (singular form).","items":{"type":"string","enum":["accesstoken","agent","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]}},"source":{"type":"array","description":"Match entries produced by any of these sources.","items":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]}},"action":{"type":"array","description":"Match entries recording any of these actions.","items":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]}},"resourceName":{"type":"array","description":"Restrict results to specific resources, each identified by its id and\ntype. Entries missing either key, or naming a type without audit\nsupport, fail with 422.","items":{"type":"object","required":["_resourceId","resourceType"],"properties":{"_resourceId":{"type":"string","format":"objectId","description":"Id of the resource to include."},"resourceType":{"type":"string","description":"Singular resource type of `_resourceId`."}}}}}},"SignedUrlResponse":{"type":"object","description":"Response containing a signed URL for downloading an audit CSV export.\n\nEach CSV is capped at roughly 20 000 rows. When `hasMore` is `true`,\npass the timestamp of the last row as the `to` query parameter on the\nnext request to fetch the next batch.","properties":{"signedURL":{"type":"string","description":"Signed URL to download the CSV. The link expires after 15 minutes."},"hasMore":{"type":"boolean","description":"`true` when the result set exceeded the per-file row limit (~20 000 rows)\nand additional batches remain. To paginate, take the timestamp of the\nlast CSV row and pass it as the `to` query parameter on your next request."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"401-unauthorized-or-scoped-token":{"description":"Unauthorized: the request has no valid bearer token (a bare `{message}` body, as on every\nroute), or the token is an API token with limited scope. The account-wide audit query\ntakes only a full-access API token, a personal access token, or a signed-in session; a\nscoped token is refused with `token_restricted_access` in the standard `{errors: [...]}`\nenvelope.","content":{"application/json":{"schema":{"oneOf":[{"$ref":"#/components/schemas/Error"},{"type":"object","description":"The auth middleware's bare body for a missing or invalid token.","properties":{"message":{"type":"string","description":"`Unauthorized` (no Authorization header) or `Bearer Authentication Failed`."}},"required":["message"]}]}}}},"403-administrator-only":{"description":"The caller is a manage, monitor or integration-level user. The account-wide audit log is\nfor the account owner and administrators; other users read one resource's history with\n`GET /v1/{resourceType}/{_id}/audit` instead.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/audit/signedURL":{"post":{"summary":"Get signed URL for audit CSV with multi-select filters","operationId":"queryAuditSignedUrlAll","tags":["Audit Logs"],"description":"The POST variant of the CSV signed-URL download, accepting the same\nmulti-select filter body as `POST /v1/audit`. The response is identical\nto the GET variant: a signed URL valid for ~15 minutes plus `hasMore`\nfor batching.\n\nSorting and time bounds stay in the query string — sending `from`/`to`\nor pagination keys in the body fails with 400.","parameters":[{"name":"sort_order","in":"query","required":false,"description":"Sort direction for the CSV rows by time.","schema":{"type":"string","enum":["asc","desc"],"default":"desc"}},{"name":"from","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"Start timestamp (ISO-8601)."},{"name":"to","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"End timestamp (ISO-8601)."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditQueryFilters"}}}},"responses":{"200":{"description":"Signed URL response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignedUrlResponse"}}}},"400":{"description":"Pagination or time-bound parameters were sent in the request body.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"$ref":"#/components/responses/401-unauthorized-or-scoped-token"},"403":{"$ref":"#/components/responses/403-administrator-only"},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```

## Get audit log for a resource (and descendants)

> Returns audit log entries for a specific resource and its descendants. For example,\
> querying an integration returns changes to the integration, its flows, exports,\
> imports, and connections.\
> \
> For account-wide searches, use \`GET /v1/audit\` instead.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to. `fileserver` appears only in\nreturned entries and cannot be used as a `resourceType` filter.","enum":["accesstoken","agent","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","fileserver","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type. `signinDenied` appears only in returned entries — it is\nrecorded when a network policy blocks a sign-in and cannot be used as an\n`action` filter.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs","signinDenied"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`)."},"oldValue":{"description":"Previous value (may be any JSON type)."},"newValue":{"description":"New value (may be any JSON type)."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/{resourceType}/{_id}/audit":{"get":{"summary":"Get audit log for a resource (and descendants)","operationId":"getAuditForResource","tags":["Audit Logs"],"description":"Returns audit log entries for a specific resource and its descendants. For example,\nquerying an integration returns changes to the integration, its flows, exports,\nimports, and connections.\n\nFor account-wide searches, use `GET /v1/audit` instead.","parameters":[{"name":"resourceType","in":"path","required":true,"schema":{"type":"string","enum":["accesstokens","agents","alerts","apis","asynchelpers","connections","ediprofiles","exports","filedefinitions","flows","groups","iclients","idpconfigs","imports","integrations","lookupcaches","mcpoauthproviders","mcpservers","networkpolicies","revisions","roles","scripts","ssoclients","stacks","syncs","tools","topics"]},"description":"Plural resource type."},{"name":"_id","in":"path","required":true,"description":"Resource id.","schema":{"type":"string","format":"objectId"}},{"name":"limit","in":"query","required":false,"description":"Maximum number of audit entries to return.","schema":{"type":"integer","minimum":1,"maximum":1000,"default":1000}},{"name":"after","in":"query","required":false,"description":"Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`\nresponse header's `rel=\"next\"` URL rather than constructing it.","schema":{"type":"string"}},{"name":"from","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"Start timestamp (ISO-8601)."},{"name":"to","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"End timestamp (ISO-8601)."},{"name":"action","in":"query","required":false,"schema":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]},"description":"Filter by action/event."},{"name":"source","in":"query","required":false,"schema":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"description":"Filter by source."},{"name":"_byUserId","in":"query","required":false,"schema":{"type":"string"},"description":"Filter by the user who performed the action."}],"responses":{"200":{"description":"Audit entries","headers":{"Link":{"description":"RFC 5988 pagination link. Includes `<...>; rel=\"next\"` with an\n`after` cursor when more entries exist; absent on the final page.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AuditEntry"}}}}},"204":{"description":"No audit entries found"},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"404":{"$ref":"#/components/responses/404-not-found"},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```

## Query a resource's audit log with multi-select filters

> The POST variant of the resource-and-descendants audit query, accepting\
> the same multi-select filter body as \`POST /v1/audit\`. Body filters apply\
> within the resource's descendant set — e.g. filter an integration's audit\
> trail to specific actions or sources. Response shape matches the GET\
> variant.\
> \
> Pagination, sorting, and time bounds stay in the query string — sending\
> them in the body fails with 400 \`invalid\_request\_body\`.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"AuditQueryFilters":{"type":"object","description":"Multi-select audit filters for the POST query endpoints. Every filter is\nan array — send multiple values to match any of them. Pagination\n(`after`, `before`, `limit`, `sort_order`, `sort_by`) and time bounds\n(`from`, `to`) belong in the query string, not this body — including\nthem here fails with 400 `invalid_request_body`.","properties":{"resourceType":{"type":"array","description":"Match entries for any of these resource types (singular form).","items":{"type":"string","enum":["accesstoken","agent","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]}},"source":{"type":"array","description":"Match entries produced by any of these sources.","items":{"type":"string","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]}},"action":{"type":"array","description":"Match entries recording any of these actions.","items":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"]}},"resourceName":{"type":"array","description":"Restrict results to specific resources, each identified by its id and\ntype. Entries missing either key, or naming a type without audit\nsupport, fail with 422.","items":{"type":"object","required":["_resourceId","resourceType"],"properties":{"_resourceId":{"type":"string","format":"objectId","description":"Id of the resource to include."},"resourceType":{"type":"string","description":"Singular resource type of `_resourceId`."}}}}}},"AuditEntry":{"type":"object","required":["_id","event","resourceType","source","time","byUser","fieldChanges"],"description":"An audit log entry.","properties":{"_id":{"type":"string","format":"objectId","readOnly":true,"description":"Audit entry id."},"byUser":{"type":"object","readOnly":true,"description":"The user who performed the action. Populated at read time from the current user record.","properties":{"_id":{"type":"string","format":"objectId","description":"User id of the actor."},"email":{"type":"string","description":"Actor's current email address."},"name":{"type":"string","description":"Actor's current display name."}}},"resourceType":{"type":"string","readOnly":true,"description":"Resource type that the audit entry applies to. `fileserver` appears only in\nreturned entries and cannot be used as a `resourceType` filter.","enum":["accesstoken","agent","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","fileserver","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"_resourceId":{"type":"string","format":"objectId","readOnly":true,"description":"Resource id the audit entry applies to."},"source":{"type":"string","readOnly":true,"description":"Source of the change.","enum":["ui","api","system","connector","script","stack","sso","cli","mcp","ora"]},"support":{"type":"boolean","readOnly":true,"description":"When true, the action was performed by support tooling/context."},"fieldChanges":{"type":"array","readOnly":true,"description":"List of field-level changes (when applicable).","items":{"$ref":"#/components/schemas/FieldChange"}},"deletedInfo":{"$ref":"#/components/schemas/DeletedInfo"},"event":{"type":"string","readOnly":true,"description":"Audit event type. `signinDenied` appears only in returned entries — it is\nrecorded when a network policy blocks a sign-in and cannot be used as an\n`action` filter.","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs","signinDenied"]},"time":{"type":"string","format":"date-time","readOnly":true,"description":"Timestamp when the action occurred."}}},"FieldChange":{"type":"object","description":"A single field-level change within an audit entry.","properties":{"fieldPath":{"type":"string","description":"Dot-path to the changed field (e.g., `settings.foo.bar`)."},"oldValue":{"description":"Previous value (may be any JSON type)."},"newValue":{"description":"New value (may be any JSON type)."}}},"DeletedInfo":{"type":"object","description":"Extra context recorded for delete events (when available).","properties":{"name":{"type":"string","description":"Name of the deleted resource (if available)."},"_integrationId":{"type":"string","format":"objectId","description":"Integration id context (for flow/sync-related events)."},"_abstractFlowId":{"type":"string","format":"objectId","description":"Abstract flow id (for instance flow events)."},"_syncId":{"type":"string","format":"objectId","description":"Sync id context (for dataset events)."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"404-not-found":{"description":"Not found. The requested resource does not exist or is not visible to the caller.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/{resourceType}/{_id}/audit":{"post":{"summary":"Query a resource's audit log with multi-select filters","operationId":"queryAuditForResource","tags":["Audit Logs"],"description":"The POST variant of the resource-and-descendants audit query, accepting\nthe same multi-select filter body as `POST /v1/audit`. Body filters apply\nwithin the resource's descendant set — e.g. filter an integration's audit\ntrail to specific actions or sources. Response shape matches the GET\nvariant.\n\nPagination, sorting, and time bounds stay in the query string — sending\nthem in the body fails with 400 `invalid_request_body`.","parameters":[{"name":"resourceType","in":"path","required":true,"schema":{"type":"string","enum":["accesstokens","agents","alerts","apis","asynchelpers","connections","ediprofiles","exports","filedefinitions","flows","groups","iclients","idpconfigs","imports","integrations","lookupcaches","mcpoauthproviders","mcpservers","networkpolicies","revisions","roles","scripts","ssoclients","stacks","syncs","tools","topics"]},"description":"Plural resource type."},{"name":"_id","in":"path","required":true,"description":"Resource id.","schema":{"type":"string","format":"objectId"}},{"name":"limit","in":"query","required":false,"description":"Maximum number of audit entries to return.","schema":{"type":"integer","minimum":1,"maximum":1000,"default":1000}},{"name":"after","in":"query","required":false,"description":"Opaque pagination cursor for the next page. Take it from the `after` value in the `Link`\nresponse header's `rel=\"next\"` URL rather than constructing it. Mutually exclusive\nwith `before`.","schema":{"type":"string"}},{"name":"before","in":"query","required":false,"description":"Opaque pagination cursor for the previous page, from the `Link` response\nheader. Mutually exclusive with `after` — sending both returns 422.","schema":{"type":"string"}},{"name":"sort_by","in":"query","required":false,"description":"Field to sort by. Only `time` is accepted; other values return 422.","schema":{"type":"string","enum":["time"],"default":"time"}},{"name":"sort_order","in":"query","required":false,"description":"Sort direction for `time`.","schema":{"type":"string","enum":["asc","desc"],"default":"desc"}},{"name":"from","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"Start timestamp (ISO-8601)."},{"name":"to","in":"query","required":false,"schema":{"type":"string","format":"date-time"},"description":"End timestamp (ISO-8601)."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditQueryFilters"}}}},"responses":{"200":{"description":"Audit entries","headers":{"Link":{"description":"RFC 5988 pagination link. Includes `<...>; rel=\"next\"` with an\n`after` cursor when more entries exist; absent on the final page.","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/AuditEntry"}}}}},"204":{"description":"No audit entries match the filters."},"400":{"description":"Pagination parameters were sent in the request body, or the path is\ninvalid (`_id` malformed, or a resource type without audit support).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"$ref":"#/components/responses/401-unauthorized"},"404":{"$ref":"#/components/responses/404-not-found"},"422":{"description":"A filter value is invalid, a filter that must be an array was sent as\nanother type, or the `after`/`before` cursor is malformed.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```

## Get signed URL to download audit logs CSV (for selected resources)

> Generates a signed URL for downloading a CSV export of audit logs for specific\
> resources and their descendants.\
> \
> The signed URL expires after 15 minutes. When \`hasMore\` is true, pass\
> the last CSV row's timestamp as \`to\` in the request body to fetch the\
> next batch.

```json
{"openapi":"3.2.0","info":{"title":"Audit Logs","version":"1.0.0"},"tags":[{"name":"Audit Logs","description":"Audit logs are an append-only record of every configuration change and\naccount event in Celigo. Each entry captures who performed an action,\nwhat resource was affected, when it happened, and what changed — down\nto field-level diffs for updates. Use them for compliance, change\ntracking, and troubleshooting.\n\nNotes:\n- History is retained for a minimum of one year.\n- Sensitive values (tokens, passwords) appear masked as `******`.\n- CSV downloads are capped at ~20,000 rows per file; use `hasMore` to paginate.\n- `byUser` is populated at read time — it reflects the user's current name and email, not the values at the time of the action.\n\n## Audit entry schema\n\n{% openapi-schemas spec=\"audit\" schemas=\"AuditEntry\" grouped=\"true\" %}"}],"servers":[{"url":"https://api.integrator.io","description":"Production (US / default region)"},{"url":"https://api.eu.integrator.io","description":"Production (EU region)"},{"url":"https://api.au.integrator.io","description":"Production (AU region)"},{"url":"https://api.ca.integrator.io","description":"Production (CA region)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"}},"schemas":{"AuditDownloadRequest":{"type":"object","description":"Request body for `POST /v1/{resourceType}/audit/signedURL`.","properties":{"_resourceIds":{"type":"array","description":"List of resource ids to include in the audit export.","items":{"type":"string"}},"from":{"type":"string","format":"date-time","description":"Start timestamp (ISO-8601)."},"to":{"type":"string","format":"date-time","description":"End timestamp (ISO-8601)."},"action":{"type":"string","enum":["create","update","delete","view","restore","purge","signin","signout","purgelogs"],"description":"Event/action filter."},"resourceType":{"type":"string","description":"Resource type filter (singular form).","enum":["accesstoken","agent","alert","api","ashare","asynchelper","connection","dataset","ediprofile","environment","export","file","filedefinition","flow","folder","group","iclient","idpconfig","import","integration","lookupcache","mcpoauthprovider","mcpserver","networkpolicy","notification","revision","role","script","ssoclient","stack","supportshare","sync","tool","topic","user"]},"source":{"type":"string","enum":["ui","api","system","connector","script","sso","cli","mcp","ora"],"description":"Source filter."},"_byUserId":{"type":"string","description":"Filter by actor user id (or `support`)."}},"required":["_resourceIds"]},"SignedUrlResponse":{"type":"object","description":"Response containing a signed URL for downloading an audit CSV export.\n\nEach CSV is capped at roughly 20 000 rows. When `hasMore` is `true`,\npass the timestamp of the last row as the `to` query parameter on the\nnext request to fetch the next batch.","properties":{"signedURL":{"type":"string","description":"Signed URL to download the CSV. The link expires after 15 minutes."},"hasMore":{"type":"boolean","description":"`true` when the result set exceeded the per-file row limit (~20 000 rows)\nand additional batches remain. To paginate, take the timestamp of the\nlast CSV row and pass it as the `to` query parameter on your next request."}}},"Error":{"type":"object","description":"Standard error response envelope returned by integrator.io APIs.","properties":{"errors":{"type":"array","description":"List of errors that occurred while processing the request.","items":{"type":"object","properties":{"code":{"oneOf":[{"type":"string"},{"type":"integer"}],"description":"Machine-readable error code. Usually a string like\n`invalid_ref`, `missing_required_field`, or `unauthorized`;\nmay be an **integer** when the error mirrors an upstream HTTP\nstatus (e.g. `500`) — most commonly returned by connection-ping\nand adaptor-proxy responses."},"message":{"type":"string","description":"Human-readable description of the error."},"field":{"type":"string","description":"Optional pointer to the document field that caused the error.\nUsed by structural validation errors (`missing_required_field`,\n`invalid_ref`) to indicate which field is at fault\n(e.g. `_id`, `type`, `http.baseURI`)."},"source":{"type":"string","description":"Optional origin layer for the error — e.g. `application` when\nthe error came from the remote system the adaptor called,\n`connector` when the adaptor itself rejected the request."}},"required":["message"]}}},"required":["errors"]}},"responses":{"400-bad-request":{"description":"Bad request. The server could not understand the request because of malformed syntax or invalid parameters.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401-unauthorized":{"description":"Unauthorized. The request lacks a valid bearer token, or the provided token\nfailed to authenticate.\n\nNote: the 401 response is produced by the auth middleware **before** the\nrequest reaches the endpoint handler, so it does **not** follow the\nstandard `{errors: [...]}` envelope. Instead the body is a bare\n`{message: string}` object with no `code`, no `errors` array. Callers\nhandling 401s should key off the HTTP status and the `message` string,\nnot try to destructure an `errors[]`.","content":{"application/json":{"schema":{"type":"object","properties":{"message":{"type":"string","description":"Human-readable description of the auth failure. Known values:\n- `\"Unauthorized\"` — no `Authorization` header on the request.\n- `\"Bearer Authentication Failed\"` — header present but token\n  is invalid, revoked, or expired."}},"required":["message"]}}}},"422-unprocessable-entity":{"description":"Unprocessable entity. The request was well-formed but was unable to be followed due to semantic errors.\n","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}},"paths":{"/v1/{resourceType}/audit/signedURL":{"post":{"summary":"Get signed URL to download audit logs CSV (for selected resources)","operationId":"getAuditSignedUrlForResources","tags":["Audit Logs"],"description":"Generates a signed URL for downloading a CSV export of audit logs for specific\nresources and their descendants.\n\nThe signed URL expires after 15 minutes. When `hasMore` is true, pass\nthe last CSV row's timestamp as `to` in the request body to fetch the\nnext batch.","parameters":[{"name":"resourceType","in":"path","required":true,"schema":{"type":"string","enum":["accesstokens","agents","alerts","apis","asynchelpers","connections","ediprofiles","exports","filedefinitions","flows","groups","iclients","idpconfigs","imports","integrations","lookupcaches","mcpoauthproviders","mcpservers","networkpolicies","revisions","roles","scripts","ssoclients","stacks","syncs","tools","topics"]},"description":"Plural resource type."}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditDownloadRequest"}}}},"responses":{"200":{"description":"Signed URL response","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SignedUrlResponse"}}}},"400":{"$ref":"#/components/responses/400-bad-request"},"401":{"$ref":"#/components/responses/401-unauthorized"},"422":{"$ref":"#/components/responses/422-unprocessable-entity"}}}}}}
```