audit

Query the account's change-tracking log — who changed which resource, when, and from where.

REST API: Audit Logs

celigo audit <subcommand> [flags]

Subcommands

Command	Purpose
list	List audit log entries.
download	Get a signed URL to download audit entries as CSV (max 20k rows).

celigo audit list

List audit log entries, optionally filtered by resource, user, source, action, and time window.

list chooses one of three endpoints from the filters you pass:

Filters	Endpoint and scope
No resource filter	Account-wide.
One --resource-type plus --resource-id	Per-resource, including descendants. Listing a flow also surfaces changes to its exports, imports, and scripts.
Several values on --resource-type, --source, or --action, or any --resource pair	Multi-select query. Each filter OR-matches its own values, and filters are combined.

Flag	Type	Default	Meaning
--resource-type <types...>	string (repeatable)	—	Plural resource types: flows, connections, exports, imports, scripts, and so on. Several values OR-match and switch to the multi-select query.
--resource-id <id>	string	—	One specific resource. Paired with a single --resource-type, descendants are included.
--resource <pairs...>	string (repeatable)	—	Scope to specific resources as <type>:<id> pairs, for example connection:5f83a9b2c7d3e8f1a2b3c4d5. Use this to audit resources of different types in one query.
--user-id <id>	string	—	Filter by the user who made the change. Supported on the single-value query only, so it cannot be combined with multi-select filters.
--source <sources...>	string (repeatable)	—	One or more of ui, api, system, connector, script, stack, sso, cli, mcp, ora.
--action <actions...>	string (repeatable)	—	One or more actions, for example create, update, delete.
--field-path <path>	string	—	Restrict entries' fieldChanges to changes on one dot-path field (e.g. http.auth.token.token). Account-wide single-value query only; an unknown path simply matches nothing. Added in celigo-cli 2026.8.7.
--time-gte <iso>	ISO 8601	—	Return entries at or after this timestamp.
--time-lte <iso>	ISO 8601	—	Return entries at or before this timestamp.
--limit <n>	integer	100	Maximum number of entries to return.

The window flags were renamed in celigo-cli 2026.8.1. They were --start-date and --end-date. The new --time-gte and --time-lte match the date-bound naming used across the CLI and name the field they filter.

Examples

# Every change to a flow (and its descendants) in April
celigo audit list --resource-type flows --resource-id 5f83a9b2c7d3e8f1a2b3c4d5 \
  --time-gte 2026-04-01T00:00:00Z --time-lte 2026-04-30T23:59:59Z \
  --format table

# API-driven changes only, in the last 500 entries
celigo audit list --source api --limit 500

# Deletions from the UI or the API, across flows and connections
celigo audit list --resource-type flows connections --source ui api --action delete

# Three named resources of two different types
celigo audit list \
  --resource flow:5f83a9b2c7d3e8f1a2b3c4d5 \
  --resource connection:60a1b2c3d4e5f6a7b8c9d0e1 \
  --resource connection:60a1b2c3d4e5f6a7b8c9d0e2

# Everything one user did in a window
celigo audit list --user-id 60a1b2c3d4e5f6a7b8c9d0e1 \
  --time-gte 2026-04-01T00:00:00Z --time-lte 2026-04-24T23:59:59Z

# Who changed a connection token, account-wide
celigo audit list --field-path http.auth.token.token

Corresponds to: GET /v1/audit (account-wide), GET /v1/{resourceType}/{resourceId}/audit (per-resource, descendants included), or POST /v1/audit and POST /v1/{resourceType}/{resourceId}/audit (multi-select). The multi-select POST requests are read-only and work in a read-mode profile.

celigo audit download

Request a signed URL that delivers up to 20,000 audit entries as CSV. Three shapes:

1. Account-wide — omit --resource-type to download the full account log.
2. Per-resource — pass one --resource-type <type> together with --resource-id <id>[,<id>...], comma-separated for multiple IDs. Scope includes descendants.
3. Multi-select — pass several values on --resource-type, --source, or --action, or any --resource pair. The download covers the whole account, narrowed to the matching entries.

--resource-type on its own is rejected by the server with 422 Unprocessable Entity and the error code audit_not_supported. For a type-only filter, use multi-select or celigo audit list --resource-type <type>.

Shapes 2 and 3 cannot be combined. CSV export has no per-resource multi-select endpoint, so descendant scope and multi-value filters are mutually exclusive. Use audit list when you need both.

Flag	Type	Default	Meaning
--resource-type <types...>	string (repeatable)	—	Plural resource types. A single value requires --resource-id. Several values switch to a multi-select download.
--resource-id <ids>	string	—	One or more resource IDs, comma-separated for multiple.
--resource <pairs...>	string (repeatable)	—	Scope to specific resources as <type>:<id> pairs. Repeatable.
--user-id <id>	string	—	Filter by the user who made the change. Single-value query only.
--source <sources...>	string (repeatable)	—	One or more of ui, api, system, connector, script, stack, sso, cli, mcp, ora.
--action <actions...>	string (repeatable)	—	One or more actions, for example create, update, delete.
--time-gte <iso>	ISO 8601	—	Include entries at or after this timestamp.
--time-lte <iso>	ISO 8601	—	Include entries at or before this timestamp.

The window flags were renamed in celigo-cli 2026.8.1, from --start-date and --end-date to --time-gte and --time-lte.

Examples

# Signed URL for a single flow (and its descendants)
celigo audit download --resource-type flows --resource-id 5f83a9b2c7d3e8f1a2b3c4d5

# Signed URL for several connections at once
celigo audit download --resource-type connections \
  --resource-id 60a1b2c3d4e5f6a7b8c9d0e1,60a1b2c3d4e5f6a7b8c9d0e2

# Account-wide, narrowed to deletions on two resource types
celigo audit download --resource-type flows connections --action delete

# Signed URL for the full account log over a date range
celigo audit download --time-gte 2026-04-01T00:00:00Z --time-lte 2026-04-24T23:59:59Z

Corresponds to: GET /v1/audit/signedURL (account-wide) or POST /v1/{resourceType}/audit/signedURL (per-resource).

Gotchas

• A single --resource-type is invalid for download. The account-wide signed-URL endpoint rejects a type-only filter with 422 Unprocessable Entity and the error code audit_not_supported. Add --resource-id <id>[,<id>...], pass a second --resource-type value to switch to multi-select, or drop the flag.
• list with both --resource-type and --resource-id uses a different endpoint. The per-resource endpoint includes descendants, so listing a flow also surfaces changes to its exports, imports, and scripts. The account-wide endpoint does not expand descendants.
• Multi-select filters OR-match within a flag and AND-match across flags. --source ui api --action delete returns deletions made from the UI or the API. It does not return every UI action.
• --user-id cannot be combined with multi-select. It is supported on the single-value query only. To narrow by user across several resource types, run audit list per type, or filter the multi-select result with --jq.
• --field-path is account-wide single-value only. The API supports the field filter on neither the multi-select nor the per-resource query shapes, so the CLI rejects those combinations. An unknown path is not an error — it simply matches nothing.
• cli, mcp, and ora are audit sources too. Changes made through this CLI land with source: cli, so you can audit what automation did versus the UI: celigo audit list --source cli.
• download returns a signed URL, not the CSV. Fetch the URL separately, for example with curl, to retrieve the file. Each download is capped at 20,000 rows.
• Audit listings are never field-projected. Every entry comes back complete, so the field projection applied to other list commands does not apply here.
• Dates are ISO 8601. Use full timestamps such as 2026-04-24T00:00:00Z. Date-only strings may be interpreted inconsistently.

Related

• jobs — operational history of flow runs (distinct from audit, which tracks configuration changes).
• workspace-users — resolve --user-id values to names and emails.