> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/cli/commands/audit.md). # audit Query the account's change-tracking log — who changed which resource, when, and from where. **REST API**: [Audit Logs](https://developer.celigo.com/api/api-reference/audit-logs) ``` celigo audit [flags] ``` ## Subcommands | Command | Purpose | | ---------- | ----------------------------------------------------------------- | | `list` | List audit log entries. | | `download` | Get a signed URL to download audit entries as CSV (max 20k rows). | ## `celigo audit list` List audit log entries, optionally filtered by resource, user, source, action, and time window. `list` chooses one of three endpoints from the filters you pass: | Filters | Endpoint and scope | | ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | | No resource filter | Account-wide. | | One `--resource-type` plus `--resource-id` | Per-resource, including descendants. Listing a flow also surfaces changes to its exports, imports, and scripts. | | Several values on `--resource-type`, `--source`, or `--action`, or any `--resource` pair | Multi-select query. Each filter OR-matches its own values, and filters are combined. | | Flag | Type | Default | Meaning | | ---------------------------- | ------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--resource-type ` | string (repeatable) | — | Plural resource types: `flows`, `connections`, `exports`, `imports`, `scripts`, and so on. Several values OR-match and switch to the multi-select query. | | `--resource-id ` | string | — | One specific resource. Paired with a single `--resource-type`, descendants are included. | | `--resource ` | string (repeatable) | — | Scope to specific resources as `:` pairs, for example `connection:5f83a9b2c7d3e8f1a2b3c4d5`. Use this to audit resources of different types in one query. | | `--user-id ` | string | — | Filter by the user who made the change. Supported on the single-value query only, so it cannot be combined with multi-select filters. | | `--source ` | string (repeatable) | — | One or more of `ui`, `api`, `system`, `connector`, `script`, `stack`, `sso`, `cli`, `mcp`, `ora`. | | `--action ` | string (repeatable) | — | One or more actions, for example `create`, `update`, `delete`. | | `--field-path ` | string | — | Restrict entries' `fieldChanges` to changes on one dot-path field (e.g. `http.auth.token.token`). Account-wide single-value query only; an unknown path simply matches nothing. Added in celigo-cli 2026.8.7. | | `--time-gte ` | ISO 8601 | — | Return entries at or after this timestamp. | | `--time-lte ` | ISO 8601 | — | Return entries at or before this timestamp. | | `--limit ` | integer | `100` | Maximum number of entries to return. | > **The window flags were renamed in celigo-cli 2026.8.1.** They were `--start-date` and `--end-date`. The new `--time-gte` and `--time-lte` match the date-bound naming used across the CLI and name the field they filter. ### Examples ```bash # Every change to a flow (and its descendants) in April celigo audit list --resource-type flows --resource-id 5f83a9b2c7d3e8f1a2b3c4d5 \ --time-gte 2026-04-01T00:00:00Z --time-lte 2026-04-30T23:59:59Z \ --format table # API-driven changes only, in the last 500 entries celigo audit list --source api --limit 500 # Deletions from the UI or the API, across flows and connections celigo audit list --resource-type flows connections --source ui api --action delete # Three named resources of two different types celigo audit list \ --resource flow:5f83a9b2c7d3e8f1a2b3c4d5 \ --resource connection:60a1b2c3d4e5f6a7b8c9d0e1 \ --resource connection:60a1b2c3d4e5f6a7b8c9d0e2 # Everything one user did in a window celigo audit list --user-id 60a1b2c3d4e5f6a7b8c9d0e1 \ --time-gte 2026-04-01T00:00:00Z --time-lte 2026-04-24T23:59:59Z # Who changed a connection token, account-wide celigo audit list --field-path http.auth.token.token ``` **Corresponds to**: [`GET /v1/audit`](https://developer.celigo.com/api/api-reference/audit-logs#get-v1-audit) (account-wide), `GET /v1/{resourceType}/{resourceId}/audit` (per-resource, descendants included), or `POST /v1/audit` and `POST /v1/{resourceType}/{resourceId}/audit` (multi-select). The multi-select `POST` requests are read-only and work in a `read`-mode profile. ## `celigo audit download` Request a signed URL that delivers up to 20,000 audit entries as CSV. Three shapes: 1. **Account-wide** — omit `--resource-type` to download the full account log. 2. **Per-resource** — pass one `--resource-type ` together with `--resource-id [,...]`, comma-separated for multiple IDs. Scope includes descendants. 3. **Multi-select** — pass several values on `--resource-type`, `--source`, or `--action`, or any `--resource` pair. The download covers the whole account, narrowed to the matching entries. `--resource-type` on its own is rejected by the server with `422 Unprocessable Entity` and the error code `audit_not_supported`. For a type-only filter, use multi-select or `celigo audit list --resource-type `. Shapes 2 and 3 cannot be combined. CSV export has no per-resource multi-select endpoint, so descendant scope and multi-value filters are mutually exclusive. Use `audit list` when you need both. | Flag | Type | Default | Meaning | | ---------------------------- | ------------------- | ------- | ----------------------------------------------------------------------------------------------------------------- | | `--resource-type ` | string (repeatable) | — | Plural resource types. A single value requires `--resource-id`. Several values switch to a multi-select download. | | `--resource-id ` | string | — | One or more resource IDs, comma-separated for multiple. | | `--resource ` | string (repeatable) | — | Scope to specific resources as `:` pairs. Repeatable. | | `--user-id ` | string | — | Filter by the user who made the change. Single-value query only. | | `--source ` | string (repeatable) | — | One or more of `ui`, `api`, `system`, `connector`, `script`, `stack`, `sso`, `cli`, `mcp`, `ora`. | | `--action ` | string (repeatable) | — | One or more actions, for example `create`, `update`, `delete`. | | `--time-gte ` | ISO 8601 | — | Include entries at or after this timestamp. | | `--time-lte ` | ISO 8601 | — | Include entries at or before this timestamp. | > **The window flags were renamed in celigo-cli 2026.8.1**, from `--start-date` and `--end-date` to `--time-gte` and `--time-lte`. ### Examples ```bash # Signed URL for a single flow (and its descendants) celigo audit download --resource-type flows --resource-id 5f83a9b2c7d3e8f1a2b3c4d5 # Signed URL for several connections at once celigo audit download --resource-type connections \ --resource-id 60a1b2c3d4e5f6a7b8c9d0e1,60a1b2c3d4e5f6a7b8c9d0e2 # Account-wide, narrowed to deletions on two resource types celigo audit download --resource-type flows connections --action delete # Signed URL for the full account log over a date range celigo audit download --time-gte 2026-04-01T00:00:00Z --time-lte 2026-04-24T23:59:59Z ``` **Corresponds to**: [`GET /v1/audit/signedURL`](https://developer.celigo.com/api/api-reference/audit-logs#get-v1-audit-signedurl) (account-wide) or `POST /v1/{resourceType}/audit/signedURL` (per-resource). ## Gotchas * **A single `--resource-type` is invalid for `download`.** The account-wide signed-URL endpoint rejects a type-only filter with `422 Unprocessable Entity` and the error code `audit_not_supported`. Add `--resource-id [,...]`, pass a second `--resource-type` value to switch to multi-select, or drop the flag. * **`list` with both `--resource-type` and `--resource-id` uses a different endpoint.** The per-resource endpoint includes descendants, so listing a flow also surfaces changes to its exports, imports, and scripts. The account-wide endpoint does not expand descendants. * **Multi-select filters OR-match within a flag and AND-match across flags.** `--source ui api --action delete` returns deletions made from the UI or the API. It does not return every UI action. * **`--user-id` cannot be combined with multi-select.** It is supported on the single-value query only. To narrow by user across several resource types, run `audit list` per type, or filter the multi-select result with `--jq`. * **`--field-path` is account-wide single-value only.** The API supports the field filter on neither the multi-select nor the per-resource query shapes, so the CLI rejects those combinations. An unknown path is not an error — it simply matches nothing. * **`cli`, `mcp`, and `ora` are audit sources too.** Changes made through this CLI land with `source: cli`, so you can audit what automation did versus the UI: `celigo audit list --source cli`. * **`download` returns a signed URL, not the CSV.** Fetch the URL separately, for example with `curl`, to retrieve the file. Each download is capped at 20,000 rows. * **Audit listings are never field-projected.** Every entry comes back complete, so the [field projection](/cli/getting-started/global-flags.md) applied to other `list` commands does not apply here. * **Dates are ISO 8601.** Use full timestamps such as `2026-04-24T00:00:00Z`. Date-only strings may be interpreted inconsistently. ## Related * [jobs](/cli/commands/jobs.md) — operational history of flow runs (distinct from audit, which tracks configuration changes). * [workspace-users](/cli/commands/workspace-users.md) — resolve `--user-id` values to names and emails. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://developer.celigo.com/cli/commands/audit.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.