> For the complete documentation index, see [llms.txt](https://developer.celigo.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.celigo.com/cli/commands/audit.md). # audit Query the account's change-tracking log — who changed which resource, when, and from where. **REST API**: [Audit Logs](https://developer.celigo.com/api/api-reference/monitoring/audit-logs) ``` celigo audit [flags] ``` ## Subcommands | Command | Purpose | | ---------- | ----------------------------------------------------------------- | | `list` | List audit log entries. | | `download` | Get a signed URL to download audit entries as CSV (max 20k rows). | ## `celigo audit list` List audit log entries, optionally filtered by resource, user, source, action, and time window. `list` chooses one of three endpoints from the filters you pass: | Filters | Endpoint and scope | | ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- | | No resource filter | Account-wide. | | One `--resource-type` plus `--resource-id` | Per-resource, including descendants. Listing a flow also surfaces changes to its exports, imports, and scripts. | | Several values on `--resource-type`, `--source`, or `--action`, or any `--resource` pair | Multi-select query. Each filter OR-matches its own values, and filters are combined. | | Flag | Type | Default | Meaning | | ---------------------------- | ------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `--resource-type ` | string (repeatable) | — | Plural resource types: `flows`, `connections`, `exports`, `imports`, `scripts`, and so on. Several values OR-match and switch to the multi-select query. | | `--resource-id ` | string | — | One specific resource. Paired with a single `--resource-type`, descendants are included. | | `--resource ` | string (repeatable) | — | Scope to specific resources as `:` pairs, for example `connection:5f83a9b2c7d3e8f1a2b3c4d5`. Use this to audit resources of different types in one query. | | `--user-id ` | string | — | Filter by the user who made the change. Supported on the single-value query only, so it cannot be combined with multi-select filters. | | `--source ` | string (repeatable) | — | One or more of `ui`, `api`, `system`, `connector`, `script`, `stack`, `sso`, `cli`, `mcp`, `ora`. | | `--action ` | string (repeatable) | — | One or more actions, for example `create`, `update`, `delete`. | | `--field-path ` | string | — | Restrict entries' `fieldChanges` to changes on one dot-path field (e.g. `http.auth.token.token`). Account-wide single-value query only; an unknown path simply matches nothing. Added in celigo-cli 2026.8.7. | | `--time-gte ` | ISO 8601 | — | Return entries at or after this timestamp. | | `--time-lte ` | ISO 8601 | — | Return entries at or before this timestamp. | | `--limit ` | integer | `100` | Maximum number of entries to return. | > **The window flags were renamed in celigo-cli 2026.8.1.** They were `--start-date` and `--end-date`. The new `--time-gte` and `--time-lte` match the date-bound naming used across the CLI and name the field they filter. ### Examples ```bash # Every change to a flow (and its descendants) in April celigo audit list --resource-type flows --resource-id 5f83a9b2c7d3e8f1a2b3c4d5 \ --time-gte 2026-04-01T00:00:00Z --time-lte 2026-04-30T23:59:59Z \ --format table # API-driven changes only, in the last 500 entries celigo audit list --source api --limit 500 # Deletions from the UI or the API, across flows and connections celigo audit list --resource-type flows connections --source ui api --action delete # Three named resources of two different types celigo audit list \ --resource flow:5f83a9b2c7d3e8f1a2b3c4d5 \ --resource connection:60a1b2c3d4e5f6a7b8c9d0e1 \ --resource connection:60a1b2c3d4e5f6a7b8c9d0e2 # Everything one user did in a window celigo audit list --user-id 60a1b2c3d4e5f6a7b8c9d0e1 \ --time-gte 2026-04-01T00:00:00Z --time-lte 2026-04-24T23:59:59Z # Who changed a connection token, account-wide celigo audit list --field-path http.auth.token.token ``` **Corresponds to**: [`GET /v1/audit`](https://developer.celigo.com/api/api-reference/monitoring/audit-logs#get-v1-audit) (account-wide), `GET /v1/{resourceType}/{resourceId}/audit` (per-resource, descendants included), or `POST /v1/audit` and `POST /v1/{resourceType}/{resourceId}/audit` (multi-select). The multi-select `POST` requests are read-only and work in a `read`-mode profile. ## `celigo audit download` Request a signed URL that delivers up to 20,000 audit entries as CSV. Three shapes: 1. **Account-wide** — omit `--resource-type` to download the full account log. 2. **Per-resource** — pass one `--resource-type ` together with `--resource-id [,...]`, comma-separated for multiple IDs. Scope includes descendants. 3. **Multi-select** — pass several values on `--resource-type`, `--source`, or `--action`, or any `--resource` pair. The download covers the whole account, narrowed to the matching entries. `--resource-type` on its own is rejected by the server with `422 Unprocessable Entity` and the error code `audit_not_supported`. For a type-only filter, use multi-select or `celigo audit list --resource-type `. Shapes 2 and 3 cannot be combined. CSV export has no per-resource multi-select endpoint, so descendant scope and multi-value filters are mutually exclusive. Use `audit list` when you need both. | Flag | Type | Default | Meaning | | ---------------------------- | ------------------- | ------- | ----------------------------------------------------------------------------------------------------------------- | | `--resource-type ` | string (repeatable) | — | Plural resource types. A single value requires `--resource-id`. Several values switch to a multi-select download. | | `--resource-id ` | string | — | One or more resource IDs, comma-separated for multiple. | | `--resource ` | string (repeatable) | — | Scope to specific resources as `:` pairs. Repeatable. | | `--user-id ` | string | — | Filter by the user who made the change. Single-value query only. | | `--source ` | string (repeatable) | — | One or more of `ui`, `api`, `system`, `connector`, `script`, `stack`, `sso`, `cli`, `mcp`, `ora`. | | `--action ` | string (repeatable) | — | One or more actions, for example `create`, `update`, `delete`. | | `--time-gte ` | ISO 8601 | — | Include entries at or after this timestamp. | | `--time-lte ` | ISO 8601 | — | Include entries at or before this timestamp. | > **The window flags were renamed in celigo-cli 2026.8.1**, from `--start-date` and `--end-date` to `--time-gte` and `--time-lte`. ### Examples ```bash # Signed URL for a single flow (and its descendants) celigo audit download --resource-type flows --resource-id 5f83a9b2c7d3e8f1a2b3c4d5 # Signed URL for several connections at once celigo audit download --resource-type connections \ --resource-id 60a1b2c3d4e5f6a7b8c9d0e1,60a1b2c3d4e5f6a7b8c9d0e2 # Account-wide, narrowed to deletions on two resource types celigo audit download --resource-type flows connections --action delete # Signed URL for the full account log over a date range celigo audit download --time-gte 2026-04-01T00:00:00Z --time-lte 2026-04-24T23:59:59Z ``` **Corresponds to**: [`GET /v1/audit/signedURL`](https://developer.celigo.com/api/api-reference/monitoring/audit-logs#get-v1-audit-signedurl) (account-wide) or `POST /v1/{resourceType}/audit/signedURL` (per-resource). ## Gotchas * **A single `--resource-type` is invalid for `download`.** The account-wide signed-URL endpoint rejects a type-only filter with `422 Unprocessable Entity` and the error code `audit_not_supported`. Add `--resource-id [,...]`, pass a second `--resource-type` value to switch to multi-select, or drop the flag. * **`list` with both `--resource-type` and `--resource-id` uses a different endpoint.** The per-resource endpoint includes descendants, so listing a flow also surfaces changes to its exports, imports, and scripts. The account-wide endpoint does not expand descendants. * **Multi-select filters OR-match within a flag and AND-match across flags.** `--source ui api --action delete` returns deletions made from the UI or the API. It does not return every UI action. * **`--user-id` cannot be combined with multi-select.** It is supported on the single-value query only. To narrow by user across several resource types, run `audit list` per type, or filter the multi-select result with `--jq`. * **`--field-path` is account-wide single-value only.** The API supports the field filter on neither the multi-select nor the per-resource query shapes, so the CLI rejects those combinations. An unknown path is not an error — it simply matches nothing. * **`cli`, `mcp`, and `ora` are audit sources too.** Changes made through this CLI land with `source: cli`, so you can audit what automation did versus the UI: `celigo audit list --source cli`. * **`download` returns a signed URL, not the CSV.** Fetch the URL separately, for example with `curl`, to retrieve the file. Each download is capped at 20,000 rows. * **Audit listings are never field-projected.** Every entry comes back complete, so the [field projection](/cli/getting-started/global-flags.md) applied to other `list` commands does not apply here. * **Dates are ISO 8601.** Use full timestamps such as `2026-04-24T00:00:00Z`. Date-only strings may be interpreted inconsistently. ## Related * [jobs](/cli/commands/jobs.md) — operational history of flow runs (distinct from audit, which tracks configuration changes). * [workspace-users](/cli/commands/workspace-users.md) — resolve `--user-id` values to names and emails.