View & Export the User Audit Trail

When exporting audit trail data, any time range can be specified; however, the API will only return the most recent 50,000 results. If this limit is reached for a particular time frame, the remainder of the data can be obtained by making another API request. See step 15 in the Export the User Audit Trail section below for more details.

For details on the events captured in the audit trail, see the User Audit Trail Events & Filters article.

Recent events will appear in the audit trail after a few minutes of processing time.

View the User Audit Trail

To view the User Audit Trail:

  1. Review the list of important notes in the User Audit Trail Overview article.
  2. Click the  icon in the top bar > User Audit Trail in the Tools section.
  3. If required, apply one or more filters to narrow down the data.
  4. Optional: Click the numbers or icons at the top-right to scroll through additional pages.
  5. Click the  icon at the top-right to refresh the data.
  6. Click an event to display additional details in a palette.The User Audit Trail

Export the User Audit Trail

To export the User Audit Trail:

  1. Review the list of important notes in the User Audit Trail Overview article.
  2. Click the  icon in the top bar > Swagger Docs in the Tools section.
  3. Click auditTrail to open the Swagger interface.
  4. Click POST /audit/user/export (Export User Audit Trail Data) to expand it.
    The POST /audit/user/export endpoint.
  5. Click the Example Value textbox in the Parameters section to populate the body textbox.
    The expanded POST /audit/user/export endpoint.
  6. Delete the beside the dateStart attribute in the body textbox, then enter a start date for the audit trail data using Unix timestamp format. Repeat the process to enter an end date for the dateEnd attribute.
    The body textbox.
  7. Click Try it out!
  8. Copy the string from the Response Body section to your clipboard. This is the job ID.The Response Body section.
  9. Scroll down and click job to expand it.
  10. Click GET /object/job/{id} (Poll for status of job) to expand it.
  11. Paste the job ID collected from step 8 above into the id field.
    The expanded GET /object/job/{id} endpoint.
  12. Click Try it out!
  13. Copy the URL beside signedURL in the Response Body section to your clipboard.The Response Body section.
  14. Open a new tab in your browser and paste the URL in the address bar to begin downloading the CSV file. Up to 50k records are returned per file.
    Exported User Audit Trail Data
  15. To export more than 50k records within the selected time frame:
    1. Review the last row of the CSV file to confirm it contains a maximum of 50k rows, which likely means additional data can be retrieved.
    2. Convert the date in the Date and Time column for the last row to Unix timestamp format.
    3. Follow the steps above to make a new API request using the Unix timestamp from step b. as the new dateEnd value but keeping the dateStart the same.
    4. Continue the process until fewer than 50k rows are retrieved. Note that because multiple events can occur at the same time, some rows may share the same Date and Time value. This means that if the oldest event (last row on the CSV file) occurred on the same date as other events in the next batch of data, all these events will be repeated in the next generated CSV file.