Help getting audit logs via API

[Sail_addict (Yuval Dayan)]

@daniel.labarre

but the API would surface up to 1 year of data. We’re also evaluating a timeframe or an enhancement that will allow up to 7 years of audit data via the Search API

Can I get more details about getting audit logs via API?
An example of how to send the request will be great.

Thank.

[atarodia (Animesh Tarodia)]

Hi @Sail_addict,

Thank you for posting and welcome to SailPoint Developer Forum.

You can use V3 Search APIs to get the Audit logs.

For Example,

If you require all events:

{
 "indices": [
 "events"
 ],
 "queryType": "SAILPOINT",
 "queryVersion": "5.2",
 "query": {
 "query": "type:*"
 }
}

Similarly, you can change the query to satisfy your requirements (adding some more examples below):
For Authentication History → type:auth
For Access Requests → type:access_request
For Provisioning Activity → type:provisioning
For Password Activity → type:password_activity

[Sail_addict (Yuval Dayan)]

Is it possible to filter by certain dates? from date1 to date 2?

[atarodia (Animesh Tarodia)]

Hi @Sail_addict, you just need to add “created” condition.

Example:

type:* AND created:[2023-07-20 TO 2023-07-26]