I have a delimited files source, where LCM actions are performed via API by an external solution.
The thing is that when I go to access history, I can view the account history, but it doesn’t tell me who performed the actions.
How can I search for this information? This is very important for auditing.
In the search tab, event logs include fields such as ‘Target’ and ‘Actor’, which provide basic information like whether the user is an admin or external.
What is the value shown in this case?
For example:
I created this source and create this account by api:
when i go to the access history, i see account history, but this history dont include who made this action:
In the search, i cant find these details
In delimited file sources, if LCM actions are triggered via API, the actor (who performed the action) is only tracked if it’s included in the API call.
To see who performed the action, check the LCM request object via Search API using type:"access-request" and filter by identity or time.
Look for the requestedBy or createdBy field — this shows who submitted the request.
If the API calls are made with a service account (e.g. via PAT), you’ll only see that account unless the API payload explicitly sets the requestedBy field.
For auditing, ensure external systems include that context in API calls.
This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.