Need help finding Identity Event History

[Remold (Remold Krol)]

Hi Ryan,

Can you test the following?

import sailpoint.object.*;

Identity identity = context.getObjectByName(Identity.class,"1");

      QueryOptions qo2 = new QueryOptions();
      List targets = new ArrayList();
      targets.add((new AuditEvent((String)null, (String)null, identity)).getTarget());
      targets.add(identity.getId());
      targets.add(identity.getName());
      qo2.addFilter(Filter.in("target", targets));
      List actions = new ArrayList();
      actions.add("identityLifecycleEvent");
      actions.add("activate");
      actions.add("deactivate");
      qo2.addFilter(Filter.in("action", actions));
      qo2.addOrdering("created", false);
      List audits = this.context.getObjects(AuditEvent.class, qo2);
      if (null != audits) {
        Iterator var7 = audits.iterator();

        while(var7.hasNext()) {
          AuditEvent audit = (AuditEvent)var7.next();
          log.error("AuditEvent=" + audit.toXml());
        }
      }

Taken from the source code of IdentityIQ 8.3

This gives me:

AuditEvent=<?xml version='1.0' encoding='UTF-8'?> <!DOCTYPE AuditEvent PUBLIC "sailpoint.dtd" "sailpoint.dtd"> <AuditEvent action="identityLifecycleEvent" clientHost="x.x.x.x" created="1644333000175" id="7f0000017eb517626317ed9e265ef5660" interface="UI" serverHost="spiiq" source="spadmin" target="Identity:1"> <String1>Change Notification</String1> <String3>Launched workflow 'Change Notification: aad mos'</String3> <String4>Attribute 'type' changed from null to employee</String4> </AuditEvent>
Last update: 2023-11-14 00:31:49.317

Which is the same as:

I hope this is what you are looking for

– Remold