REST API to return a subset of the audited events

See the OCSF Schema Overview for more information on the schema, and OCSF Class Events for more information on event classification. Also, check out this blog on how to use the Audit Trail API.

SecuritybearerAuth
Request
path Parameters
orgUuid
required
string <uuid>

The organization uuid

Example: 123e4567-e89b-12d3-a456-426614174000
query Parameters
date
required
string <date>

The date of the event

Example: date=2021-01-01
cursor
string

The identifier of an OCSF event from the last batch of events, indicating that the next set of events must have identifiers greater than cursor

Example: cursor=6672200dd10935351f936399
limit
integer <int32>

The number of events to return, with a maximum of 500

Example: limit=10
header Parameters
ax-organization-uuid
string <uuid>

The organization uuid

Example: 123e4567-e89b-12d3-a456-426614174000
Responses
200

The filled OCSF schema for the corresponding Automox event

400

Bad Request

401

Access token is missing or invalid

403

You do not have permission to perform this action.

404

Entity not found

429

Too many requests

503

Service Unavailable

get/audit-service/v1/orgs/{orgUuid}/events
Request samples 
$apiKey = 'your_automox_api_key'
$axOrgUUID = 'your_automox_organization_uuid'
$headers = @{
  "Authorization" = "Bearer $apiKey"
  "Content-Type" = "application/json"
  "x-ax-organization-uuid" = "$axOrgUUID"
  }
$url = "https://console.automox.com/audit-service/v1/orgs/{orgUuid}/events"
$response = (Invoke-WebRequest -Method Get -Uri $url -Headers $headers).Content
Response samples
application/json
[
  • {
    • "_id": {
      • "$oid": "6669d991ba9a2536b8158f17"
      },
    • "activity": "Logon",
    • "activity_id": 99,
    • "category_uid": 3,
    • "class_uid": 3002,
    • "count": 1,
    • "message": "User Log In Success",
    • "metadata": {
      • "tenant_uid": "7ee9f975-6cb7-44e9-afc3-3adbece95d74",
      • "uid": "9f8896c3-e042-42de-ae41-eaef8a2a667b",
      • "correlation_uid": "e92ae537-ea35-42d9-b6d4-92335f91a3db",
      • "product": {
        • "version": "1.0.0-dev",
        • "vendor_name": "Automox"
        },
      • "version": "1.1.0"
      },
    • "severity": "Informational",
    • "severity_id": 1,
    • "status": "Other",
    • "status_code": 200,
    • "status_id": 1,
    • "time": 1718213009419,
    • "timezone_offset": 0,
    • "type_name": "Authentication: Logon",
    • "type_uid": 300201,
    • "actor": {
      • "user": {
        • "email_addr": "readonly@mailinator.com",
        • "org": {
          • "uid": "e92ae537-ea35-42d9-b6d4-92335f91a3db",
          • "name": "Automation Testing Zone"
          },
        • "uid": "21968d73-38b9-4c55-8b10-a854a5fa6a36"
        }
      },
    • "user": {
      • "uid": "115998",
      • "email_addr": "readonly@mailinator.com"
      },
    • "auth_protocol_id": 99,
    • "logon_type_id": 99,
    • "status_details": "success"
    }
]