Iru

Iru Audit API

The Audit API from Iru — 1 operation(s) for audit.

Documentation GitHub OpenAPI

Operations 1

GET /api/v1/audit/events List audit events

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/kandji-audit-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Iru Endpoint Management Audit API
  description: "# Welcome to the Iru Endpoint Management API Documentation\n\n**Note:** Kandji is in the process of changing to Iru. Many URLs and notes within this documentation will continue to reference Kandji for some time.\n\nYou can find your API URL in Settings > Access. The API URL will follow the below formats.\n\n- US - `https://SubDomain.api.kandji.io`\n    \n- EU - `https://SubDomain.api.eu.kandji.io`\n    \n\nFor information on how to obtain an API token, please refer to the Iru docs.\n\n[https://docs.iru.com/](https://docs.iru.com/)\n\n#### Rate Limit\n\nThe Iru Endpoint Management API currently has an API rate limit of 10,000 requests per hour per customer.\n\n#### Request Methods\n\nHTTP request methods supported by the API.\n\n| Method | Definition |\n| --- | --- |\n| GET | The `GET` method requests a representation of the specified resource. |\n| POST | The `POST` method submits an entity to the specified resource. |\n| PATCH | The `PATCH` method applies partial modifications to a resource. |\n| DELETE | The `DELETE` method deletes the specified resource. |\n\n#### Response codes\n\nNot all response codes apply to every endpoint.\n\n| Code | Response |\n| --- | --- |\n| 200 | OK |\n| 201 | Created |\n| 204 | No content |\n|  | Typical response when sending the DELETE method. |\n| 400 | Bad Request |\n|  | \"Command already running\" - The command may already be running in a _Pending_ state waiting on the device. |\n|  | \"Command is not allowed for current device\" - The command may not be compatible with the target device. |\n|  | \"JSON parse error - Expecting ',' delimiter: line 3 column 2 (char 65)\" |\n| 401 | Unauthorized |\n|  | This error can occur if the token is incorrect, was revoked, or the token has expired. |\n| 403 | Forbidden |\n|  | The request was understood but cannot be authorized. |\n| 404 | Not found |\n|  | Unable to locate the resource in the Iru tenant. |\n| 415 | Unsupported Media Type |\n|  | The request contains a media type which the server or resource does not support. |\n| 500 | Internal server error |\n| 503 | Service unavailable |\n|  | This error can occur if a file upload is still being processed via the custom apps API. |\n\n#### Data structure\n\nThe API returns all structured responses in JSON schema format.\n\n#### Examples\n\nCode examples using the API can be found in the Iru Endpoint Management support [GitHub](https://github.com/kandji-inc/support/tree/main/api-tools)."
  version: 1.0.0
servers:
- url: https://{subdomain}.api.kandji.io
  description: US Server
  variables:
    subdomain:
      default: your-subdomain
      description: Your Iru Endpoint Management subdomain
- url: https://{subdomain}.api.eu.kandji.io
  description: EU Server
  variables:
    subdomain:
      default: your-subdomain
      description: Your Iru Endpoint Management subdomain
security:
- BearerAuth: []
tags:
- name: Audit
paths:
  /api/v1/audit/events:
    get:
      summary: List audit events
      description: This request returns audit log events from the Kandji Activity module.
      parameters:
      - name: limit
        in: query
        required: false
        description: A max upper `limit` is set at 500 records returned per request. Pagination should be used using the cursor in the `next` key to request more results. Additionally, parameter queries can be added to a request to filter the results.
        schema:
          type: string
      - name: sort_by
        in: query
        required: false
        description: Sort results by `occurred_at`, `id` either ascending (default behavior) or descending(-) order.
        schema:
          type: string
      - name: start_date
        in: query
        required: false
        description: Filter by start date in datetime or year-month-day (2024-11-26) formats
        schema:
          type: string
      - name: end_date
        in: query
        required: false
        description: Filter by end date in datetime or year-month-day (2024-12-06) formats
        schema:
          type: string
      - name: cursor
        in: query
        required: false
        description: You can pass the next cursor as a parameter or use the URL in the next key to get the next page of results or to start from where you left off last.
        schema:
          type: string
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                type: object
                example:
                  results:
                  - id: 01JNGZW47KZKPXE1JWCFE4PHDW
                    action: update
                    occurred_at: '2025-03-04T16:29:55.253454Z'
                    actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5
                    actor_type: user
                    target_id: 449ec92a-186a-44f2-9421-d5ac6e465eb5
                    target_type: blueprint
                    target_component: library_items
                    new_state:
                      library_items_added:
                      - id: c7a5871a-1683-432f-87d4-30bbd404eb85
                        name: GitHub
                      - id: 6c3c34cf-36c4-4812-bd3f-712d66458c80
                        name: Apple Configurator
                      library_items_removed: []
                      library_items_scoped:
                      - id: 6c3c34cf-36c4-4812-bd3f-712d66458c80
                        name: Apple Configurator
                      - id: c7a5871a-1683-432f-87d4-30bbd404eb85
                        name: GitHub
                      - id: 1af36ec2-111d-4ec4-bc3b-170facf1408b
                        name: Apple Developer
                      name: demo
                    metadata: {}
                  - id: 01JNGZWQ7WAN45PVTJ3686TXHT
                    action: create
                    occurred_at: '2025-03-04T16:30:14.143192Z'
                    actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5
                    actor_type: user
                    target_id: 2b1fd766-3ba4-49ba-9f88-8219d468b34c
                    target_type: blueprint
                    target_component: ''
                    new_state:
                      description: ''
                      type: map
                      name: audit_event_test
                    metadata:
                      source_id: null
                      source: null
                  - id: 01JNGZWQ7W0C1TD9MZAP6XSEGH
                    action: update
                    occurred_at: '2025-03-04T16:30:14.214831Z'
                    actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5
                    actor_type: user
                    target_id: 2b1fd766-3ba4-49ba-9f88-8219d468b34c
                    target_type: blueprint
                    target_component: parameters
                    new_state:
                      parameters: []
                      name: audit_event_test
                    metadata: {}
                  - id: 01JNGZX031XXXWS574PMJE5E52
                    action: update
                    occurred_at: '2025-03-04T16:30:23.535596Z'
                    actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5
                    actor_type: user
                    target_id: 2b1fd766-3ba4-49ba-9f88-8219d468b34c
                    target_type: blueprint
                    target_component: library_items
                    new_state:
                      library_items_added:
                      - id: d8a6b20f-9b7a-4af7-9ecb-1c7104116ca8
                        name: homebrew
                      library_items_removed: []
                      library_items_scoped:
                      - id: d8a6b20f-9b7a-4af7-9ecb-1c7104116ca8
                        name: homebrew
                      name: audit_event_test
                    metadata: {}
                  - id: 01JNM1393ZTW3JAPWPRTVNH1JM
                    action: update
                    occurred_at: '2025-03-05T20:49:01.319307Z'
                    actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5
                    actor_type: user
                    target_id: 07194cf3-10c1-4b39-aa2b-763133b0347d
                    target_type: library_item
                    target_component: ''
                    new_state:
                      active: false
                      label: null
                      type: vpp-app
                      name: 'Pocket Casts: Podcast Player'
                    metadata: {}
                  - id: 01JNM149BA16F2W42VVFP44VD0
                    action: update
                    occurred_at: '2025-03-05T20:49:33.901017Z'
                    actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5
                    actor_type: user
                    target_id: 7a488f5a-082b-4039-8e11-9b92985300c4
                    target_type: blueprint
                    target_component: library_items
                    new_state:
                      library_items_added:
                      - id: 07194cf3-10c1-4b39-aa2b-763133b0347d
                        name: 'Pocket Casts: Podcast Player'
                      library_items_removed: []
                      library_items_scoped:
                      - id: c0af8f59-8d96-49e3-a66b-80639bc43eac
                        name: accuhive_wifi
                      - id: 4418f6fa-0761-460f-b98d-c037f44ffad0
                        name: Iru Self Service
                      - id: 92a8be7b-dc71-41f5-be27-138769080850
                        name: default skip
                      - id: 07194cf3-10c1-4b39-aa2b-763133b0347d
                        name: 'Pocket Casts: Podcast Player'
                      name: _ipados_testing_2
                    metadata: {}
                  - id: 01JNM1498JPRMZN6737HP4M2PT
                    action: update
                    occurred_at: '2025-03-05T20:49:34.008256Z'
                    actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5
                    actor_type: user
                    target_id: 9b1ce867-83dd-46bb-b79a-ba2b5c3a4acc
                    target_type: blueprint
                    target_component: library_items
                    new_state:
                      library_items_added:
                      - id: 07194cf3-10c1-4b39-aa2b-763133b0347d
                        name: 'Pocket Casts: Podcast Player'
                      library_items_removed: []
                      library_items_scoped:
                      - id: 3e2a8bd2-45a3-43e4-a1e6-7296a83abf65
                        name: agent_debug_logging
                      - id: cc2e2e17-e046-4405-ba46-1c39790a69a0
                        name: 1Password 7
                      - id: 3eb5836a-c856-47a6-8614-0da2624e8577
                        name: audit test
                      - id: 07956063-476a-4c53-9fec-1686a5b9ec5b
                        name: wb
                      - id: 03ece026-6d91-4616-a9de-c77c23a32555
                        name: wallpaper
                      - id: 3ad11b1e-42fb-4405-b826-c9cdf6061e7e
                        name: pppc_finder
                      - id: 814351ef-d9ee-4ebe-bf3e-5fb6cc3086bc
                        name: Microsoft Company Portal
                      - id: 07194cf3-10c1-4b39-aa2b-763133b0347d
                        name: 'Pocket Casts: Podcast Player'
                      - id: 764706a2-f934-4808-85a4-7763d89327f4
                        name: brooklyn_screensaver
                      - id: 24eb6c93-27d7-40a0-9092-d29e9d53a0ef
                        name: Okta Verify
                      name: _testing_something
                    metadata: {}
                  - id: 01JNM149BEX9ZK8YX7FVGARH4C
                    action: update
                    occurred_at: '2025-03-05T20:49:34.064939Z'
                    actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5
                    actor_type: user
                    target_id: ac4aba12-d2e5-430a-b7aa-42d25f9e6ead
                    target_type: blueprint
                    target_component: library_items
                    new_state:
                      library_items_added:
                      - id: 07194cf3-10c1-4b39-aa2b-763133b0347d
                        name: 'Pocket Casts: Podcast Player'
                      library_items_removed: []
                      library_items_scoped:
                      - id: 92a8be7b-dc71-41f5-be27-138769080850
                        name: default skip
                      - id: f0c99039-355e-4793-8b6f-7b55d9e8b77c
                        name: microsoft_sso_extension_mobile
                      - id: 07194cf3-10c1-4b39-aa2b-763133b0347d
                        name: 'Pocket Casts: Podcast Player'
                      - id: c0af8f59-8d96-49e3-a66b-80639bc43eac
                        name: accuhive_wifi
                      - id: 4418f6fa-0761-460f-b98d-c037f44ffad0
                        name: Iru Self Service
                      - id: 624cb961-0e69-4242-9cd1-3dffd3ca6830
                        name: Microsoft Authenticator
                      name: _ipados_testing
                    metadata: {}
                  - id: 01JNM149BE4W1KJ3J8WNPMKTH3
                    action: update
                    occurred_at: '2025-03-05T20:49:34.148395Z'
                    actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5
                    actor_type: user
                    target_id: 07194cf3-10c1-4b39-aa2b-763133b0347d
                    target_type: library_item
                    target_component: ''
                    new_state:
                      active: true
                      label: null
                      type: vpp-app
                      name: 'Pocket Casts: Podcast Player'
                    metadata: {}
                  - id: 01JNM15XZVZ64S00H7BAZKHE4A
                    action: update
                    occurred_at: '2025-03-05T20:50:28.090682Z'
                    actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5
                    actor_type: user
                    target_id: a0726ca3-717d-41b9-a3af-c7d0bad8b784
                    target_type: api_token
                    target_component: ''
                    new_state:
                      description: null
                      permissions:
                      - path: /api/v1/devices/{device_id}
                        http_method: PATCH
                      - path: /api/v1/users
                        http_method: GET
                      - path: /api/v1/users/{id}
                        http_method: GET
                      - path: /api/v1/users/{id}
                        http_method: DELETE
                      - path: /api/v1/audit/events
                        http_method: GET
                      label: audit log events
                    metadata: {}
                  previous: null
                  next: https://accuhive.api.kandji.io/api/v1/audit/events?limit=2&sort_by=-occurred_at&cursor=PmR0OjIwMjUtMDMtMTcgMjI6Mjk6MjUuMzAxMDkyKzAwOjAw
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Bad Request
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Unauthorized
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Not Found
      tags:
      - Audit
components:
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT