UiPath Audit Logs API

openapi: 3.2.0
info:
  title: UiPath Platform Management Audit Logs API
  description: The UiPath Platform Management API covers foundational platform administration resources including identity management, audit log access, and licensing operations.
  version: '2024.10'
  contact:
    name: UiPath Support
    url: https://support.uipath.com
  termsOfService: https://www.uipath.com/legal/terms-of-use
servers:
- url: https://cloud.uipath.com
  description: UiPath Automation Cloud Platform
security:
- bearerAuth: []
tags:
- name: Audit Logs
  description: Retrieve and download organization and tenant audit event logs
paths:
  /{organizationName}/orgaudit_/api/query/sources:
    get:
      operationId: getOrganizationAuditSources
      summary: UiPath Get Organization Audit Event Sources
      description: Retrieves metadata about available audit event sources at the organization level. Returns the list of services that generate audit events along with available event types and categories for use as filters in the query events endpoint. Requires the PM.Audit or PM.Audit.Read OAuth scope.
      tags:
      - Audit Logs
      parameters:
      - $ref: '#/components/parameters/organizationName'
        example: example-value
      responses:
        '200':
          description: Available organization audit event sources
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditSources'
              examples:
                getOrganizationAuditSources200Example:
                  summary: Default getOrganizationAuditSources 200 response
                  x-microcks-default: true
                  value:
                    sources:
                    - {}
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /{organizationName}/orgaudit_/api/query/events:
    get:
      operationId: queryOrganizationAuditEvents
      summary: UiPath Query Organization Audit Events
      description: Retrieves audit events at the organization level filtered by time range, event source, event type, user, and other criteria. Returns a paginated list of audit events with actor information, event details, and status. Requires the PM.Audit or PM.Audit.Read OAuth scope.
      tags:
      - Audit Logs
      parameters:
      - $ref: '#/components/parameters/organizationName'
        example: example-value
      - $ref: '#/components/parameters/auditFrom'
        example: example-value
      - $ref: '#/components/parameters/auditTo'
        example: example-value
      - $ref: '#/components/parameters/auditSource'
        example: example-value
      - $ref: '#/components/parameters/auditMaxCount'
        example: example-value
      responses:
        '200':
          description: Audit events matching the query criteria
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditEventCollection'
              examples:
                queryOrganizationAuditEvents200Example:
                  summary: Default queryOrganizationAuditEvents 200 response
                  x-microcks-default: true
                  value:
                    auditEvents:
                    - {}
                    next: https://cloud.uipath.com/example
                    previous: https://cloud.uipath.com/example
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /{organizationName}/{tenantName}/tenantaudit_/api/query/events:
    get:
      operationId: queryTenantAuditEvents
      summary: UiPath Query Tenant Audit Events
      description: Retrieves audit events scoped to a specific tenant, filtered by time range, event source, event type, user, and other criteria. Tenant-level audit events cover actions within Orchestrator, Document Understanding, and other tenant-scoped services. Requires the PM.Audit or PM.Audit.Read OAuth scope.
      tags:
      - Audit Logs
      parameters:
      - $ref: '#/components/parameters/organizationName'
        example: example-value
      - $ref: '#/components/parameters/tenantName'
        example: example-value
      - $ref: '#/components/parameters/auditFrom'
        example: example-value
      - $ref: '#/components/parameters/auditTo'
        example: example-value
      - $ref: '#/components/parameters/auditSource'
        example: example-value
      - $ref: '#/components/parameters/auditMaxCount'
        example: example-value
      responses:
        '200':
          description: Tenant-level audit events matching the query criteria
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditEventCollection'
              examples:
                queryTenantAuditEvents200Example:
                  summary: Default queryTenantAuditEvents 200 response
                  x-microcks-default: true
                  value:
                    auditEvents:
                    - {}
                    next: https://cloud.uipath.com/example
                    previous: https://cloud.uipath.com/example
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    AuditSource:
      type: object
      description: A service that generates audit events
      properties:
        name:
          type: string
          description: Name identifier of the audit event source service
          example: Example Name
        targets:
          type: array
          items:
            type: string
          description: List of event target categories for this source
          example: []
    AuditEventCollection:
      type: object
      description: Collection of audit events with pagination links
      properties:
        auditEvents:
          type: array
          items:
            $ref: '#/components/schemas/AuditEvent'
          example: []
        next:
          type: string
          format: uri
          description: URL to retrieve newer audit events relative to the current result set
          example: https://cloud.uipath.com/example
        previous:
          type: string
          format: uri
          description: URL to retrieve older audit events relative to the current result set
          example: https://cloud.uipath.com/example
    AuditEvent:
      type: object
      description: A single audit event record
      properties:
        id:
          type: string
          description: Unique identifier of the audit event
          example: abc123
        createdOn:
          type: string
          format: date-time
          description: ISO 8601 timestamp when the event occurred
          example: '2026-01-15T10:30:00Z'
        organizationId:
          type: string
          description: Identifier of the organization in which the event occurred
          example: abc123
        actorId:
          type: string
          description: Identifier of the user or service that performed the action
          example: abc123
        actorEmail:
          type: string
          format: email
          description: Email address of the actor who performed the action
          example: user@example.com
        eventType:
          type: string
          description: Type identifier of the audit event
          example: Standard
        eventSource:
          type: string
          description: Service that generated the audit event
          example: example-value
        eventTarget:
          type: string
          description: Category of resource targeted by the action
          example: example-value
        eventDetails:
          type: object
          additionalProperties: true
          description: Detailed payload of the audit event in service-specific format
          example: example-value
        eventSummary:
          type: string
          description: Human-readable summary of the audit event
          example: example-value
        status:
          type: integer
          enum:
          - 0
          - 1
          description: Outcome status (0 = success, 1 = failed)
          example: 0
        clientInfo:
          $ref: '#/components/schemas/ClientInfo'
    ErrorResponse:
      type: object
      description: Standard error response body
      properties:
        message:
          type: string
          description: Human-readable error message
          example: example-value
        errorCode:
          type: string
          description: Error code identifier
          example: example-value
        traceId:
          type: string
          description: Trace identifier for support and debugging
          example: abc123
    ClientInfo:
      type: object
      description: Client connection information for an audit event
      properties:
        ipAddress:
          type: string
          description: IP address from which the action was performed
          example: example-value
        country:
          type: string
          description: Country resolved from the IP address
          example: 42
    AuditSources:
      type: object
      description: Available audit event sources and categories
      properties:
        sources:
          type: array
          items:
            $ref: '#/components/schemas/AuditSource'
          example: []
  parameters:
    auditTo:
      name: to
      in: query
      required: false
      description: End of the audit event time range (ISO 8601 datetime)
      schema:
        type: string
        format: date-time
    organizationName:
      name: organizationName
      in: path
      required: true
      description: The name of the UiPath organization
      schema:
        type: string
    auditMaxCount:
      name: maxCount
      in: query
      required: false
      description: Maximum number of audit events to return
      schema:
        type: integer
        minimum: 1
        maximum: 1000
    tenantName:
      name: tenantName
      in: path
      required: true
      description: The name of the UiPath tenant
      schema:
        type: string
    auditSource:
      name: source
      in: query
      required: false
      description: Filter by event source service name
      schema:
        type: array
        items:
          type: string
    auditFrom:
      name: from
      in: query
      required: false
      description: Start of the audit event time range (ISO 8601 datetime)
      schema:
        type: string
        format: date-time
  responses:
    Unauthorized:
      description: The request lacks valid authentication credentials
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth 2.0 Bearer token obtained from the UiPath Identity Server. Platform Management API scopes include PM.Users, PM.Groups, PM.Audit, PM.License, and their read-only variants.
externalDocs:
  description: UiPath Platform Management API Documentation
  url: https://docs.uipath.com/automation-cloud/automation-cloud/latest/api-guide/about-the-platform-management-apis