UiPath AuditLogs API

openapi: 3.1.0
info:
  title: UiPath Automation Hub Alerts AuditLogs API
  description: The UiPath Automation Hub API provides access to the automation pipeline and idea management platform, allowing developers to programmatically create, retrieve, and manage automation ideas, projects, and pipeline data. The API is accessible at the tenant-scoped endpoint https://cloud.uipath.com/{orgName}/{tenantName}/automationhub_/api/v1/ and uses token-based authentication generated from the Automation Hub Admin Console. It is designed for organizations building Center of Excellence workflows, integrating Automation Hub data with external tools, or automating pipeline governance processes. A Postman collection and Swagger interface are available for exploring and testing endpoints.
  version: '1.0'
  contact:
    name: UiPath Support
    url: https://support.uipath.com
  termsOfService: https://www.uipath.com/legal/terms-of-use
servers:
- url: https://cloud.uipath.com/{orgName}/{tenantName}/automationhub_/api/v1
  description: UiPath Automation Cloud Automation Hub
  variables:
    orgName:
      default: your-org
      description: The name of your UiPath organization
    tenantName:
      default: your-tenant
      description: The name of your UiPath tenant
security:
- apiKeyAuth: []
tags:
- name: AuditLogs
  description: Retrieve and download organization and tenant audit event logs
paths:
  /{organizationName}/orgaudit_/api/query/sources:
    get:
      operationId: getOrganizationAuditSources
      summary: UiPath Get Organization Audit Event Sources
      description: Retrieves metadata about available audit event sources at the organization level. Returns the list of services that generate audit events along with available event types and categories for use as filters in the query events endpoint. Requires the PM.Audit or PM.Audit.Read OAuth scope.
      tags:
      - AuditLogs
      parameters:
      - $ref: '#/components/parameters/organizationName'
        example: example-value
      responses:
        '200':
          description: Available organization audit event sources
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditSources'
              examples:
                getOrganizationAuditSources200Example:
                  summary: Default getOrganizationAuditSources 200 response
                  x-microcks-default: true
                  value:
                    sources:
                    - {}
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /{organizationName}/orgaudit_/api/query/events:
    get:
      operationId: queryOrganizationAuditEvents
      summary: UiPath Query Organization Audit Events
      description: Retrieves audit events at the organization level filtered by time range, event source, event type, user, and other criteria. Returns a paginated list of audit events with actor information, event details, and status. Requires the PM.Audit or PM.Audit.Read OAuth scope.
      tags:
      - AuditLogs
      parameters:
      - $ref: '#/components/parameters/organizationName'
        example: example-value
      - $ref: '#/components/parameters/auditFrom'
        example: example-value
      - $ref: '#/components/parameters/auditTo'
        example: example-value
      - $ref: '#/components/parameters/auditSource'
        example: example-value
      - $ref: '#/components/parameters/auditMaxCount'
        example: example-value
      responses:
        '200':
          description: Audit events matching the query criteria
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditEventCollection'
              examples:
                queryOrganizationAuditEvents200Example:
                  summary: Default queryOrganizationAuditEvents 200 response
                  x-microcks-default: true
                  value:
                    auditEvents:
                    - {}
                    next: https://cloud.uipath.com/example
                    previous: https://cloud.uipath.com/example
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /{organizationName}/{tenantName}/tenantaudit_/api/query/events:
    get:
      operationId: queryTenantAuditEvents
      summary: UiPath Query Tenant Audit Events
      description: Retrieves audit events scoped to a specific tenant, filtered by time range, event source, event type, user, and other criteria. Tenant-level audit events cover actions within Orchestrator, Document Understanding, and other tenant-scoped services. Requires the PM.Audit or PM.Audit.Read OAuth scope.
      tags:
      - AuditLogs
      parameters:
      - $ref: '#/components/parameters/organizationName'
        example: example-value
      - $ref: '#/components/parameters/tenantName'
        example: example-value
      - $ref: '#/components/parameters/auditFrom'
        example: example-value
      - $ref: '#/components/parameters/auditTo'
        example: example-value
      - $ref: '#/components/parameters/auditSource'
        example: example-value
      - $ref: '#/components/parameters/auditMaxCount'
        example: example-value
      responses:
        '200':
          description: Tenant-level audit events matching the query criteria
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditEventCollection'
              examples:
                queryTenantAuditEvents200Example:
                  summary: Default queryTenantAuditEvents 200 response
                  x-microcks-default: true
                  value:
                    auditEvents:
                    - {}
                    next: https://cloud.uipath.com/example
                    previous: https://cloud.uipath.com/example
        '401':
          $ref: '#/components/responses/Unauthorized'
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  parameters:
    auditTo:
      name: to
      in: query
      required: false
      description: End of the audit event time range (ISO 8601 datetime)
      schema:
        type: string
        format: date-time
    auditFrom:
      name: from
      in: query
      required: false
      description: Start of the audit event time range (ISO 8601 datetime)
      schema:
        type: string
        format: date-time
    auditSource:
      name: source
      in: query
      required: false
      description: Filter by event source service name
      schema:
        type: array
        items:
          type: string
    tenantName:
      name: tenantName
      in: path
      required: true
      description: The name of the UiPath tenant
      schema:
        type: string
    auditMaxCount:
      name: maxCount
      in: query
      required: false
      description: Maximum number of audit events to return
      schema:
        type: integer
        minimum: 1
        maximum: 1000
    organizationName:
      name: organizationName
      in: path
      required: true
      description: The name of the UiPath organization
      schema:
        type: string
  schemas:
    AuditSources:
      type: object
      description: Available audit event sources and categories
      properties:
        sources:
          type: array
          items:
            $ref: '#/components/schemas/AuditSource'
          example: []
    AuditEvent:
      type: object
      description: A single audit event record
      properties:
        id:
          type: string
          description: Unique identifier of the audit event
          example: abc123
        createdOn:
          type: string
          format: date-time
          description: ISO 8601 timestamp when the event occurred
          example: '2026-01-15T10:30:00Z'
        organizationId:
          type: string
          description: Identifier of the organization in which the event occurred
          example: abc123
        actorId:
          type: string
          description: Identifier of the user or service that performed the action
          example: abc123
        actorEmail:
          type: string
          format: email
          description: Email address of the actor who performed the action
          example: user@example.com
        eventType:
          type: string
          description: Type identifier of the audit event
          example: Standard
        eventSource:
          type: string
          description: Service that generated the audit event
          example: example-value
        eventTarget:
          type: string
          description: Category of resource targeted by the action
          example: example-value
        eventDetails:
          type: object
          additionalProperties: true
          description: Detailed payload of the audit event in service-specific format
          example: example-value
        eventSummary:
          type: string
          description: Human-readable summary of the audit event
          example: example-value
        status:
          type: integer
          enum:
          - 0
          - 1
          description: Outcome status (0 = success, 1 = failed)
          example: 0
        clientInfo:
          $ref: '#/components/schemas/ClientInfo'
    AuditSource:
      type: object
      description: A service that generates audit events
      properties:
        name:
          type: string
          description: Name identifier of the audit event source service
          example: Example Name
        targets:
          type: array
          items:
            type: string
          description: List of event target categories for this source
          example: []
    ErrorResponse:
      type: object
      description: Standard error response body
      properties:
        message:
          type: string
          description: Human-readable error message
          example: example-value
        errorCode:
          type: string
          description: Error code identifier
          example: example-value
        traceId:
          type: string
          description: Trace identifier for support and debugging
          example: abc123
    AuditEventCollection:
      type: object
      description: Collection of audit events with pagination links
      properties:
        auditEvents:
          type: array
          items:
            $ref: '#/components/schemas/AuditEvent'
          example: []
        next:
          type: string
          format: uri
          description: URL to retrieve newer audit events relative to the current result set
          example: https://cloud.uipath.com/example
        previous:
          type: string
          format: uri
          description: URL to retrieve older audit events relative to the current result set
          example: https://cloud.uipath.com/example
    ClientInfo:
      type: object
      description: Client connection information for an audit event
      properties:
        ipAddress:
          type: string
          description: IP address from which the action was performed
          example: example-value
        country:
          type: string
          description: Country resolved from the IP address
          example: 42
  responses:
    Unauthorized:
      description: The request lacks valid authentication credentials
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      in: header
      name: Authorization
      description: 'API token generated from the Automation Hub Admin Console under Platform Setup > Open API. Include as a Bearer token in the Authorization header: "Bearer {token}".'
externalDocs:
  description: UiPath Automation Hub API Documentation
  url: https://docs.uipath.com/automation-hub/automation-cloud/latest/api-guide/introduction-to-automation-hub-api-1