openapi: 3.0.0
info:
  title: Webex Admin Address Book Admin Audit Events API
  version: 1.0.0
  description: The Webex Admin APIs provide comprehensive programmatic access to administrative functions for managing Webex organizations, users, licenses, and settings. These APIs enable automation of user provisioning, license assignment, compliance management, and audit event retrieval. Administrators can integrate with enterprise identity systems, enforce security policies, monitor usage, and streamline onboarding/offboarding processes. The APIs support granular control over organizational resources, making them ideal for large-scale deployments and custom admin tooling.
tags:
- name: Admin Audit Events
paths:
  /adminAudit/events:
    get:
      responses:
        '200':
          description: OK
          headers:
            Content-Disposition:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditEventCollectionResponse'
              example:
                items:
                - data:
                    actorOrgName: Acme Inc.
                    targetName: Acme Inc.
                    eventDescription: An Admin logged in
                    actorName: Joe Smith
                    actorEmail: joe@example.com
                    adminRoles:
                    - User
                    trackingId: ATLAS_6f23a878-bcd4-c204-a4db-e701b42b0e5c_0
                    targetType: TargetResourceType.ORG
                    targetId: NWIzZTBiZDgtZjg4Ni00MjViLWIzMTgtYWNlYjliN2EwZGFj
                    eventCategory: EventCategory.LOGINS
                    actorUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
                    actorIp: 128.107.241.191
                    targetOrgId: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE
                    actionText: Joe Smith logged into organization Acme Inc.
                    targetOrgName: Acme Inc.
                  created: '2019-01-02T16:58:36.845Z'
                  actorOrgId: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE
                  id: MjQ0ODhiZTYtY2FiMS00ZGRkLTk0NWQtZDFlYjkzOGQ4NGUy
                  actorId: MjQ4Njg2OTYtYWMwZC00ODY4LWJkMjEtZGUxZDc4MzhjOTdm
        '400':
          description: 'Bad Request: The request was invalid or cannot be otherwise served. An accompanying error message will explain further.'
        '401':
          description: 'Unauthorized: Authentication credentials were missing or incorrect.'
        '403':
          description: 'Forbidden: The request is understood, but it has been refused or access is not allowed.'
        '404':
          description: 'Not Found: The URI requested is invalid or the resource requested, such as a user, does not exist. Also returned when the requested format is not supported by the requested method.'
        '405':
          description: 'Method Not Allowed: The request was made to a resource using an HTTP request method that is not supported.'
        '409':
          description: 'Conflict: The request could not be processed because it conflicts with some established rule of the system. For example, a person may not be added to a room more than once.'
        '410':
          description: 'Gone: The requested resource is no longer available.'
        '415':
          description: 'Unsupported Media Type: The request was made to a resource without specifying a media type or used a media type that is not supported.'
        '423':
          description: 'Locked: The requested resource is temporarily unavailable. A Retry-After header may be present that specifies how many seconds you need to wait before attempting the request again.'
        '428':
          description: 'Precondition Required: File(s) cannot be scanned for malware and need to be force downloaded.'
        '429':
          description: 'Too Many Requests: Too many requests have been sent in a given amount of time and the request has been rate limited. A Retry-After header should be present that specifies how many seconds you need to wait before a successful request can be made.'
        '500':
          description: 'Internal Server Error: Something went wrong on the server. If the issue persists, feel free to contact the [Webex Developer Support team](/explore/support).'
        '502':
          description: 'Bad Gateway: The server received an invalid response from an upstream server while processing the request. Try again later.'
        '503':
          description: 'Service Unavailable: Server is overloaded with requests. Try again later.'
        '504':
          description: 'Gateway Timeout: An upstream server failed to respond on time. If your query uses max parameter, please try to reduce it.'
      summary: List Admin Audit Events
      operationId: List Admin Audit Events
      description: 'List admin audit events in your organization. Several query parameters are available to filter the response.


        Long result sets will be split into [pages](/docs/basics#pagination).


        **NOTE**: A maximum of one year of audit events can be returned per request.'
      tags:
      - Admin Audit Events
      parameters:
      - name: orgId
        in: query
        description: List events in this organization, by ID.
        required: true
        example: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE
        schema:
          type: string
      - name: from
        in: query
        description: List events which occurred after a specific date and time.
        required: true
        example: '2018-01-01T13:12:11.789Z'
        schema:
          type: string
      - name: to
        in: query
        description: List events which occurred before a specific date and time.
        required: true
        example: '2018-01-01T14:12:11.789Z'
        schema:
          type: string
      - name: actorId
        in: query
        description: List events performed by this person, by ID.
        example: ZWUzNDNmYjEtNGQzNS00ZjNmLWE2ZDctMzZkNzVlYjk0ZWVm
        schema:
          type: string
      - name: max
        in: query
        description: Limit the maximum number of events in the response. The maximum value is `200`.
        example: '100'
        schema:
          type: number
          default: 100
      - name: offset
        in: query
        description: Offset from the first result that you want to fetch.
        example: '0'
        schema:
          type: number
      - name: eventCategories
        in: query
        description: List events, by event categories.
        example: LOGINS,LOGOUT
        schema:
          type: array
          items:
            type: string
            example: LOGINS,LOGOUT
          description: List events, by event categories.
  /adminAudit/eventCategories:
    get:
      responses:
        '200':
          description: OK
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditEventCategoryCollectionResponse'
              example:
                eventCategories: []
        '400':
          description: 'Bad Request: The request was invalid or cannot be otherwise served. An accompanying error message will explain further.'
        '401':
          description: 'Unauthorized: Authentication credentials were missing or incorrect.'
        '403':
          description: 'Forbidden: The request is understood, but it has been refused or access is not allowed.'
        '404':
          description: 'Not Found: The URI requested is invalid or the resource requested, such as a user, does not exist. Also returned when the requested format is not supported by the requested method.'
        '405':
          description: 'Method Not Allowed: The request was made to a resource using an HTTP request method that is not supported.'
        '409':
          description: 'Conflict: The request could not be processed because it conflicts with some established rule of the system. For example, a person may not be added to a room more than once.'
        '410':
          description: 'Gone: The requested resource is no longer available.'
        '415':
          description: 'Unsupported Media Type: The request was made to a resource without specifying a media type or used a media type that is not supported.'
        '423':
          description: 'Locked: The requested resource is temporarily unavailable. A Retry-After header may be present that specifies how many seconds you need to wait before attempting the request again.'
        '428':
          description: 'Precondition Required: File(s) cannot be scanned for malware and need to be force downloaded.'
        '429':
          description: 'Too Many Requests: Too many requests have been sent in a given amount of time and the request has been rate limited. A Retry-After header should be present that specifies how many seconds you need to wait before a successful request can be made.'
        '500':
          description: 'Internal Server Error: Something went wrong on the server. If the issue persists, feel free to contact the [Webex Developer Support team](/explore/support).'
        '502':
          description: 'Bad Gateway: The server received an invalid response from an upstream server while processing the request. Try again later.'
        '503':
          description: 'Service Unavailable: Server is overloaded with requests. Try again later.'
        '504':
          description: 'Gateway Timeout: An upstream server failed to respond on time. If your query uses max parameter, please try to reduce it.'
      summary: List Admin Audit Event Categories
      operationId: List Admin Audit Event Categories
      description: Get the list of all admin event categories.
      tags:
      - Admin Audit Events
      parameters: []
components:
  schemas:
    AuditEventCategoryCollectionResponse:
      type: object
      properties:
        eventCategories:
          type: array
          items:
            type: string
          description: An array of audit event categories.
    AuditEvent:
      type: object
      properties:
        data:
          type: object
          properties:
            actorOrgName:
              type: string
              example: Acme Inc.
              description: The display name of the organization.
            targetName:
              type: string
              example: Acme Inc.
              description: The name of the resource being acted upon.
            eventDescription:
              type: string
              example: An Admin logged in
              description: A description for the event.
            actorName:
              type: string
              example: Joe Smith
              description: The name of the person who performed the action.
            actorEmail:
              type: string
              example: joe@example.com
              description: The email of the person who performed the action.
            adminRoles:
              type: array
              items:
                $ref: '#/components/schemas/AdminRolesEnum'
              description: Admin roles for the person.
            trackingId:
              type: string
              example: ATLAS_6f23a878-bcd4-c204-a4db-e701b42b0e5c_0
              description: A tracking identifier for the event.
            targetType:
              type: string
              example: TargetResourceType.ORG
              description: The type of resource changed by the event.
            targetId:
              type: string
              example: NWIzZTBiZDgtZjg4Ni00MjViLWIzMTgtYWNlYjliN2EwZGFj
              description: The identifier for the resource changed by the event.
            eventCategory:
              type: string
              example: EventCategory.LOGINS
              description: The category of resource changed by the event.
            actorUserAgent:
              type: string
              example: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
              description: The browser user agent of the person who performed the action.
            actorIp:
              type: string
              example: 128.107.241.191
              description: The IP address of the person who performed the action.
            targetOrgId:
              type: string
              example: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE
              description: The `orgId` of the organization.
            actionText:
              type: string
              example: Joe Smith logged into organization Acme Inc.
              description: A more detailed description of the change made by the person.
            targetOrgName:
              type: string
              example: Acme Inc.
              description: The name of the organization being acted upon.
            errorMessage:
              type: string
              example: WXC-25058 Extension cannot be less than 2 or greater than 6 characters
              description: User operation failure message.
            errorCode:
              type: string
              example: WXC-25058
              description: User operation failure code.
        created:
          type: string
          example: '2019-01-02T16:58:36.845Z'
          description: The date and time the event took place.
        actorOrgId:
          type: string
          example: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE
          description: The `orgId` of the person who made the change.
        id:
          type: string
          example: MjQ0ODhiZTYtY2FiMS00ZGRkLTk0NWQtZDFlYjkzOGQ4NGUy
          description: A unique identifier for the event.
        actorId:
          type: string
          example: MjQ4Njg2OTYtYWMwZC00ODY4LWJkMjEtZGUxZDc4MzhjOTdm
          description: The `personId` of the person who made the change.
    AdminRolesEnum:
      type: string
      enum:
      - User
      - Full_Admin
      - id_full_admin
    AuditEventCollectionResponse:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/AuditEvent'
          description: An array of audit event objects. See [this article](https://help.webex.com/n3b0w6x/) for details about each event type.
  securitySchemes:
    oauth2:
      flows:
        authorizationCode:
          authorizationUrl: /
          scopes: {}
          tokenUrl: /
      type: oauth2
    bearer-key:
      type: http
      description: e.g. Bearer YOUR_AUTHORIZATION_TOKEN
      scheme: bearer
      bearerFormat: JWT
    bearerAuth:
      type: oauth2
      description: OAuth 2.0 Bearer token authentication
      flows:
        authorizationCode:
          authorizationUrl: https://webexapis.com/v1/authorize
          tokenUrl: https://webexapis.com/v1/access_token
          scopes:
            spark:applications_token: Create access tokens for Service Apps