openapi: 3.2.0
info:
  title: Webex Admin Audit Events API
  version: 1.0.0
  description: 'Operations tagged Admin Audit Events across 2 of this provider''s published API definitions: webex-admin-audit-events-api-openapi.yml,
    webex-admin-openapi.json. Each path carries the servers of the definition it was published in.'
  x-provenance:
    method: harvested
    authored_by: Cisco Webex
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
    provider_published: true
    derived_view: Per-tag view of the provider's source document. Operations and schemas are the provider's, unmodified; only
      the partition is ours.
  x-evidence:
  - type: source
    url: https://github.com/webex/webex-openapi-specs/blob/main/public-spec/webex-admin.json
  - type: raw
    url: https://raw.githubusercontent.com/webex/webex-openapi-specs/main/public-spec/webex-admin.json
tags:
- name: Admin Audit Events
paths:
  /adminAudit/events:
    get:
      responses:
        '200':
          description: OK
          headers:
            Content-Disposition:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditEventCollectionResponse'
              example:
                items:
                - data:
                    actorOrgName: Acme Inc.
                    targetName: Acme Inc.
                    eventDescription: An Admin logged in
                    actorName: Joe Smith
                    actorEmail: joe@example.com
                    adminRoles:
                    - User
                    trackingId: ATLAS_6f23a878-bcd4-c204-a4db-e701b42b0e5c_0
                    targetType: TargetResourceType.ORG
                    targetId: NWIzZTBiZDgtZjg4Ni00MjViLWIzMTgtYWNlYjliN2EwZGFj
                    eventCategory: EventCategory.LOGINS
                    actorUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko)
                      Chrome/71.0.3578.98 Safari/537.36
                    actorIp: 128.107.241.191
                    targetOrgId: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE
                    actionText: Joe Smith logged into organization Acme Inc.
                    targetOrgName: Acme Inc.
                  created: '2019-01-02T16:58:36.845Z'
                  actorOrgId: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE
                  id: MjQ0ODhiZTYtY2FiMS00ZGRkLTk0NWQtZDFlYjkzOGQ4NGUy
                  actorId: MjQ4Njg2OTYtYWMwZC00ODY4LWJkMjEtZGUxZDc4MzhjOTdm
        '400':
          description: 'Bad Request: The request was invalid or cannot be otherwise served. An accompanying error message
            will explain further.'
        '401':
          description: 'Unauthorized: Authentication credentials were missing or incorrect.'
        '403':
          description: 'Forbidden: The request is understood, but it has been refused or access is not allowed.'
        '404':
          description: 'Not Found: The URI requested is invalid or the resource requested, such as a user, does not exist.
            Also returned when the requested format is not supported by the requested method.'
        '405':
          description: 'Method Not Allowed: The request was made to a resource using an HTTP request method that is not supported.'
        '409':
          description: 'Conflict: The request could not be processed because it conflicts with some established rule of the
            system. For example, a person may not be added to a room more than once.'
        '410':
          description: 'Gone: The requested resource is no longer available.'
        '415':
          description: 'Unsupported Media Type: The request was made to a resource without specifying a media type or used
            a media type that is not supported.'
        '423':
          description: 'Locked: The requested resource is temporarily unavailable. A Retry-After header may be present that
            specifies how many seconds you need to wait before attempting the request again.'
        '428':
          description: 'Precondition Required: File(s) cannot be scanned for malware and need to be force downloaded.'
        '429':
          description: 'Too Many Requests: Too many requests have been sent in a given amount of time and the request has
            been rate limited. A Retry-After header should be present that specifies how many seconds you need to wait before
            a successful request can be made.'
        '500':
          description: 'Internal Server Error: Something went wrong on the server. If the issue persists, feel free to contact
            the [Webex Developer Support team](/explore/support).'
        '502':
          description: 'Bad Gateway: The server received an invalid response from an upstream server while processing the
            request. Try again later.'
        '503':
          description: 'Service Unavailable: Server is overloaded with requests. Try again later.'
        '504':
          description: 'Gateway Timeout: An upstream server failed to respond on time. If your query uses max parameter, please
            try to reduce it.'
      summary: List Admin Audit Events
      operationId: List Admin Audit Events
      description: 'List admin audit events in your organization. Several query parameters are available to filter the response.


        Long result sets will be split into [pages](/docs/basics#pagination).


        **NOTE**: A maximum of one year of audit events can be returned per request.'
      tags:
      - Admin Audit Events
      parameters:
      - name: orgId
        in: query
        description: List events in this organization, by ID.
        required: true
        example: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE
        schema:
          type: string
      - name: from
        in: query
        description: List events which occurred after a specific date and time.
        required: true
        example: '2018-01-01T13:12:11.789Z'
        schema:
          type: string
      - name: to
        in: query
        description: List events which occurred before a specific date and time.
        required: true
        example: '2018-01-01T14:12:11.789Z'
        schema:
          type: string
      - name: actorId
        in: query
        description: List events performed by this person, by ID.
        example: ZWUzNDNmYjEtNGQzNS00ZjNmLWE2ZDctMzZkNzVlYjk0ZWVm
        schema:
          type: string
      - name: max
        in: query
        description: Limit the maximum number of events in the response. The maximum value is `200`.
        example: '100'
        schema:
          type: number
          default: 100
      - name: offset
        in: query
        description: Offset from the first result that you want to fetch.
        example: '0'
        schema:
          type: number
      - name: eventCategories
        in: query
        description: List events, by event categories.
        example: LOGINS,LOGOUT
        schema:
          type: array
          items:
            type: string
            example: LOGINS,LOGOUT
          description: List events, by event categories.
  /adminAudit/eventCategories:
    get:
      responses:
        '200':
          description: OK
          headers: {}
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AuditEventCategoryCollectionResponse'
              example:
                eventCategories: []
        '400':
          description: 'Bad Request: The request was invalid or cannot be otherwise served. An accompanying error message
            will explain further.'
        '401':
          description: 'Unauthorized: Authentication credentials were missing or incorrect.'
        '403':
          description: 'Forbidden: The request is understood, but it has been refused or access is not allowed.'
        '404':
          description: 'Not Found: The URI requested is invalid or the resource requested, such as a user, does not exist.
            Also returned when the requested format is not supported by the requested method.'
        '405':
          description: 'Method Not Allowed: The request was made to a resource using an HTTP request method that is not supported.'
        '409':
          description: 'Conflict: The request could not be processed because it conflicts with some established rule of the
            system. For example, a person may not be added to a room more than once.'
        '410':
          description: 'Gone: The requested resource is no longer available.'
        '415':
          description: 'Unsupported Media Type: The request was made to a resource without specifying a media type or used
            a media type that is not supported.'
        '423':
          description: 'Locked: The requested resource is temporarily unavailable. A Retry-After header may be present that
            specifies how many seconds you need to wait before attempting the request again.'
        '428':
          description: 'Precondition Required: File(s) cannot be scanned for malware and need to be force downloaded.'
        '429':
          description: 'Too Many Requests: Too many requests have been sent in a given amount of time and the request has
            been rate limited. A Retry-After header should be present that specifies how many seconds you need to wait before
            a successful request can be made.'
        '500':
          description: 'Internal Server Error: Something went wrong on the server. If the issue persists, feel free to contact
            the [Webex Developer Support team](/explore/support).'
        '502':
          description: 'Bad Gateway: The server received an invalid response from an upstream server while processing the
            request. Try again later.'
        '503':
          description: 'Service Unavailable: Server is overloaded with requests. Try again later.'
        '504':
          description: 'Gateway Timeout: An upstream server failed to respond on time. If your query uses max parameter, please
            try to reduce it.'
      summary: List Admin Audit Event Categories
      operationId: List Admin Audit Event Categories
      description: Get the list of all admin event categories.
      tags:
      - Admin Audit Events
      parameters: []
components:
  schemas:
    AdminRolesEnum:
      type: string
      enum:
      - User
      - Full_Admin
      - id_full_admin
    AuditEventCollectionResponse:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/AuditEvent'
          description: An array of audit event objects. See [this article](https://help.webex.com/n3b0w6x/) for details about
            each event type.
    AuditEvent:
      type: object
      properties:
        data:
          type: object
          properties:
            actorOrgName:
              type: string
              example: Acme Inc.
              description: The display name of the organization.
            targetName:
              type: string
              example: Acme Inc.
              description: The name of the resource being acted upon.
            eventDescription:
              type: string
              example: An Admin logged in
              description: A description for the event.
            actorName:
              type: string
              example: Joe Smith
              description: The name of the person who performed the action.
            actorEmail:
              type: string
              example: joe@example.com
              description: The email of the person who performed the action.
            adminRoles:
              type: array
              items:
                $ref: '#/components/schemas/AdminRolesEnum'
              description: Admin roles for the person.
            trackingId:
              type: string
              example: ATLAS_6f23a878-bcd4-c204-a4db-e701b42b0e5c_0
              description: A tracking identifier for the event.
            targetType:
              type: string
              example: TargetResourceType.ORG
              description: The type of resource changed by the event.
            targetId:
              type: string
              example: NWIzZTBiZDgtZjg4Ni00MjViLWIzMTgtYWNlYjliN2EwZGFj
              description: The identifier for the resource changed by the event.
            eventCategory:
              type: string
              example: EventCategory.LOGINS
              description: The category of resource changed by the event.
            actorUserAgent:
              type: string
              example: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98
                Safari/537.36
              description: The browser user agent of the person who performed the action.
            actorIp:
              type: string
              example: 128.107.241.191
              description: The IP address of the person who performed the action.
            targetOrgId:
              type: string
              example: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE
              description: The `orgId` of the organization.
            actionText:
              type: string
              example: Joe Smith logged into organization Acme Inc.
              description: A more detailed description of the change made by the person.
            targetOrgName:
              type: string
              example: Acme Inc.
              description: The name of the organization being acted upon.
            errorMessage:
              type: string
              example: WXC-25058 Extension cannot be less than 2 or greater than 6 characters
              description: User operation failure message.
            errorCode:
              type: string
              example: WXC-25058
              description: User operation failure code.
        created:
          type: string
          example: '2019-01-02T16:58:36.845Z'
          description: The date and time the event took place.
        actorOrgId:
          type: string
          example: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE
          description: The `orgId` of the person who made the change.
        id:
          type: string
          example: MjQ0ODhiZTYtY2FiMS00ZGRkLTk0NWQtZDFlYjkzOGQ4NGUy
          description: A unique identifier for the event.
        actorId:
          type: string
          example: MjQ4Njg2OTYtYWMwZC00ODY4LWJkMjEtZGUxZDc4MzhjOTdm
          description: The `personId` of the person who made the change.
    AuditEventCategoryCollectionResponse:
      type: object
      properties:
        eventCategories:
          type: array
          items:
            type: string
          description: An array of audit event categories.
  securitySchemes:
    oauth2:
      flows:
        authorizationCode:
          authorizationUrl: /
          scopes: {}
          tokenUrl: /
      type: oauth2
    bearer-key:
      type: http
      description: e.g. Bearer YOUR_AUTHORIZATION_TOKEN
      scheme: bearer
      bearerFormat: JWT
    bearerAuth:
      type: oauth2
      description: OAuth 2.0 Bearer token authentication
      flows:
        authorizationCode:
          authorizationUrl: https://webexapis.com/v1/authorize
          tokenUrl: https://webexapis.com/v1/access_token
          scopes:
            spark:applications_token: Create access tokens for Service Apps
x-refined-from:
- webex-admin-audit-events-api-openapi.yml
- webex-admin-openapi.json