openapi: 3.2.0
info:
  title: Webex Security Audit Events API
  version: 1.0.0
  description: 'Operations tagged Security Audit Events across 2 of this provider''s published API definitions: webex-admin-openapi.json,
    webex-security-audit-events-api-openapi.yml. Each path carries the servers of the definition it was published in.'
  x-provenance:
    method: harvested
    authored_by: Cisco Webex
    harvested_by: API Evangelist
    harvested_on: '2026-08-19'
    first_party: true
    note: Published by Cisco. Retrieved unmodified except for this x-provenance block.
    provider_published: true
    derived_view: Per-tag view of webex-admin-openapi.json, the provider's source document. Operations and schemas are the
      provider's, unmodified; only the partition is ours.
    derived_from: webex-admin-openapi.json
    operation_coverage: 1/1
  x-evidence:
  - type: source
    url: https://github.com/webex/webex-openapi-specs/blob/main/public-spec/webex-admin.json
  - type: raw
    url: https://raw.githubusercontent.com/webex/webex-openapi-specs/main/public-spec/webex-admin.json
tags:
- name: Security Audit Events
paths:
  /admin/securityAudit/events:
    get:
      responses:
        '200':
          description: OK
          headers:
            link:
              schema:
                type: string
            Content-Disposition:
              schema:
                type: string
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SecurityAuditEventCollectionResponse'
              example:
                items:
                - data:
                    actorOrgName: Acme Inc.
                    eventDescription: An Admin logged in
                    actorName: Joe Smith
                    actorEmail: joe@example.com
                    actorUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko)
                      Chrome/71.0.3578.98 Safari/537.36
                    trackingId: ATLAS_6f23a878-bcd4-c204-a4db-e701b42b0e5c_0
                    eventCategory: LOGINS
                    actorIp: 128.107.241.191
                    actionText: Joe Smith logged into organization Acme Inc.
                  created: '2019-01-02T16:58:36.845Z'
                  actorOrgId: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE
                  id: MjQ0ODhiZTYtY2FiMS00ZGRkLTk0NWQtZDFlYjkzOGQ4NGUy
                  actorId: Y2lzY29zcGFyazovL3VzL1BFT1BMRS82ZWVmOGE4ZS1lNzg3LTQzMWUtOWM3ZC1hOGVjZmU1MjM5Nzc
        '400':
          description: 'Bad Request: The request was invalid or cannot be otherwise served. An accompanying error message
            will explain further.'
        '401':
          description: 'Unauthorized: Authentication credentials were missing or incorrect.'
        '403':
          description: 'Forbidden: The request is understood, but it has been refused or access is not allowed.'
        '404':
          description: 'Not Found: The URI requested is invalid or the resource requested, such as a user, does not exist.
            Also returned when the requested format is not supported by the requested method.'
        '405':
          description: 'Method Not Allowed: The request was made to a resource using an HTTP request method that is not supported.'
        '409':
          description: 'Conflict: The request could not be processed because it conflicts with some established rule of the
            system. For example, a person may not be added to a room more than once.'
        '410':
          description: 'Gone: The requested resource is no longer available.'
        '415':
          description: 'Unsupported Media Type: The request was made to a resource without specifying a media type or used
            a media type that is not supported.'
        '423':
          description: 'Locked: The requested resource is temporarily unavailable. A Retry-After header may be present that
            specifies how many seconds you need to wait before attempting the request again.'
        '428':
          description: 'Precondition Required: File(s) cannot be scanned for malware and need to be force downloaded.'
        '429':
          description: 'Too Many Requests: Too many requests have been sent in a given amount of time and the request has
            been rate limited. A Retry-After header should be present that specifies how many seconds you need to wait before
            a successful request can be made.'
        '500':
          description: 'Internal Server Error: Something went wrong on the server. If the issue persists, feel free to contact
            the [Webex Developer Support team](/explore/support).'
        '502':
          description: 'Bad Gateway: The server received an invalid response from an upstream server while processing the
            request. Try again later.'
        '503':
          description: 'Service Unavailable: Server is overloaded with requests. Try again later.'
        '504':
          description: 'Gateway Timeout: An upstream server failed to respond on time. If your query uses max parameter, please
            try to reduce it.'
      summary: List Security Audit Events
      operationId: List Security Audit Events
      description: 'List Security Audit Events. This API currently returns user sign-in and sign-out data.

        To call this API the `audit:events_read` scope must be selected for the Integration or Service App and authorized
        by a Full Admin.


        Several query parameters are available to filter the response.


        Long result sets will be split into multiple [pages](/docs/basics#pagination)


        **NOTE**: A maximum of one year of audit events can be returned per request.'
      tags:
      - Security Audit Events
      parameters:
      - name: orgId
        in: query
        description: List events in this organization, by ID.
        required: true
        example: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE
        schema:
          type: string
      - name: startTime
        in: query
        description: List events which occurred after a specific date and time.
        required: true
        example: '2018-01-01T13:12:11.789Z'
        schema:
          type: string
      - name: endTime
        in: query
        description: List events which occurred before a specific date and time.
        required: true
        example: '2018-01-01T14:12:11.789Z'
        schema:
          type: string
      - name: actorId
        in: query
        description: List events performed by this person, by ID.
        example: Y2lzY29zcGFyazovL3VzL1BFT1BMRS9iYzQ1YTdiMC00OTg1LTQzYzktYjI1OS00Y2MzOTgzYzY4NjQ
        schema:
          type: string
      - name: max
        in: query
        description: Limit the maximum number of events in the response. The maximum value is `1000`.
        example: '100'
        schema:
          type: number
          default: 100
      - name: eventCategories
        in: query
        description: List events, by event categories.
        example: LOGINS
        schema:
          type: array
          items:
            type: string
            example: LOGINS
          description: List events, by event categories.
components:
  schemas:
    SecurityAuditEvent:
      type: object
      properties:
        data:
          type: object
          properties:
            actorOrgName:
              type: string
              example: Acme Inc.
              description: The display name of the organization.
            eventDescription:
              type: string
              example: An Admin logged in
              description: A description for the event.
            actorName:
              type: string
              example: Joe Smith
              description: The name of the person who performed the action.
            actorEmail:
              type: string
              example: joe@example.com
              description: The email of the person who performed the action.
            actorUserAgent:
              type: string
              example: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98
                Safari/537.36
              description: The browser user agent of the person who performed the action.
            trackingId:
              type: string
              example: ATLAS_6f23a878-bcd4-c204-a4db-e701b42b0e5c_0
              description: A tracking identifier for the event.
            eventCategory:
              type: string
              example: LOGINS
              description: The category of resource changed by the event.
            actorIp:
              type: string
              example: 128.107.241.191
              description: The IP address of the person who performed the action.
            actionText:
              type: string
              example: Joe Smith logged into organization Acme Inc.
              description: A more detailed description of the change made by the person.
        created:
          type: string
          example: '2019-01-02T16:58:36.845Z'
          description: The date and time the event took place.
        actorOrgId:
          type: string
          example: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE
          description: The `orgId` of the person who made the change.
        id:
          type: string
          example: MjQ0ODhiZTYtY2FiMS00ZGRkLTk0NWQtZDFlYjkzOGQ4NGUy
          description: A unique identifier for the event.
        actorId:
          type: string
          example: Y2lzY29zcGFyazovL3VzL1BFT1BMRS82ZWVmOGE4ZS1lNzg3LTQzMWUtOWM3ZC1hOGVjZmU1MjM5Nzc
          description: The `personId` of the person who made the change.
    SecurityAuditEventCollectionResponse:
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/SecurityAuditEvent'
          description: array of monitoring Audit events
  securitySchemes:
    oauth2:
      flows:
        authorizationCode:
          authorizationUrl: /
          scopes: {}
          tokenUrl: /
      type: oauth2
    bearer-key:
      type: http
      description: e.g. Bearer YOUR_AUTHORIZATION_TOKEN
      scheme: bearer
      bearerFormat: JWT
    bearerAuth:
      type: oauth2
      description: OAuth 2.0 Bearer token authentication
      flows:
        authorizationCode:
          authorizationUrl: https://webexapis.com/v1/authorize
          tokenUrl: https://webexapis.com/v1/access_token
          scopes:
            spark:applications_token: Create access tokens for Service Apps
x-refined-from:
- webex-admin-openapi.json
- webex-security-audit-events-api-openapi.yml