Audit Reporting API v1

The Audit Reporting API lets you programmatically create and access reports covering login activity, file operations, permission modifications, user and group provisioning, configuration changes, and other domain events. These reports give you full visibility into what's happening across your Egnyte domain.

Base URL

https://{domain}.egnyte.com/pubapi/v1/audit

Authentication

All requests require an OAuth 2.0 Bearer token in the Authorization header:

Authorization: Bearer {access_token}

See Authentication for details on obtaining a token.

Permissions

• Only admin users or power users with the "can run reports" role can generate audit reports.
• Audit reporting must be enabled on your Egnyte domain's plan.

Report Formats

Audit report data can be returned in CSV or JSON format. Specify the desired format in the format parameter when creating a report. CSV output matches the format downloaded via the Egnyte audit report UI.

Date and Time Format

All dates and times use ISO 8601 format:

• Date: YYYY-MM-DD (e.g., 2019-05-27)
• Timestamp: YYYY-MM-DDTHH:MM:SSZ (e.g., 2019-05-27T22:27:01Z)

Create Login Audit Report

Generates a report on login activity, logouts, account lockouts, password resets, and failed login attempts.

Request

POST /pubapi/v1/audit/logins

Request Body

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/logins" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "json",
  "date_start": "2019-05-01",
  "date_end": "2019-05-20",
  "access_points": [
    "web",
    "ftp"
  ],
  "users": [
    "jsmith",
    "kjohnson"
  ],
  "events": [
    "logins",
    "failed_attempts"
  ]
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Create File Audit Report

Generates a report on file and folder actions including uploads, downloads, previews, deletions, moves, copies, and link activity.

Request

POST /pubapi/v1/audit/files

Request Body

*Either folders or file must be specified.

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/files" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "json",
  "date_start": "2019-05-01",
  "date_end": "2019-05-20",
  "transaction_type": [
    "download",
    "preview"
  ],
  "users": [
    "jsmith",
    "kjohnson"
  ],
  "folders": [
    "/Shared/Marketing",
    "/Shared/Engineering"
  ]
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Create Permissions Audit Report

Generates a report on permission changes for folders, including who assigned permissions and who received them.

Request

POST /pubapi/v1/audit/permissions

Request Body

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/permissions" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "json",
  "date_start": "2019-05-01",
  "date_end": "2019-05-20",
  "assigners": [
    "jsmith",
    "kjohnson"
  ],
  "assignee_users": [
    "rbrown",
    "mjones"
  ],
  "folders": [
    "/Shared/Marketing",
    "/Shared/Engineering"
  ]
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Create User Provisioning Audit Report

Generates a report on user account changes including creation, updates, deletions, and password changes.

Request

POST /pubapi/v1/audit/users

Request Body

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/users" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "json",
  "date_start": "2019-08-01",
  "date_end": "2019-08-15",
  "action_type": [
    "CREATE",
    "PASSWORD_RESET",
    "PASSWORD_CHANGE"
  ],
  "subject": [
    "standarduser1@mydomain",
    "standarduser2@mydomain"
  ]
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Create Group Provisioning Audit Report

Generates a report on group changes including creation, member additions/removals, renames, and deletions.

Request

POST /pubapi/v1/audit/groups

Request Body

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/groups" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "csv",
  "date_start": "2019-08-01",
  "date_end": "2019-08-15",
  "action_type": [
    "CREATE",
    "ADD_USERS"
  ],
  "users": [
    "standarduser1@mydomain",
    "standarduser2@mydomain"
  ],
  "groups": [
    "ProjectManagers",
    "Electricians"
  ],
  "include_system_actions": true
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Create Configuration Settings Audit Report

Generates a report on changes to domain configuration settings.

Request

POST /pubapi/v1/audit/workgroup-settings

Request Body

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/workgroup-settings" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "csv",
  "date_start": "2019-08-01",
  "date_end": "2019-08-15",
  "users": [
    "user1",
    "user2"
  ]
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Create Workflow Audit Report

Generates a report on workflow activity including creation, completion, cancellation, step transitions, and task actions.

Request

POST /pubapi/v1/audit/workflows

Request Body

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/workflows" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "json",
  "date_start": "2019-08-01",
  "date_end": "2019-08-15",
  "users": [
    "jsmith"
  ],
  "workflow_actions": [
    "WORKFLOW_CREATED",
    "WORKFLOW_COMPLETED"
  ],
  "workflow_types": [
    "APPROVAL",
    "REVIEW"
  ]
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Create Workflow Templates Audit Report

Generates a report on workflow template changes including creation, editing, and status changes.

Request

POST /pubapi/v1/audit/workflow-templates

Request Body

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/workflow-templates" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "json",
  "date_start": "2019-08-01",
  "date_end": "2019-08-15",
  "workflow_template_actions": [
    "TEMPLATE_CREATED",
    "TEMPLATE_EDITED"
  ]
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Create Quality Docs Audit Report

Generates a report on Quality Docs activity including document actions, training assignments, and status changes.

Request

POST /pubapi/v1/audit/quality-docs

Request Body

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/quality-docs" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "json",
  "date_start": "2019-08-01",
  "date_end": "2019-08-15",
  "quality_docs_actions": [
    "DOCUMENT_ADDED",
    "DOCUMENT_MODIFIED"
  ],
  "quality_docs_statuses": [
    "EFFECTIVE"
  ]
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Create Quality Docs Categories Audit Report

Generates a report on Quality Docs category and subcategory changes.

Request

POST /pubapi/v1/audit/quality-docs-categories

Request Body

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/quality-docs-categories" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "json",
  "date_start": "2019-08-01",
  "date_end": "2019-08-15",
  "quality_docs_categories_actions": [
    "CATEGORY_ADDED",
    "CATEGORY_MODIFIED"
  ]
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Create Quality Docs Courses Audit Report

Generates a report on Quality Docs training course activity including course creation, modifications, and status changes.

Request

POST /pubapi/v1/audit/quality-docs-courses

Request Body

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/quality-docs-courses" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "json",
  "date_start": "2019-08-01",
  "date_end": "2019-08-15",
  "quality_docs_courses_actions": [
    "COURSE_CREATED",
    "COURSE_MODIFIED"
  ]
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Create eTMF Audit Report

Generates a report on electronic Trial Master File (eTMF) activity including study, trial, country, site, and document actions.

Request

POST /pubapi/v1/audit/etmf

Request Body

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/etmf" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "json",
  "date_start": "2019-08-01",
  "date_end": "2019-08-15",
  "etmf_actions": [
    "STUDY_CREATED",
    "DOCUMENT_ADDED"
  ],
  "etmf_study_ids": [
    "study-001"
  ]
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Create Snapshot Restore Audit Report

Generates a report on snapshot restore activity including mounting, unmounting, previewing, and restoring snapshots.

Request

POST /pubapi/v1/audit/snapshot-restore

Request Body

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/snapshot-restore" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "json",
  "date_start": "2019-08-01",
  "date_end": "2019-08-15"
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Create Upload Requests Audit Report

Generates a report on upload request activity including request creation, file uploads, document submissions, and approvals.

Request

POST /pubapi/v1/audit/upload-requests

Request Body

Example Request

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v1/audit/upload-requests" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "format": "json",
  "date_start": "2019-08-01",
  "date_end": "2019-08-15"
}'

Response

202 Accepted

Response Headers

Example Response

{
  "id": "12345678"
}

Check Audit Report Generation Status

Polls the status of a report generation job. Poll no more frequently than once every 2 minutes.

Request

GET /pubapi/v1/audit/jobs/{id}

Path Parameters

Example Request

curl -i -X GET "https://{domain}.egnyte.com/pubapi/v1/audit/jobs/{id}" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Response

200 OK (report still generating)

Example Response

{
  "status": "running"
}

303 See Other (report ready)

Response Headers

Example Response

{
  "status": "completed"
}

Retrieve Audit Report

Retrieves a completed audit report. For JSON reports, supports pagination via query parameters.

Request

GET /pubapi/v1/audit/{type}/{id}

Path Parameters

Query Parameters

The following parameters apply only to JSON-formatted reports:

Example Request (CSV)

curl -i -X GET "https://{domain}.egnyte.com/pubapi/v1/audit/logins/{id}" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Example Request (JSON with pagination)

curl -i -X GET "https://{domain}.egnyte.com/pubapi/v1/audit/files/{id}?offset=10&count=50" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Response

200 OK

Response Headers

Example Response (CSV)

Username,Event,IP Address,Access,Time
"John Smith (jsmith@company.com)",Login,198.51.100.0,Web,2019-05-26T18:35Z
"John Smith (jsmith@company.com)",Logout,198.51.100.0,Web,2019-05-26T20:06Z

Example Response (JSON - Login Audit Report)

{
  "total_count": 100,
  "offset": 10,
  "count": 2,
  "events": [
    {
      "username": "John Smith ( jsmith@company.com )",
      "user_id": 121,
      "event": "Failed Attempt",
      "ip_address": "198.51.100.0",
      "access": "Web",
      "time": "2019-05-26T18:35Z"
    },
    {
      "username": "John Smith ( jsmith@company.com )",
      "user_id": 121,
      "event": "Login",
      "ip_address": "198.51.100.0",
      "access": "Mobile",
      "time": "2019-05-26T20:06Z"
    }
  ]
}

Example Response (JSON - File Audit Report)

{
  "total_count": 100,
  "offset": 10,
  "count": 2,
  "events": [
    {
      "username": "John Smith ( jsmith@company.com )",
      "user_id": 121,
      "file": "/Shared/Documents/example.txt",
      "target_path": "/Shared/Documents/subfolder",
      "transaction": "Move File",
      "actionInfo": "N/A",
      "access": "Mobile",
      "time": "2021-02-15T07:58:17Z",
      "ipAddress": "192.168.0.0.1",
      "file_checksum": "acc8b9f0d5d77c5c03cb9961986"
    },
    {
      "username": "Anonymous access Admin (via link)",
      "user_id": 123,
      "folder": "/Shared/Documents/example",
      "link": "https://acme.egnyte.com/h-s/20130526/5b10bafb3c2742b6",
      "transaction": "Download via Link",
      "actionInfo": "N/A",
      "access": "Web",
      "time": "2021-02-15T08:34:37Z",
      "ipAddress": "192.168.0.0.1",
      "file_checksum": "N/A"
    }
  ]
}

Example Response (JSON - Permissions Audit Report)

{
  "total_count": 100,
  "offset": 10,
  "count": 2,
  "events": [
    {
      "folder": "/Shared/Marketing",
      "assignee": "Sarah Doerr ( sdoerr@company.com )",
      "assignee_id": 107,
      "assigner": "John Doe ( jdoe@company.com )",
      "assigner_id": 101,
      "change": "+Editor",
      "time": "2019-05-26T18:35Z"
    },
    {
      "folder": "/Shared/Engineering",
      "assignee": "Sarah Doerr ( sdoerr@company.com )",
      "assignee_id": 107,
      "assigner": "John Doe ( jdoe@company.com )",
      "assigner_id": 101,
      "change": "Editor>>Owner",
      "time": "2019-05-26T20:06Z"
    }
  ]
}

Example Response (JSON - User Provisioning Audit Report)

{
  "total_count": 2,
  "offset": 0,
  "count": 2,
  "events": [
    {
      "performed_by": "William Black ( wblack@corporate-email.com )",
      "performed_by_id": 102,
      "subject": "John White ( jwhite@corporate-email.com )",
      "subject_id": 107,
      "action": "Create",
      "action_info": "",
      "date_and_time": "2019-08-03T17:13:58Z",
      "action_source": "Web UI"
    },
    {
      "performed_by": "John White ( jwhite@corporate-email.com )",
      "performed_by_id": 107,
      "subject": "John White ( jwhite@corporate-email.com )",
      "subject_id": 107,
      "action": "Password Change",
      "action_info": "",
      "date_and_time": "2019-08-03T17:15:57Z",
      "action_source": "Web UI"
    }
  ]
}

Example Response (JSON - Group Provisioning Audit Report)

{
  "total_count": 2,
  "offset": 0,
  "count": 2,
  "events": [
    {
      "time": "2019-09-14T23:03:22Z",
      "actor": "John White ( jwhite@corporate-email.com )",
      "actor_id": 107,
      "group": "ProjectManagers",
      "action": "Create",
      "action_info": "",
      "source": "Web UI"
    },
    {
      "time": "2019-09-14T23:03:38Z",
      "actor": "John White ( jwhite@corporate-email.com )",
      "actor_id": 107,
      "group": "ProjectManagers",
      "action": "Add Users",
      "action_info": "William Black ( wblack@corporate-email.com ),Kate Smith ( ksmith@corporate-email.com )",
      "source": "Web UI"
    }
  ]
}

Example Response (JSON - Configuration Settings Audit Report)

{
  "total_count": 2,
  "offset": 0,
  "count": 2,
  "events": [
    {
      "time": "2021-01-05T23:00:00Z",
      "actor": "John White ( jwhite@corporate-email.com )",
      "ip_address": "192.168.0.1",
      "setting_screen": "SECURITY",
      "setting_name": "security.externalAuthSettings.samlEnabled",
      "old_value": "false",
      "new_value": "true"
    },
    {
      "time": "2021-01-05T23:00:01Z",
      "actor": "John White ( jwhite@corporate-email.com )",
      "ip_address": "192.168.0.1",
      "setting_screen": "SECURITY",
      "setting_name": "security.externalAuthSettings.samlSettings.idpName",
      "old_value": "onelogin",
      "new_value": "Duo"
    }
  ]
}

Delete Audit Report

Deletes an existing audit report.

Request

DELETE /pubapi/v1/audit/{type}/{id}

Path Parameters

Example Request

curl -i -X DELETE "https://{domain}.egnyte.com/pubapi/v1/audit/logins/{id}" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Response

204 No Content

No response body is returned on successful deletion.

Error Codes

Example Error Response

{
  "Errors": [
    {
      "description": "Audit report does not exist.",
      "code": "404"
    }
  ]
}

Related Resources

• Audit Reporting API v2 — For streaming audit events from the last 7 days using cursor-based pagination
• Authentication — How to obtain and refresh OAuth tokens
• User Management API — Manage users and permissions