Audit Reporting API v2

The Audit Reporting API v2 lets you retrieve audit records for login activity, file actions, permission changes, configuration changes, and more. This streaming API provides near real-time access to events from the last 7 days.

Base URL

https://{domain}.egnyte.com/pubapi/v2/audit

Authentication

All requests require an OAuth 2.0 Bearer token in the Authorization header:

Authorization: Bearer {access_token}

Only admin users or power users with the "can run reports" role can access this API. See Authentication for details on obtaining a token.

Rate Limits

• 10 requests per minute
• 100 requests per hour

When rate limited, the API returns HTTP 429 with a Retry-After header indicating the number of seconds to wait before retrying. Implement exponential backoff or respect the Retry-After value.

How It Works

The Audit Reporting API v2 streams events using a cursor-based pagination model:

1. Initial request: Specify a startDate within the last 7 days
2. Parse response: Extract the nextCursor and events array (up to 5,000 events per request)
3. Subsequent requests: Use the nextCursor to retrieve the next batch
4. Check moreEvents: When false, you've retrieved all available events up to the current time
5. Repeat: Continue polling with the latest cursor to retrieve new events as they occur

Each request returns events spanning up to 30 minutes of history. If fewer than 5,000 events occurred in that window, the nextCursor advances to the next 30-minute span. If 5,000 events are returned, the cursor points to the last event to ensure no events are missed.

Retrieve Audit Events

Retrieve audit events for a specified date range or continue streaming from a cursor.

Request

GET /pubapi/v2/audit/stream
POST /pubapi/v2/audit/stream

Query Parameters (GET)

* Either startDate or nextCursor is required, but not both.

Request Body (POST)

* Either startDate or nextCursor is required, but not both.

Example Request (GET)

curl -i -X GET "https://{domain}.egnyte.com/pubapi/v2/audit/stream?startDate=2021-12-08" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

Example Request (POST)

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v2/audit/stream" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "startDate": "2021-12-08",
  "endDate": "2021-12-10",
  "auditType": [
    "FILE_AUDIT",
    "LOGIN_AUDIT",
    "PERMISSION_AUDIT"
  ]
}'

Example Request with Cursor

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v2/audit/stream" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "nextCursor": "QmlnVGFibGVLZXk="
}'

Response

200 OK

Event Object (FILE_AUDIT)

Event Object (USER_AUDIT)

Event Object (GROUP_AUDIT)

Example Response

{
  "nextCursor": "AAN_lwABAX1zZe9AAAAAAAAAAAAAAAAAAAAAAA",
  "events": [
    {
      "date": 1638936585716,
      "sourcePath": "/Shared/Departments/Marketing/Branding/Logo.jpg",
      "targetPath": "N/A",
      "user": "Jack Smith ( jsmith@company.com )",
      "userId": "101",
      "action": "Preview",
      "access": "Web UI",
      "ipAddress": "173.226.89.189",
      "actionInfo": "",
      "auditSource": "FILE_AUDIT"
    },
    {
      "date": 1638937051697,
      "sourcePath": "/Shared/Departments/Engineering/ProductY/Photo.png",
      "targetPath": "N/A",
      "user": "Adam Jackson ( ajackson@company.com )",
      "userId": "146",
      "action": "Upload",
      "access": "Web UI",
      "ipAddress": "172.8.18.17",
      "actionInfo": "",
      "auditSource": "FILE_AUDIT"
    },
    {
      "date": 1638940605824,
      "actor": "Jennifer Watkins ( jwatkins@company.com )",
      "subject": "Paul Chen ( pchen@company.com )",
      "action": "Disable",
      "actionInfo": "",
      "source": "Web UI",
      "auditSource": "USER_AUDIT"
    },
    {
      "date": 1638942414189,
      "actor": "Jennifer Watkins ( jwatkins@company.com )",
      "group": "Engineering",
      "action": "Create",
      "actionInfo": "",
      "source": "Web UI",
      "auditSource": "GROUP_AUDIT"
    }
  ],
  "moreEvents": true
}

Error Codes

Code Examples

GET /pubapi/v2/audit/stream?startDate=2021-12-08

curl -i -X GET "https://{domain}.egnyte.com/pubapi/v2/audit/stream?startDate=2021-12-08" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN"

POST /pubapi/v2/audit/stream

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v2/audit/stream" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "nextCursor": "AAN_lwABAX1zZe9AAAAAAAAAAAAAAAAAAAAAAA"
}'

POST /pubapi/v2/audit/stream

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v2/audit/stream" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "startDate": "2021-12-08",
  "auditType": [
    "FILE_AUDIT",
    "LOGIN_AUDIT",
    "PERMISSION_AUDIT"
  ]
}'

POST /pubapi/v2/audit/stream

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v2/audit/stream" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "startDate": "2021-12-08"
}'

POST /pubapi/v2/audit/stream

curl -i -X POST "https://{domain}.egnyte.com/pubapi/v2/audit/stream" \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer YOUR_ACCESS_TOKEN" \
     -d '{
  "startDate": "2021-12-08"
}'

Related Resources

• Audit Reporting API v1 — For retrieving audit events older than 7 days
• Authentication — How to obtain and refresh OAuth tokens
• User Management API — Manage users and permissions