openapi: 3.0.0 info: description: >- This is the OAS 3.0 specification for the Audit Producer API in Sophos Central. version: 1.0.0 contact: email: central-nitro-pod@sophos.com name: Central Nitro Pod url: 'https://developer.sophos.com' title: Audit Events API tags: - name: Audit Events description: List and read audit events. servers: - url: 'https://api.central.sophos.com/audit/v1' description: Global service in the production environment. security: - bearerAuth: [] paths: /audit-events: get: summary: Get audit events description: List audit events. x-soph-permissions: 'logs_reports:read' operationId: getAuditEvents tags: - Audit Events parameters: - name: X-Partner-ID in: header description: Optional partner ID. required: false schema: type: string format: uuid - name: X-Organization-ID in: header description: Optional organization ID. required: false schema: type: string format: uuid - name: X-Tenant-ID in: header description: Optional tenant ID. required: false schema: type: string format: uuid - name: startDate in: query description: 'Start date, no earlier than 90 days.' required: true schema: type: string format: date-time - name: endDate in: query description: Up to this end date. required: false schema: type: string format: date-time - name: originIpAddress in: query description: Origin IP Address. required: false schema: type: string maxLength: 128 - name: modifiedBy in: query description: Modifier's email. required: false schema: type: string format: email - name: modifierAccountId in: query description: Modifier account id. required: false schema: type: string format: uuid - name: resourceOwnerId in: query description: Resource owner id. required: false schema: type: string format: uuid - in: query name: pageFromKey required: false schema: type: string description: The key of the item from where to fetch a page. - in: query name: pageSize required: false schema: type: integer default: 50 description: The size of the page requested. - name: fields description: The fields to return in a partial response. in: query style: form explode: false schema: type: array items: type: string responses: '200': description: Paged list of audit events for the tenant. content: application/json: schema: type: object description: Page of audit events. required: - items - pages properties: items: description: Page of audit events. type: array items: description: Details of an audit event. type: object required: - id - occurredAt x-parent: true properties: id: description: Unique identifier for the audit event. type: string format: uuid occurredAt: description: When the event occurred. type: string format: date-time modifiedBy: description: >- Identifier of the actor that modified the item (for example, an email). type: string format: email itemType: description: >- Type of item modified in the audit log; corresponds to the Item Type in audit reports. type: string itemModified: description: Identifier of the item that was modified. type: string description: description: Description of the audit event. type: string originIpAddress: description: IP address associated with the event. type: string resourceOwnerId: description: Identifier of the resource owner; may be empty. type: string format: uuid resourceOwnerType: description: Type of the resource owner for the audited item. type: string modifierType: description: >- Category of the actor that performed the modification. type: string modifierAccountId: description: Account identifier of the modifier. type: string format: uuid modifierAccountType: description: Account type for the modifier. type: string pages: type: object required: - size - maxSize properties: fromKey: type: string description: The key of the first item in the returned page. nextKey: type: string description: The key to use when fetching the next page. size: type: integer description: The size of the page being returned. maxSize: type: integer description: The maximum page size that can be requested. examples: PageWithEvents: summary: First page with one event value: items: - id: 4e3b2978-ab6c-4891-9a7d-4d991d8c0fbc occurredAt: '2026-05-20T17:39:24.480Z' modifiedBy: cdb.qa.3@example.com itemType: AUTHENTICATION itemModified: cdb.qa.3@example.com description: SUCCESSFUL_AUTHENTICATION originIpAddress: 195.171.192.19 resourceOwnerId: 47fca5ed-3620-4a81-8bd7-e127af39b494 resourceOwnerType: TENANT modifierType: TENANT_ADMIN modifierAccountId: 5c487584-9cfc-4de1-bd71-dcc0189a1810 modifierAccountType: Customer pages: fromKey: 58fd4443-3b28-4206-92e8-8e07065e85b7 nextKey: edd7fa83-2733-47b2-b51a-634236cc8a2f size: 100 maxSize: 500 EmptyPage: summary: No events match the query value: items: [] pages: size: 100 maxSize: 500 '400': description: Bad request. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri example: error: badRequest message: Bad request. correlationId: 715be156-6561-4fc4-8cbe-11a5a49ce440 requestId: 2dd71c0b-e5fb-41ba-ba15-367eefee54ee '401': description: Unauthorized. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri '500': description: Unexpected error. content: application/json: schema: type: object required: - error properties: error: type: string message: type: string correlationId: type: string format: uuid code: type: string createdAt: type: string format: datetime requestId: type: string format: uuid docUrl: type: string format: uri example: error: internalServerError message: Internal Server Error. correlationId: df88bf88-471b-49d6-8a5e-07a26964d2ec requestId: 85073630-8ad8-46da-bf64-cb1e8b6f864b components: securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT