Skip to content

Get audit events

GET/audit-events

Audit Events API · Audit Events

List audit events.

Required permissionlogs_reports:read

Parameters

Name In Type Required Description
X-Partner-ID header string (uuid) No Optional partner ID.
X-Organization-ID header string (uuid) No Optional organization ID.
X-Tenant-ID header string (uuid) No Optional tenant ID.
startDate query string (date-time) Yes Start date, no earlier than 90 days.
endDate query string (date-time) No Up to this end date.
originIpAddress query string No Origin IP Address.
Must be at most 128 characters long.
modifiedBy query string (email) No Modifier's email.
modifierAccountId query string (uuid) No Modifier account id.
resourceOwnerId query string (uuid) No Resource owner id.
pageFromKey query string No The key of the item from where to fetch a page.
pageSize query integer No The size of the page requested.
fields query array of string No The fields to return in a partial response.

Request samples

curl -X GET "https://api.central.sophos.com/audit/v1/audit-events?startDate=<startDate>" -H "Authorization: Bearer <access-token>" -H "X-Partner-ID: <partner-id>" -H "X-Organization-ID: <organization-id>" -H "X-Tenant-ID: <tenant-id>"


import requests

response = requests.get(
    "https://api.central.sophos.com/audit/v1/audit-events?startDate=<startDate>",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Partner-ID": "<partner-id>",
        "X-Organization-ID": "<organization-id>",
        "X-Tenant-ID": "<tenant-id>",
    },
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Partner-ID" = "<partner-id>"
    "X-Organization-ID" = "<organization-id>"
    "X-Tenant-ID" = "<tenant-id>"
}
Invoke-RestMethod -Method GET -Uri "https://api.central.sophos.com/audit/v1/audit-events?startDate=<startDate>" -Headers $headers


package main

import (
    "fmt"
    "io"
    "net/http"
)

func main() {
    req, err := http.NewRequest("GET", "https://api.central.sophos.com/audit/v1/audit-events?startDate=<startDate>", nil)
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Partner-ID", "<partner-id>")
    req.Header.Set("X-Organization-ID", "<organization-id>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api.central.sophos.com/audit/v1/audit-events?startDate=<startDate>", {
  method: "GET",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Partner-ID": "<partner-id>",
    "X-Organization-ID": "<organization-id>",
    "X-Tenant-ID": "<tenant-id>",
  },
});
const data = await response.json();
console.log(data);

Responses

200 — Paged list of audit events for the tenant.

Response fields

itemsarray of objectrequired
Page of audit events.
Details of an audit event.
Show child attributesHide child attributes
idstring (uuid)required
Unique identifier for the audit event.
occurredAtstring (date-time)required
When the event occurred.
modifiedBystring (email)
Identifier of the actor that modified the item (for example, an email).
itemTypestring
Type of item modified in the audit log; corresponds to the Item Type in audit reports.
itemModifiedstring
Identifier of the item that was modified.
descriptionstring
Description of the audit event.
originIpAddressstring
IP address associated with the event.
resourceOwnerIdstring (uuid)
Identifier of the resource owner; may be empty.
resourceOwnerTypestring
Type of the resource owner for the audited item.
modifierTypestring
Category of the actor that performed the modification.
modifierAccountIdstring (uuid)
Account identifier of the modifier.
modifierAccountTypestring
Account type for the modifier.
pagesobjectrequired
Show child attributesHide child attributes
fromKeystring
The key of the first item in the returned page.
nextKeystring
The key to use when fetching the next page.
sizeintegerrequired
The size of the page being returned.
maxSizeintegerrequired
The maximum page size that can be requested.

Errors

Status Meaning
400 Bad request.
401 Unauthorized.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "items": [
    {
      "id": "4e3b2978-ab6c-4891-9a7d-4d991d8c0fbc",
      "occurredAt": "2026-05-20T17:39:24.480Z",
      "modifiedBy": "cdb.qa.3@example.com",
      "itemType": "AUTHENTICATION",
      "itemModified": "cdb.qa.3@example.com",
      "description": "SUCCESSFUL_AUTHENTICATION",
      "originIpAddress": "195.171.192.19",
      "resourceOwnerId": "47fca5ed-3620-4a81-8bd7-e127af39b494",
      "resourceOwnerType": "TENANT",
      "modifierType": "TENANT_ADMIN",
      "modifierAccountId": "5c487584-9cfc-4de1-bd71-dcc0189a1810",
      "modifierAccountType": "Customer"
    }
  ],
  "pages": {
    "fromKey": "58fd4443-3b28-4206-92e8-8e07065e85b7",
    "nextKey": "edd7fa83-2733-47b2-b51a-634236cc8a2f",
    "size": 100,
    "maxSize": 500
  }
}

See the guide for a narrative walkthrough of this API.