Audit Logging | MuleSoft Documentation
# Audit Logging
The audit logging service provides a queryable history of actions performed within Anypoint Platform. It keeps track of all user interactions with objects in the system and timestamps those actions. Audit logging also provides mechanisms for querying the set of users who performed actions, the set of objects that had actions performed on them, and other endpoints that enable log entry querying.
Audit logs have a default retention period of one year. If your organization was created before July 10, 2023 and you didn’t manually change the retention period, the retention period is six years. Users who have the Organization Administrator and Audit Log Config Manager permissions can customize the retention period. For more information, see Audit Log Retention Period. Download your logs periodically to retain your log files for longer than the current retention period.
You can access the data logs through the audit logging query API or through the audit logging UI.
## Access Audit Logging
Users who have Anypoint Platform Organization Administrator permission or the Audit Log Viewer permission have access to both the UI and the Audit Log Query API. The audit log service is business-group aware, which means you see only logs that are relevant to your own business group.
The audit log UI is embedded in Access Management.
  1. Log in to Anypoint Platform.
  2. In the navigation bar or the main Anypoint Platform page, click **Access Management**.
  3. In the Access Management navigation menu, click **Audit Logs**.


The **Audit Logs** page displays the logs. You can:
  * Download audit logs.
  * Set a time period for showing audit logs.
  * Filter audit logs by product, type, and actions.
  * Search audit logs by environment, object, and user.


## Export Audit Logs
If you have the Anypoint Integration Advanced package or a Titanium subscription to Anypoint Platform, you can use the Telemetry Exporter feature in Anypoint Monitoring to export audit logs to third-party analytics and observability apps.
When exported, audit logs have a unique ID in the `mulesoft.audit.id` attribute. In usual operations, each log is delivered only once, but under certain circumstances, some logs are delivered more than once. Duplicate log entries always share the unique `mulesoft.audit.id` attribute, so this attribute can be used to safely block or remove duplicate logs from the target system.
Telemetry Exporter for audit logs currently has these data differences, limitations, and known issues:
  * The audit logs that the Telemetry Exporter sends to third-party apps often have different field names from the audit logs that appear in Access Management or the Audit Query Log API. For example, audit logs shown in the UI or retrieved by the Audit Log Query API describe a user action (such as `update` or `delete`) as `action`, whereas the OpenTelemetry attribute refers to it as `mulesoft.audit.action`.
  * If the audit log entry metadata and payload field exceed 30KB when compressed, the payload is truncated before compression.


## Audit Log Contents
Activities in the audit log are actions that occur at a particular time, involve one or more objects, have an action type (such as `delete` or `approve`) associated with the objects, and optionally a payload that can store application-specific information such as changed fields, environment information, and so on.
Each log entry has a set of properties that provides information about the activity:
  * **Time** : Timestamp when the activity occurred
  * **Product** : Product where the object resides, for example, `Access Management`
  * **Type** : Type of object the action is performed, for example, `Organization`
  * **Action** : Action associated with the object, for example, `Create`
  * **Object** : Name of the object, for example, `foo`
  * **User Name** : User who performed the action, for example, `johndoe`
Occasionally, there are `Anypoint Staff` log entries. This log entry is made when the audit action was performed by a user who doesn’t belong to your organization. `Anypoint Staff` entries are created when these events occur:
    * An internal or system process that’s a routine part of Anypoint Platform operations is performed
    * The MuleSoft procurement staff changes entitlements for your organization as a result of license grants
    * An action is performed by a MuleSoft employee on your behalf for other purposes, such as troubleshooting  
---  
  * **Connected App** : Name of the connected app that takes an action on behalf of itself or a user. If a connected app didn’t execute the action, the payload is `N/A`.
  * **Environment** : Environment names for events from API Manager, Runtime Manager, CloudHub, Partner Manager, and MQ.
  * **Parent** : (Optional) Parent of the object (if any) the action is performed on. The mainly applies to APIs.
  * **Payload** : (Optional) More information about the log properties. For example, if an organization is created, the payload contains information about the organization and the owner, such as IDs.
This a list of actions per product and object type that Anypoint Platform audits:
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Subaction: None Properties: New T&Cs  
Subaction: None Properties: New T&Cs  
Set org custom theme |  Portal theme |  Subaction: None Properties: Theme data  
Edit org custom theme |  Subaction: None Properties: Theme data  
Add custom policy |  Subaction: None Properties: None  
Delete custom policy |  Subaction: None Properties: Policy data  
### APIs
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Subaction: None Properties: None  
Subaction: None Properties: None  
Subaction: None Properties: None  
Update label of API |  Subaction: None Properties: API object  
Update consumer endpoint of API |  Edit - update endpoint |  Subaction: None Properties: API object  
Update endpoint URI of API |  Edit - edit endpoint URI |  Subaction: None Properties: API object  
### API Versions
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create API version |  API version |  Subaction: None Properties: None  
Delete API version |  API version |  Subaction: None Properties: None  
API version |  Subaction: Import API version Properties: None  
Edit name of API version |  API version |  Subaction: Edit name Properties: New name  
Edit description of API version |  API version |  Subaction: Edit description Properties: New description  
Edit API URL of API version |  API version |  Subaction: Edit API URL Properties: New API URL  
API Version |  Subaction: Add tag Properties: New tag  
API Version |  Subaction: Remove tag Properties: Deleted tag  
Deprecate API |  API version |  Subaction: Deprecate API Properties: None  
API Version |  Subaction: Set terms & conditions Properties: T&Cs  
Create RAML |  API Version |  Subaction: Create RAML Properties: None  
Modify RAML |  API Version |  Subaction: Edit RAML Properties: Updated RAML files  
Create endpoint |  API version |  Subaction: Create endpoint Properties: New endpoint  
Update existing endpoint |  API version |  Subaction: Update endpoint Properties: Create endpoint  
Deploy proxy |  API Version |  Subaction: None Properties: Deploy location (app name & server name for hybrid)  
Update deployed proxy |  API version |  Subaction: Configure endpoint Properties: New endpoint  
Redeploy proxy |  API Version |  Subaction: None Properties: Deploy location (app name & server name for hybrid)  
Create SLA tier |  Subaction: None Properties: SLA settings  
Modify SLA tier |  Subaction: None Properties: SLA settings  
Deprecate SLA tier |  Subaction: Deprecate SLA tier Properties: SLA settings  
Delete SLA tier |  Subaction: None Properties: None  
Apply policy |  Subaction: None Properties: Policy settings  
Edit policy |  Subaction: None Properties: Policy settings  
Remove policy |  Subaction: None Properties: None  
### Application
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create application |  Application |  Subaction: None Properties: Application  
Delete application |  Application |  Subaction: None Properties: None  
Reset client secret |  Application |  Edit - reset client secret |  Subaction: Reset client secret Properties: None  
Request access |  Object 1: App ID Object 2: API version ID |  Subaction: None Properties: SLA tier  
Request tier change |  Object 1: App ID Object 2: API version ID |  Edit - request tier change |  Subaction: Request tier change Properties: New tier  
Request tier change approval |  Object 1: App ID Object 2: API version ID |  Edit - request tier change approval |  Subaction: Request tier change approval Properties: New tier  
Approve application |  Object 1: App ID Object 2: API version ID |  Edit - contract approval |  Subaction: Contract approval Properties: SLA tier  
Revoke application |  Object 1: App ID Object 2: API version ID |  Edit - contract revoke |  Subaction: Contract revoked Properties: SLA tier  
Restore application |  Object 1: App ID Object 2: API version ID |  Edit - contract restore |  Subaction: Contract restored Properties: SLA tier  
The `Create Application` and `Delete Application` actions are logged at the root organization level.
## Access Management
### Users
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Signup / Organization creation |  Subaction: None Properties: Organization ID  
User creation (w/out creating an org) |  Subaction: None Properties: UserID  
Password reset requested |  Subaction: Password reset Properties: None  
Password changed |  Subaction: Password changed Properties: None  
Delete user |  Subaction: None Properties: User object  
Disable user |  Subaction: Disable user Properties: None  
Login success |  Subaction: None Properties: None  
Login success reauthenticate |  Login - Reauthenticate |  Subaction: Reauthenticate Properties: None  
Login failure |  Subaction: Failure Properties: Error message  
Login failure reauthentication |  Login - Reauthentication Failure |  Subaction: Reauthentication Failure Properties: Error message  
Subaction: None Properties: None  
  * `Login` and `Logout` actions are logged only at the organization level.
  * `Login failure` actions are logged only against existing user accounts.
  * `Login failure` actions aren’t logged if you are using SSO configured with LDAP or OIDC, which includes login failures to Anypoint Platform Private Cloud Edition (Anypoint Platform PCE).

  
---  
### Roles
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create role |  Subaction: None Properties: None  
Edit role - add user |  Object 1: Role Object 2: User |  Object 1: Role Object 2: User |  Subaction: Add user Properties: Role, User  
Edit role - remove user |  Object 1: Role Object 2: User |  Object 1: Role Object 2: User |  Subaction: Remove user Properties: Role, User  
Edit role - change external group mapping |  Subaction: Edit role mapping Properties: New mapping  
Delete role |  Subaction: None Properties: Role metadata  
### Permissions
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
User permission change |  Object 1: User Object 2: Resource |  Parent 1: N/A Parent 2: Resource parent if applicable |  Permissions change |  Subaction: None Properties: New permission  
Role permission change |  Object 1: Role Object 2: Resource |  Parent 1: N/A Parent 2: Resource parent if applicable |  Permissions change |  Subaction: None Properties: New permission  
Environment permissions change |  Permissions change |  Subaction: None Properties: New permissions  
### Identity Management
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create identity provider configuration |  Identity management |  Provider name |  Subaction: None  
Edit identity provider configuration |  Identity management |  Provider name |  Subaction: None  
Delete identity provider configuration |  Identity management |  Provider name |  Subaction: None  
Object 1: Identity management Object 2: User |  Object 1: Provider name Object 2: UserID |  Subaction: None Properties: Message  
Create identity management key |  Identity management key |  Subaction: None  
Set primary identity management key |  Identity management key |  Subaction: Set primary key Properties:
  * old_primary_provider_key_id
  * provider_key_id
Delete identity management key |  Identity management key |  Subaction: None  
### Organization and Business Groups
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Edit domain name |  Organization |  Subaction: None Properties: New name  
Create business group |  Organization |  Parent organization |  Subaction: None Properties: Org object  
Edit business group name |  Organization |  Parent organization |  Subaction: Edit name Properties: New group name  
Edit business group owner |  Organization |  Parent organization |  Subaction: Edit owner Properties: New owner userID  
Edit business group entitlement |  Entitlement |  Subaction: Edit entitlement Properties: Entitlement change  
Delete business group |  Organization |  Parent organization |  Subaction: None Properties: Org object  
### Environments
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create environment |  Environment |  Subaction: None Properties: None  
Delete environment |  Environment |  Subaction: None Properties: Environment metadata  
Rename environment |  Environment |  Subaction: None Properties: Environment name |  Environments that are created automatically when you create an organization or business group do not have audit log entries. As Anypoint Platform has evolved, the default environments created have also changed over time. Currently, `Sandbox` and `Design` are created automatically and do not have audit log entries.   
---  
### Connected Apps
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create Connected Application |  Connected Application |  Subaction: None Properties:
  * clientName
  * clientID
  * clientIP
  * orgID
  * grantTypes

  
Edit Connected Application |  Connected Application |  Subaction: None Properties:
  * clientName
  * clientID
  * clientIP
  * orgID
  * grantTypes

  
Delete Connected Application |  Connected Application |  Subaction: None Properties:
  * clientName
  * clientID
  * clientIP
  * orgID
  * grantTypes

  
Update Scope Assignments |  Connected Application |  Permissions Change |  Subaction: Add Assignments Properties: Scopes  
Application Authorization Approved |  External Authorization |  Subaction: None Properties: None  
Application Authorization Denied |  External Authorization |  Subaction: None Properties: None  
Token Retrieval Success |  Connected Application |  Login - Token |  Subaction: Token Properties:
  * clientName
  * clientID
  * clientIP
  * orgID
  * grantTypes

  
Token Retrieval Failed |  Connected Application |  Login - Token |  Subaction: Token Properties:
  * clientID
  * clientIP
  * Error Message

  
Revoke Access/Refresh Tokens |  Connected Application |  Revoke Tokens |  Subaction: None Properties:
  * clientName
  * clientID
  * clientIP
  * orgID
  * grantTypes

  
### Teams
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create Team |  Subaction: None Properties:
  * org_id
  * team_id
  * team_name
  * team_type
  * created_at
  * updated_at
  * ancestor_team_ids

  
Update Team |  Subaction: None Properties:
  * org_id
  * team_id
  * team_type
  * ancestor_team_ids

  
Subaction: None Properties:
  * org_id
  * team_id
  * team_type
  * ancestor_team_ids
  * previous_ancestor_team_ids

  
Add Members |  Subaction: Add Members Properties:
  * array of:
    * id (Member/Maintainer ID)
    * membership_type

  
Remove Members |  Subaction: Remove Members Properties:
  * Removed Member ID

  
Add Permissions |  Permissions change |  Subaction: Add permissions Properties:
  * name (Permission Name)
  * role_id (Permission ID)
  * context_params)

  
Remove Permissions |  Permissions change |  Subaction: Remove permissions Properties:
  * name (Permission Name)
  * role_id (Permission ID)
  * context_params)

  
Edit External Group Mappings |  Subaction: Edit external group mapping Properties:
  * data:
    * provider_id
    * membership_type
    * external_group_name
  * total

  
Delete Team |  Subaction: None Properties:
  * org_id
  * team_id
  * ancestor_team_ids

  
### User IdP Profiles
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create User IdP Profile |  User IdP Profile |  Subaction: None Properties:
  * userId
  * idpUserId
  * providerId
  * loginProfileData

  
## Anypoint DataGraph
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
data-graph-{api-name}-{env-name}  
data-graph-{api-name}-{env-name}  
data-graph-{api-name}-{env-name}  
## Anypoint MQ
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create/modify/delete/purge queue |  Create/modify/delete |  Subaction: None Properties: Queue metadata  
Create/modify/delete exchange |  Create/modify/delete |  Subaction: None Properties: Exchange metadata  
Create/delete exchange binding |  Create/delete |  Subaction: None Properties: Exchange metadata  
Create/delete/regenerate client |  Create/delete/regenerate |  Subaction: None Properties: Client metadata  
## API Designer APIs
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create project |  Create project |  Subaction: None Properties:
  * orgID
  * userID
  * projectName

  
Delete project |  Delete project |  Subaction: None Properties:
  * orgID
  * userID
  * projectName

  
Delete files |  Delete files |  Subaction: None Properties:
  * orgID
  * userID
  * projectName

  
Rename project |  Rename project |  Subaction: None Properties:
  * orgID
  * userID
  * newProjectName

  
Clean branch |  Clean branch |  Subaction: None Properties:
  * orgID
  * userID
  * branchName

  
Create branch |  Create branch |  Subaction: None Properties:
  * orgID
  * userID
  * branchName

  
Delete branch |  Delete branch |  Subaction: None Properties:
  * orgID
  * userID
  * branchName

  
Save branch |  Save branch |  Subaction: None Properties:
  * orgID
  * userID
  * branchName

  
Delete file |  Delete file |  Subaction: None Properties:
  * orgID
  * userID
  * File Path

  
Subaction: None Properties:
  * orgID
  * userID
  * targetFile

  
Import project |  Import project |  Subaction: None Properties:
  * orgID
  * userID
  * branchName

  
Publish to Exchange |  Publish to Exchange |  Subaction: None Properties:
  * orgID
  * userID
  * projectName

  
Publish to API Platform |  Publish to API Platform |  Subaction: None Properties:
  * orgID
  * userID
  * projectName

  
Add dependencies |  Add dependencies |  Subaction: None Properties:
  * orgID
  * userID
  * dependencies

  
Remove dependencies |  Remove dependencies |  Subaction: None Properties:
  * orgID
  * userID
  * dependencies

  
Change dependencies |  Change dependencies |  Subaction: None Properties:
  * orgID
  * userID
  * addDependencies
  * removeDependencies

  
Reload dependencies |  Reload dependencies |  Subaction: None Properties:
  * orgID
  * userID
  * branchName

  
Merge Branch |  Merge Branch |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * branchName

  
Share project |  Share project |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * projectID

  
Sync with Github |  Sync with Github |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * repositoryName

  
Unsync with Github |  Unsync with Github |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * projectID

  
Modify organization settings |  Organization ID |  Modify organization settings |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * projectID

  
Rename branch |  Rename branch |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * branchName

  
Modify project settings |  Modify project settings |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * projectID
Reload dependencies |  Reload dependencies |  Subaction: None Properties:
  * orgID
  * userID
  * branchName

  
Merge Branch |  Merge Branch |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * branchName

  
Share project |  Share project |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * projectID

  
Sync with Github |  Sync with Github |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * repositoryName

  
Unsync with Github |  Unsync with Github |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * projectID

  
Modify organization settings |  Organization ID |  Modify organization settings |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * projectID

  
Rename branch |  Rename branch |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * branchName

  
Modify project settings |  Modify project settings |  Subaction: None Properties:
  * orgID
  * projectID
  * userID
  * projectID

  
### Mocking Service
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create link |  Subaction: Create Link Properties: Link metadata  
Delete link |  Subaction: Delete Link Properties: Link metadata  
### Portals
These actions apply to API Manager v1.x portals:
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create portal |  Object 1: Portal ID Object 2: API Version ID |  Subaction: None Properties: None  
Modify portal association |  Object 1: Portal ID Object 2: API version ID |  Subaction: Change portal association Properties: None  
Delete portal |  Subaction: None Properties: None  
Add portal page |  Subaction: Add portal page Properties: Page content  
Make portal page visible |  Subaction: Make page visible Properties: Page content  
Delete portal page |  Subaction: Delete portal page Properties: Page content  
Edit portal page |  Subaction: Edit portal page Properties: Page content  
Hide portal page |  Subaction: Hide portal page Properties: Page content  
Set portal theme |  Subaction: Set portal theme Properties: Theme settings  
Modify portal theme |  Subaction: Modify portal theme Properties: Theme settings  
Modify portal security |  Subaction: Set security Properties: Public / private state  
## API Governance
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create profile |  Profile name |  Subaction: None Properties: None  
Update profile |  Profile name |  Subaction: None Properties: None  
Delete profile |  Profile name |  Subaction: None Properties: None  
Activate profile |  Profile name |  Subaction: None Properties: None  
## Exchange
### Assets
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create an asset |  Subaction: None Properties: Asset object  
Update an asset |  Subaction: None Properties: Asset object  
Delete an asset |  Subaction: None Properties: None  
Share an asset |  Granted or revoked permissions |  Subaction: None Properties:
  * Asset object
  * Source
  * Target

  
Publish an asset to public portal |  Asset Version Group |  Asset ID and version group |  Publish to public portal |  Subaction: None Properties: Asset ID, name and type  
Remove an asset from public portal |  Asset Version Group |  Asset ID and version group |  Remove from public portal |  Subaction: None Properties: Asset ID, name and type  
Update an asset icon |  Subaction: None Properties: Asset object  
Delete an asset icon |  Subaction: None Properties: Asset object  
Create a managed tag (category) |  Asset managed tag |  Asset ID and tag ID |  Subaction: None Properties: None  
Delete a managed tag (category) |  Asset managed tag |  Asset ID and tag ID |  Subaction: None Properties: None  
Delete an organization |  Organization |  Organization ID |  Subaction: None Properties: None  
Update tags |  Subaction: None Properties: Tags  
Create a tag configuration |  Tag configuration |  Tag configuration ID |  Subaction: None Properties: TagConfiguration  
Update a tag configuration |  Tag configuration |  Tag configuration ID |  Subaction: None Properties: TagConfiguration  
Delete a tag configuration |  Tag configuration |  Tag configuration ID |  Subaction: None Properties: None  
### Asset Portals
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create a page |  Asset portal page |  Asset portal |  Subaction: None Properties:
  * Asset object

  
Update a page |  Asset portal page |  Asset portal |  Subaction: None Properties:
  * Asset object

  
Delete a page |  Asset portal page |  Asset portal |  Subaction: None Properties: None  
Create a portal |  Asset portal |  Subaction: None Properties: Asset portal  
Publish a portal |  Asset portal |  Subaction: None Properties: Asset portal  
### API Metadata
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create an API instance |  API instance |  API instance ID |  Subaction: None Properties:
  * isPublic

  
Delete an API instance |  API instance |  API instance ID |  Subaction: None Properties:
  * isPublic

  
Update an API instance |  API instance |  API instance ID |  Subaction: None Properties:
  * isPublic

  
### File Upload
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Upload file |  Exchange file |  Subaction: None Properties: File key  
Delete file |  Exchange file |  Subaction: None Properties: File key  
Update file |  Exchange file |  Subaction: None Properties: File key  
### Public Portals
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Update a domain |  Public portal domain |  Organization ID and domain |  Public portal |  Subaction: None Properties:
  * Portal ID
  * Domain

  
Delete a domain |  Public portal domain |  Organization ID and domain |  Public portal |  Subaction: None Properties:
  * Portal ID
  * Domain

  
Create a page |  Public portal page |  Public portal |  Subaction: None Properties:
  * Portal ID
  * Page ID

  
Delete a page |  Public portal page |  Public portal |  Subaction: None Properties:
  * Portal ID
  * Page ID

  
Update a page |  Public portal page |  Public portal |  Subaction: None Properties:
  * Portal ID
  * Page ID

  
Create a portal |  Public portal |  Organization ID |  Subaction: None Properties:
  * Project ID
  * Created by ID

  
Publish a portal |  Public portal |  Organization ID |  Subaction: None Properties:
  * Project ID
  * Created by ID

  
Delete a portal |  Public portal |  Organization ID |  Subaction: None Properties:
  * Project ID
  * Created by ID

  
Update a portal |  Public portal |  Organization ID |  Subaction: None Properties:
  * Project ID
  * Created by ID

  
### Asset Reviews
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create a Comment |  Asset portal review comment |  Asset portal review |  Subaction: None Properties: Comment  
Delete a comment |  Asset portal review comment |  Asset portal review |  Subaction: None Properties: Comment  
Update a comment |  Asset portal review comment |  Asset portal review |  Subaction: None Properties: Comment  
Create a review |  Asset portal review |  Subaction: None Properties: Review object  
Delete a review |  Asset portal review |  Subaction: None Properties: Review object  
Update a review |  Asset portal review |  Subaction: None Properties: Review object  
User action | Object type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create Document Action |  Document Action |  Document Action Id |  Subaction: none Properties:
  * Document Action Id
  * Timestamp
  * User Id
  * Document Action Name

  
Update Document Action |  Document Action |  Document Action Id |  Subaction: none Properties:
  * Document Action Id
  * Timestamp
  * User Id
  * Document Action Name

  
Add/Delete reviewers to/from a Document Action |  Document Action |  Document Action Id |  Subaction: none Properties:
  * Document Action Id
  * Timestamp
  * User Id
  * Reviewer Ids
Update Document Action |  Document Action |  Document Action Id |  Subaction: none Properties:
  * Document Action Id
  * Timestamp
  * User Id
  * Document Action Name

  
Add/Delete reviewers to/from a Document Action |  Document Action |  Document Action Id |  Subaction: none Properties:
  * Document Action Id
  * Timestamp
  * User Id
  * Reviewer Ids

  
Delete Document Action |  Document Action |  Document Action Id |  Subaction: none Properties:
  * Document Action Id
  * Timestamp
  * User Id
  * Document Action Name

  
Document Action Version Created |  Document Action Version |  Document Action Version Id |  Subaction: none Properties:
  * Document Action Id
  * Document Action Version Id
  * Timestamp
  * User Id
  * Document Action Name
  * Document Action Version Name

  
Document instance is reviewed |  Document Action Execution |  Document Action Execution Id |  Subaction: none Properties:
  * Document Action Execution Id
  * Document Action Id
  * Timestamp
  * User Id

  
## Object Store v2
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create/modify/delete store |  Create/modify/delete |  Subaction: None Properties: Store metadata  
The payload is split when it contains more than 32k (32768) characters. Split audit log entries have identical correlation IDs.  
---  
### Run Configurations
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create run configuration |  Run configuration |  Run configuration ID |  Subaction: None Properties:
  * Process name
  * Process ID
  * Process phase
  * Run configuration name
  * Run configuration description
  * Run configuration type
  * Run configuration priority
  * Activity parameters
    * Activity Parameter name
      * Mapping with <global variable/credential name>
  * User task user
  * User task group
  * Execution session type
  * Execution user
  * Execution taskbar option
  * Schedule Name
  * Bots
    * Bot name
    * Bot ID
    * Assigned sessions

  
Edit run configuration |  Run configuration |  Run configuration ID |  Subaction: None Properties:
  * Process name
  * Process ID
  * Process phase
  * Run configuration name
  * Run configuration description
  * Run configuration priority
  * Activity parameters
    * Activity Parameter name
      * Mapping with <global variable/credential name>
  * User task user
  * User task group
  * Execution session type
  * Execution user
  * Execution taskbar option
  * Schedules
    * Schedule name
  * Bots
    * Bot name
    * Bot ID
    * Assigned sessions

  
Delete run configuration |  Run configuration |  Run configuration ID |  Subaction: None Properties:
  * Process name
  * Process ID
  * Process phase
  * Run configuration name

  
Deploy run configuration |  Run configuration |  Run configuration ID |  Subaction: None Properties:
  * Process name
  * Process ID
  * Process phase
  * Run configuration name
  * Schedules
    * Schedule name
  * Bots
    * Bot name
    * Bot ID
    * Assigned sessions

  
Publish run configuration |  Run configuration |  Run configuration ID |  Subaction: None Properties:
  * Process name
  * Process ID
  * Process phase
  * Run configuration name

  
Revoke run configuration |  Run configuration |  Run configuration ID |  Subaction: None Properties:
  * Process name
  * Process ID
  * Process phase
  * Run configuration name

  
Pause run configuration |  Run configuration |  Run configuration ID |  Subaction: None Properties:
  * Process name
  * Process ID
  * Process phase
  * Run configuration name

  
Continue run configuration |  Run configuration |  Run configuration ID |  Subaction: None Properties:
  * Process name
  * Process ID
  * Process phase
  * Run configuration name

  
### Processes
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create process |  Subaction: none Properties:
  * Process name
  * Process phase
  * Applications required
    * Application name
  * Process team
    * Member name
    * Assigned phases
  * Advanced permissions option

  
Edit process |  Subaction: none Properties:
  * Process name
  * Process phase
  * Applications required
    * Application name
  * Process team
    * Member name
    * Assigned phases
  * Advanced permissions option

  
Delete process |  Subaction: none Properties:
  * Process name
  * Process phase

  
### Bots
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Register bot |  Subaction: none Properties:
  * Bot name
  * API key name
  * Bot version
  * IP address
  * Hostname
  * Time zone

  
Register bot |  Subaction: none Properties:
  * Bot name
  * API key name
  * Bot version
  * IP address
  * Hostname
  * Time zone
  * Bot status
  * Assigned Applications
    * Application name
  * Assigned service times
    * Service time name
  * Phase affiliation
  * Description
  * Assigned Secure Sessions

  
Subaction: none Properties:
  * Bot name

  
### Credential Pool
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create credential |  Credential ID |  Subaction: none Properties:
  * Credential name
  * Credential description
  * User affiliation
  * User group affiliation
  * Phase affiliation

  
Edit credential |  Credential ID |  Subaction: none Properties:
  * Credential name
  * Credential description
  * User affiliation
  * User group affiliation
  * Phase affiliation

  
Delete credential |  Credential ID |  Subaction: none Properties:
  * Credential name

  
### Global Variables
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create global variable |  Global variable |  Global variable ID |  Subaction: none Properties:
  * Global variable name
  * Global variable description
  * Phase affiliation

  
Edit global variable |  Global variable |  Global variable ID |  Subaction: none Properties:
  * Global variable name
  * Global variable description
  * Phase affiliation

  
Delete global variable |  Global variable |  Global variable ID |  Subaction: none Properties:
  * Global variable name

  
### Applications
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create Application |  Application |  Application ID |  Subaction: none Properties:
  * Application name
  * Application time zone
  * Downtimes
    * Downtime name

  
Edit Application |  Application |  Application ID |  Subaction: none Properties:
  * Application name
  * Application time zone
  * Downtimes
    * Downtime name

  
Delete Application |  Application |  Application ID |  Subaction: none Properties:
  * Application name

  
### Service Times
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create service time |  Service time |  Service time ID |  Subaction: none Properties:
  * Service time name
  * Timezone
  * Service time start
  * Service time end

  
Edit service time |  Service time |  Service time ID |  Subaction: none Properties:
  * Service time name
  * Timezone
  * Service time start
  * Service time end

  
Delete service time |  Service time |  Service time ID |  Subaction: none Properties:
  * Service time name
### Applications
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create Application |  Application |  Application ID |  Subaction: none Properties:
  * Application name
  * Application time zone
  * Downtimes
    * Downtime name

  
Edit Application |  Application |  Application ID |  Subaction: none Properties:
  * Application name
  * Application time zone
  * Downtimes
    * Downtime name

  
Delete Application |  Application |  Application ID |  Subaction: none Properties:
  * Application name

  
### Service Times
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create service time |  Service time |  Service time ID |  Subaction: none Properties:
  * Service time name
  * Timezone
  * Service time start
  * Service time end

  
Edit service time |  Service time |  Service time ID |  Subaction: none Properties:
  * Service time name
  * Timezone
  * Service time start
  * Service time end

  
Delete service time |  Service time |  Service time ID |  Subaction: none Properties:
  * Service time name

  
## Runtime Manager
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create application |  Application |  Subaction: None Properties: Application metadata  
Start application |  Application |  Subaction: None Properties: Application metadata  
Restart application |  Application |  Subaction: None Properties: Application metadata  
Stop application |  Application |  Subaction: None Properties: Application metadata  
Delete application |  Application |  Subaction: None Properties: Application metadata  
Change application zip file |  Application |  Subaction: None Properties: Application metadata  
Promote application from sandbox |  Application |  Subaction: None Properties: Application metadata  
Change application runtime |  Application |  Subaction: None Properties: Application metadata  
Change application worker size |  Application |  Subaction: None Properties: Application metadata  
Change application worker number |  Application |  Subaction: None Properties: Application metadata  
Enable/disable persistent queues |  Application |  Subaction: None Properties: Application metadata  
Enable/disable persistent queue encryption |  Application |  Subaction: None Properties: Application metadata  
Modify application properties |  Application |  Subaction: None Properties: Application metadata  
Enable/disable insight |  Application |  Subaction: None Properties: Application metadata  
Modify log levels |  Application |  Subaction: None Properties: Application metadata  
Create/modify/delete alerts |  Application |  Subaction: None Properties: Application metadata  
Enable/disable alerts |  Application |  Subaction: None Properties: Application metadata  
Create/modify/delete application data |  Application |  Subaction: None Properties: Application metadata  
Create/modify schedules |  Application |  Subaction: None Properties: Application metadata  
Create/modify/delete tenants |  Application |  Subaction: None Properties: Application metadata  
Enable/disable schedules |  Application |  Subaction: None Properties: Application metadata  
Clear queues |  Application |  Subaction: None Properties: Application metadata  
Enable/Disable static IP |  Application |  Subaction: None Properties: Application metadata  
Allocate/release static IP |  Application |  Subaction: None Properties: Application metadata  
LoadBalancer Create/modify/delete |  LoadBalancer |  LoadBalancerID |  Create/modify/delete |  Subaction: None Properties: LoadBalancer metadata  
Create/modify/delete alerts V2 |  Create/modify/delete |  Subaction: None Properties: Alert  
Create/modify/delete VPC |  Create/modify/delete |  Subaction: None Properties: VPC metadata  
Create/modify/delete VPN |  Create/modify/delete |  Subaction: None Properties: VPN metadata  
### Servers
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Subaction: None Properties: Server metadata  
Delete server |  Subaction: None Properties: Server metadata  
Rename server |  Subaction: Rename Properties: Server metadata  
Create server group |  Server group |  ServerGroupID |  Subaction: None Properties: Server group metadata  
Delete server group |  Server group |  ServerGroupID |  Subaction: None Properties: Server group metadata  
Rename server group |  Server group |  ServerGroupID |  Subaction: Rename Properties: Server group metadata  
Add server to server group |  Server group |  ServerGroupID |  Subaction: Add server Properties: Server group metadata  
Remove server from server group |  Server group |  ServerGroupID |  Subaction: Remove server Properties: Server group metadata  
Create cluster |  Subaction: None Properties: Cluster metadata  
Delete Cluster |  Subaction: None Properties: Cluster metadata  
Rename cluster |  Subaction: Rename Properties: Cluster metadata  
Add server to cluster |  Subaction: Add server Properties: Cluster metadata  
Remove server from cluster |  Subaction: Remove server Properties: Cluster metadata  
Deploy application |  Application |  ApplicationID |  Subaction: None Properties: Application metadata  
Delete application |  Application |  ApplicationID |  Subaction: None Properties: Application metadata  
Start application |  Application |  ApplicationID |  Subaction: None Properties: Application metadata  
Stop application |  Application |  ApplicationID |  Subaction: None Properties: Application metadata  
Redeploy application with existing file |  Application |  ApplicationID |  Subaction: None Properties: Application metadata  
Redeploy application with new file |  Application |  ApplicationID |  Subaction: Update binary Properties: Application metadata  
### Private Spaces in CloudHub 2.0
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create/Modify/Delete private space |  Private Space |  PrivateSpaceID |  Create/Modify/Delete |  Subaction: None Properties: Private space metadata  
Create/Modify/Delete connection |  Private Space |  PrivateSpaceID |  Create/Modify/Delete |  Subaction: None Properties: Connection metadata  
Create/Modify/Delete VPN |  Private Space |  PrivateSpaceID |  Create/Modify/Delete |  Subaction: None Properties: None  
Create/Modify/Delete transit gateway |  Private Space |  PrivateSpaceID |  Create/Modify/Delete |  Subaction: None Properties: Transit gateway metadata  
Create/Modify/Delete TLSContext |  Private Space |  PrivateSpaceID |  Create/Modify/Delete |  Subaction: None Properties: None  
Create/Modify/Delete routes |  Private Space |  PrivateSpaceID |  Create/Modify/Delete |  Subaction: None Properties:
  * Target
  * Route object

  
## Secrets Manager
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create a secret group |  secretGroup |  secretGroup name |  Subaction: None Properties:
  * secretGroup path
  * secrets manager transaction ID

  
Delete a secret group |  secretGroup |  secretGroup name |  Subaction: None Properties:
  * secretGroup path
  * secrets manager transaction ID

  
Create a secret |  a secret type such as sharedSecret |  secret name |  Subaction: None Properties:
  * secret path
  * secrets manager transaction ID

  
Update a secret |  a secret type such as sharedSecret |  secret name |  Subaction: None Properties:
  * secret path
  * secrets manager transaction ID

  
Patch a secret |  a secret type such as sharedSecret |  secret name |  Subaction: None Properties:
  * secret path
  * secrets manager transaction ID
## Secrets Manager
User Action | Object Type | Object | Parent | Action | Payload  
---|---|---|---|---|---  
Create a secret group |  secretGroup |  secretGroup name |  Subaction: None Properties:
  * secretGroup path
  * secrets manager transaction ID

  
Delete a secret group |  secretGroup |  secretGroup name |  Subaction: None Properties:
  * secretGroup path
  * secrets manager transaction ID

  
Create a secret |  a secret type such as sharedSecret |  secret name |  Subaction: None Properties:
  * secret path
  * secrets manager transaction ID

  
Update a secret |  a secret type such as sharedSecret |  secret name |  Subaction: None Properties:
  * secret path
  * secrets manager transaction ID

  
Patch a secret |  a secret type such as sharedSecret |  secret name |  Subaction: None Properties:
  * secret path
  * secrets manager transaction ID

  
## Audit Log REST API Access
You can access the Audit Log REST API from the Audit Logging Query API and its RAML.
### Use a Query Loop to make Requests in Audit Logs
The latest version of the query API uses cursor pagination for efficiency, but you can continue to use the previous version of the query API, which uses offset pagination and returns the total number of records.
The latest version of the API uses pagination with cursors, so you can initiate query loops using cursors. Setting the `cursorPagination` query parameter to `true` enables you to use cursor paging. When you use cursor pagination, each response returns a cursor. The cursor corresponds to the last data entry in the response data set. The subsequent request in the query loop should use the cursor value that was returned in the previous response, and so on. When the data set is empty in response, you have reached the end of the query loop, and there is no more data to query for that time window. At that point, stop the query loop. When the data set is empty in the response, no cursor is returned. When you use cursor pagination, `total` is not returned by default, because the query loop is not dependent on the offset or the number of total rows. If you want to see the total when you use cursor paging, set the `doIncludeTotal` query parameter to true.
When the `cursorPagination` query parameter is true and you use `offset` and `cursor` in the query body, `cursor` is prioritized, and `offset` is ignored.
There is no mapping between `offset` and `cursor` values; And so when you run a query loop over a time window, you cannot switch to the new param somewhere in the middle by using the `cursorPagination` and continue the loop. This is because when using `cursorPagination`, `offset` is ignored and so the loop will be start from the beginning.
The cursor-based pagination API is not applicable to the CSV query. The query continues to use offset-based pagination.
This example shows a series of calls in a query loop for cursor based query:
  1. The first call doesn’t have a cursor in the body and doesn’t request the `total`. The response returns this data:
```
POST https://base/audit/v2/organizations/<orgId>/query?cursorPagination=true
```

Body:
```
{
	"startDate":"2022-09-01T22:14:47.099Z",
	"endDate":"2022-11-30T23:14:47.099Z",
}
```

Response:
```
{
  "data": [log entries],
  "cursor": '123_abcd'
}
```

You can use the cursor from the first call’s response in the next call to get the next set of rows.
  2. The second call has a specific cursor in the request:
```
POST https://base/audit/v2/organizations/<orgId>/query?cursorPagination=true
```

Body:
```
{
	"startDate":"2022-09-01T22:14:47.099Z",
	"endDate":"2022-11-30T23:14:47.099Z",
	"cursor": '123_abcd'
}
```

Response:
```
{
	"data": [logs],
	"cursor": '123_xyz'
}
```

  3. The third call is the final call in a loop. Because there are no more logs to return, the response doesn’t have a cursor and contains no data.
```
POST https://base/audit/v2/organizations/<orgId>/query?cursorPagination=true
```

Body:
```
{
	"startDate":"2022-09-01T22:14:47.099Z",
	"endDate":"2022-11-30T23:14:47.099Z",
	"cursor": '123_xyz'
}
```

Response:
```
{
	"data": []
}
```

  4. This example shows how to use a cursor and request the total:
```
POST https://base/audit/v2/organizations/<orgId>/query?cursorPagination=true&doIncludeTotal=true
```

Body:
```
{
	"startDate":"2022-09-01T22:14:47.099Z",
	"endDate":"2022-11-30T23:14:47.099Z",
	"cursor": '123_abcds'
}
```

Response:
```
{
	"data": [logs],
	"cursor": '123_asdfg'
	"total": 50000
}
```



### Access the API using CURL Commands
These are example `curl` commands for accessing the API (Windows users need to download `curl` before using these commands).
Get authorization information:
```
curl 'https://anypoint.mulesoft.com/audit/v2/organizations/<organization_id>/platforms?include_internal=false' -H 'Authorization: bearer <bearer_value>'
```

Get actions by date range:
```
curl 'https://anypoint.mulesoft.com/audit/v2/organizations/<organization_id>/query?include_internal=false' -H 'Authorization: bearer <bearer_value>' -H 'Content-Type: application/json;charset=UTF-8' -H 'Accept: application/json, text/plain, */*' --data-binary '{"startDate":"2017-03-08T20:16:41.250Z","endDate":"2017-03-08T21:16:41.250Z","platforms":[],"objectTypes":[],"actions":[],"objectIds":[],"userIds":[],"ascending":false,"organizationId":"<organization_id>","offset":0,"limit":25}' --compressed ;
```

### Rate Limit Policy for Audit Log Query Endpoint
The Audit Log Query endpoint applies rate limits per IP in the three control planes: US, EU, and gov.
This table outlines the rate limits for each control plane:
Control Plane | Allowed requests per minute per IP  
---|---  
If a client exceeds the rate limit for a given control plane, the Audit Log Query endpoint returns a `503 Service Unavailable` status code until the minute expires. During this time, the service is unavailable to the client.
It’s best for Audit Log Query Endpoint users to monitor their request rates and adjust their usage accordingly to avoid exceeding the rate limit. Exceeding the rate limit can make the endpoint temporarily unavailable.
## See Also
  * Audit Log Retention Period
  *   * Anypoint MQ Audit Logs