Audit Log Endpoint Returns 401's
Asked by Andrea:

I'm trying to access Confluence Audit Records using the following endpoint **wiki/rest/api/audit**per [these docs](https://developer.atlassian.com/cloud/confluence/rest/v1/api-group-audit/#api-wiki-rest-api-audit-get)but am receiving 401 errors.

I've been able to successfully access Audit Records using Basic Auth for Jira and am using the same token I created in the Developer Console. In the [3LO app](https://developer.atlassian.com/cloud/confluence/oauth-2-3lo-apps/), I've ensured I have the **read audit record** granular scope checked.

![Screenshot 2023-08-22 at 3.18.17 PM.png](/t5/image/serverpage/image-id/276513i1BB966248E092D90/image-size/large?v=v2&px=999 "Screenshot 2023-08-22 at 3.18.17 PM.png")

The documentation states that the **Confluence Administrator' global permission** is required, but my org is unable to grant me that permission. Instead, they've authorized my app, and believe this is sufficient.

The simple example I'm following for the CURL request from docs [here](https://developer.atlassian.com/cloud/confluence/basic-auth-for-rest-apis/#simple-example):

```
curl -D- \

-X GET \

-H "Authorization: ${username:token}" \

-H "Content-Type: application/json" \

"https://${MY_SERVER}.atlassain.net/wiki/rest/api/audit"
```

Returns the following:  

```
HTTP/2 302

cache-control: max-age=0, private, must-revalidate

content-length: 11

date: Tue, 22 Aug 2023 19:08:44 GMT

location: http://ww1.atlassain.net

server: Cowboy

set-cookie: sid={COOKIE}; path=/; domain=.atlassain.net; expires=Sun, 09 Sep 2091 22:22:51 GMT; max-age=${AGE}; secure; HttpOnly

Redirecting% ~ .......................................................................................... took 4s at 03:08:44 PM
```

When I run the CURL command from my Postman Instance:  

```
curl --location 'https://${MY_SERVER}.atlassian.net/wiki/rest/api/audit' \

--header 'Accept: application/json' \

--header 'Authorization: Basic ${ENCODED_TOKEN}' \

<html>
```

I get the following response:  

```
<head>

 <title>Unauthorized (401)</title>

...
...
```

I've reviewed many similar questions in community help and am still not having any luck. I've ensured the password for my basic auth is the token from the Dev Console. Any help is greatly appreciated!


Answers:
author: marc -Collabello--Phase Locked-
body: Hi [@andrea_piazza](/t5/user/viewprofilepage/user-id/5297954) ,

When you run the curl command, you use your own email and token. That means you will get a 401 when you are not a global admin.

The 3LO app permissions are independent of the Basic Auth you use with the curl commands.

comments: author: Andrea
body: Thank you! [@marc -Collabello--Phase Locked-](/t5/user/viewprofilepage/user-id/1205132) is there any way to access the audit records without global admin permissions, my IT staff only wants me to access audit records and nothing else so I can't have global permissions to write our integration. Thank you for your help!


author: marc -Collabello--Phase Locked-
body: According to the documentation, it is possible through a 3LO app. However that likely won't work with curl.

I do not have experience with this.


Tags: cloud

confluence-cloud