{
  "openapi": "3.1.0",
  "info": {
    "version": "v2.0",
    "title": "Celonis Audit Log API",
    "description": "This is the documentation for the Celonis Audit Log API that allows querying on audit logs in a Celonis Platform team. This API supports multiple methods of authentication:<br/> <br/> - (preferred method) Via OAuth 2.0 token with scope <tt>audit.log:read</tt>, passed in an HTTP header like this: <tt>Authorization: Bearer TOKEN</tt><br/> - Via Application keys, passed in an HTTP header like this: <tt>Authorization: AppKey APPLICATION_KEY</tt><br/> - Via API keys, passed in an HTTP header like this: <tt>Authorization: Bearer API_KEY</tt><br/><br/>Please see [this help page](https://docs.celonis.com/en/using-oauth-2-0.html) for more information about OAuth 2.0.<br/><br/>**NOTE: ALL AUDIT LOG OPERATIONS ARE SCOPED TO A TEAM.**"
  },
  "servers": [
    {
      "url": "https://dev.eu-1.celonis.cloud/log",
      "description": "Generated server url"
    }
  ],
  "security": [
    {
      "Authorization": []
    }
  ],
  "tags": [
    {
      "name": "Audit Log API",
      "description": "For Querying Audit Logs in a team"
    }
  ],
  "paths": {
    "/api/external/v2/audit": {
      "get": {
        "tags": [
          "Audit Log API"
        ],
        "summary": "List Audit Logs (Token-based Pagination)",
        "description": "Audit Logs can be filtered by specifying a date interval.<br> Retrieves a list of Audit Logs using a token-based pagination for high-performance scrolling. Use the *nextPageToken* from the response to fetch the next set of results.<br> If there are more Audit Logs for the specified interval, *nextPageToken* will be returned for further querying.<br><br/>**NOTE:**  The **USE AUDIT LOGS API** permission must be enabled.",
        "operationId": "getAuditLogs",
        "parameters": [
          {
            "name": "pageToken",
            "in": "query",
            "description": "encoded nextPageToken from the previous response",
            "required": false,
            "schema": {
              "type": "string"
            },
            "example": "eyI5ZTFkMzMwMy04N2Y4LTQ5NTEtOTkyNC02ZjhhY2E3MzY2MTUiOjE2Njk1Azk3NDAwMDB9"
          },
          {
            "name": "limit",
            "in": "query",
            "description": "Limit of results",
            "required": false,
            "schema": {
              "type": "integer",
              "format": "int32",
              "default": 200,
              "maximum": 500,
              "minimum": 1
            },
            "example": 200
          },
          {
            "name": "from",
            "in": "query",
            "description": "Start time (ISO 8601 Instant yyyy-MM-ddTHH:mm:ssZ)",
            "required": false,
            "schema": {
              "type": "string",
              "format": "date-time"
            },
            "example": "2021-01-01T09:00:00Z"
          },
          {
            "name": "to",
            "in": "query",
            "description": "End time (ISO 8601 Instant yyyy-MM-ddTHH:mm:ssZ)",
            "required": false,
            "schema": {
              "type": "string",
              "format": "date-time"
            },
            "example": "2021-01-31T09:00:00Z"
          }
        ],
        "responses": {
          "200": {
            "description": "A JSON object representing the paginated results.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/SwaggerAuditLogEventTokenBasedPageExternal"
                }
              }
            }
          },
          "204": {
            "description": "No Content"
          },
          "400": {
            "description": "Bad Request. Please check the response contents for an explanation of the cause.",
            "content": {}
          },
          "401": {
            "description": "Unauthorized. Please check whether your API key or application key has sufficient permissions. In case you are unsure, please refer the documentation on [application keys](https://help.celonis.cloud/help/display/CIBC/Application+Keys) and [permissions](https://help.celonis.cloud/help/display/CIBC/Permissions)."
          },
          "403": {
            "description": "Forbidden"
          },
          "500": {
            "description": "An internal error happened. Please forward the associated error ID along with any helpful information to [our support](https://help.celonis.cloud/help/display/CIBC/Support)",
            "content": {}
          }
        },
        "security": [
          {
            "Authorization": []
          }
        ]
      }
    }
  },
  "components": {
    "schemas": {
      "AuditLogExternalTransport": {
        "type": "object",
        "properties": {
          "userId": {
            "type": "string"
          },
          "userRole": {
            "type": "string"
          },
          "event": {
            "type": "string"
          },
          "timestamp": {
            "type": "string",
            "format": "date-time"
          },
          "message": {},
          "ipAddress": {
            "type": "string"
          },
          "port": {
            "type": "string"
          },
          "diffPayload": {
            "$ref": "#/components/schemas/DiffPayloadExternalTransport"
          }
        }
      },
      "DiffPayloadExternalTransport": {
        "type": "object",
        "properties": {
          "oldValue": {
            "type": "string"
          },
          "newValue": {
            "type": "string"
          }
        }
      },
      "SwaggerAuditLogEventTokenBasedPageExternal": {
        "type": "object",
        "properties": {
          "nextPageToken": {
            "type": "string"
          },
          "content": {
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/AuditLogExternalTransport"
            }
          }
        }
      }
    },
    "securitySchemes": {
      "Authorization": {
        "type": "apiKey",
        "description": "Please, prefix the Token with \"AppKey \" or \"Bearer \" (word and space) to indicate the Authorization type",
        "name": "Authorization",
        "in": "header"
      }
    }
  }
}