openapi: 3.1.0
info:
  version: v2.0
  title: Celonis Audit Log API
  description: >-
    This is the documentation for the Celonis Audit Log API that allows querying
    on audit logs in a Celonis Platform team. This API supports multiple methods
    of authentication:<br/> <br/> - (preferred method) Via OAuth 2.0 token with
    scope <tt>audit.log:read</tt>, passed in an HTTP header like this:
    <tt>Authorization: Bearer TOKEN</tt><br/> - Via Application keys, passed in
    an HTTP header like this: <tt>Authorization: AppKey
    APPLICATION_KEY</tt><br/> - Via API keys, passed in an HTTP header like
    this: <tt>Authorization: Bearer API_KEY</tt><br/><br/>Please see [this help
    page](https://docs.celonis.com/en/using-oauth-2-0.html) for more information
    about OAuth 2.0.<br/><br/>**NOTE: ALL AUDIT LOG OPERATIONS ARE SCOPED TO A
    TEAM.**
servers:
  - url: https://dev.eu-1.celonis.cloud/log
    description: Generated server url
security:
  - Authorization: []
tags:
  - name: Audit Log API
    description: For Querying Audit Logs in a team
paths:
  /api/external/v2/audit:
    get:
      tags:
        - Audit Log API
      summary: List Audit Logs (Token-based Pagination)
      description: >-
        Audit Logs can be filtered by specifying a date interval.<br> Retrieves
        a list of Audit Logs using a token-based pagination for high-performance
        scrolling. Use the *nextPageToken* from the response to fetch the next
        set of results.<br> If there are more Audit Logs for the specified
        interval, *nextPageToken* will be returned for further
        querying.<br><br/>**NOTE:**  The **USE AUDIT LOGS API** permission must
        be enabled.
      operationId: getAuditLogs
      parameters:
        - name: pageToken
          in: query
          description: encoded nextPageToken from the previous response
          required: false
          schema:
            type: string
          example: >-
            eyI5ZTFkMzMwMy04N2Y4LTQ5NTEtOTkyNC02ZjhhY2E3MzY2MTUiOjE2Njk1Azk3NDAwMDB9
        - name: limit
          in: query
          description: Limit of results
          required: false
          schema:
            type: integer
            format: int32
            default: 200
            maximum: 500
            minimum: 1
          example: 200
        - name: from
          in: query
          description: Start time (ISO 8601 Instant yyyy-MM-ddTHH:mm:ssZ)
          required: false
          schema:
            type: string
            format: date-time
          example: '2021-01-01T09:00:00Z'
        - name: to
          in: query
          description: End time (ISO 8601 Instant yyyy-MM-ddTHH:mm:ssZ)
          required: false
          schema:
            type: string
            format: date-time
          example: '2021-01-31T09:00:00Z'
      responses:
        '200':
          description: A JSON object representing the paginated results.
          content:
            application/json:
              schema:
                $ref: >-
                  #/components/schemas/SwaggerAuditLogEventTokenBasedPageExternal
        '204':
          description: No Content
        '400':
          description: >-
            Bad Request. Please check the response contents for an explanation
            of the cause.
          content: {}
        '401':
          description: >-
            Unauthorized. Please check whether your API key or application key
            has sufficient permissions. In case you are unsure, please refer the
            documentation on [application
            keys](https://help.celonis.cloud/help/display/CIBC/Application+Keys)
            and
            [permissions](https://help.celonis.cloud/help/display/CIBC/Permissions).
        '403':
          description: Forbidden
        '500':
          description: >-
            An internal error happened. Please forward the associated error ID
            along with any helpful information to [our
            support](https://help.celonis.cloud/help/display/CIBC/Support)
          content: {}
      security:
        - Authorization: []
components:
  schemas:
    AuditLogExternalTransport:
      type: object
      properties:
        userId:
          type: string
        userRole:
          type: string
        event:
          type: string
        timestamp:
          type: string
          format: date-time
        message: {}
        ipAddress:
          type: string
        port:
          type: string
        diffPayload:
          $ref: '#/components/schemas/DiffPayloadExternalTransport'
    DiffPayloadExternalTransport:
      type: object
      properties:
        oldValue:
          type: string
        newValue:
          type: string
    SwaggerAuditLogEventTokenBasedPageExternal:
      type: object
      properties:
        nextPageToken:
          type: string
        content:
          type: array
          items:
            $ref: '#/components/schemas/AuditLogExternalTransport'
  securitySchemes:
    Authorization:
      type: apiKey
      description: >-
        Please, prefix the Token with "AppKey " or "Bearer " (word and space) to
        indicate the Authorization type
      name: Authorization
      in: header
