Audits

GET GET /data/v1/audit/auditEvents

GET /data/v1/audit/auditEvents

Operation ID: getAuditEvents.

Retrieve logged Audit Trail audit events for the current account and its child accounts. Logins are audited at the enterprise level.

Timestamps for Audit Trail data use the US Central Standard Time (GMT-6, CST) timezone.

Required Permission Scopes

To retrieve Audit Trail data, you must have the Data | Tracking Event | Read permission scope.

Parameters

• Authorization (header, string, required) A unique, time-limited token that you can use to issue requests to the Marketing Cloud Engagement API. Replace YOUR_ACCESS_TOKEN with your authentication token.

  Example

  Bearer YOUR_ACCESS_TOKEN

• $orderBy (query, string) The field and sort method to use to sort the results. You can sort based on the value of createdDate in ascending (ASC) or descending (DESC) order. The default value is createdDate DESC.
• $page (query, number) The page number of results to retrieve. The default value is 1.
• $pagesize (query, number) The number of items to return on a page of results. The default value is 50.
• enddate (query, string (date-time)) End date of the date range to search for security events. Specify the value as an ISO 8601 timestamp. The value of enddate must occur after the value of startdate. The default value is today's date.
• startdate (query, string (date-time)) Start date of the date range to search for security events. Specify the value as an ISO 8601 timestamp. The value of startdate must occur before the value of enddate. The default value is 30 days before today's date.

Responses

• 200 OK

  Media type: application/json. Schema: auditEventsResponse.

  Example

  {
    "page": 1,
    "pageSize": 50,
    "count": 2,
    "items": [
      {
        "id": 5432,
        "createdDate": "2026-02-18T16:25:42.012Z",
        "memberId": 114411,
        "enterpriseId": 9876543,
        "employee": {
          "id": 314159,
          "employeeName": "D'Angelo Cunningham",
          "userName": "dcunningham@example.com"
        },
        "objectType": {
          "id": 2101,
          "name": "MemberEmployee"
        },
        "operation": {
          "id": 2,
          "name": "Update"
        },
        "object": {
          "id": "918273",
          "name": "Marketer"
        },
        "transactionId": "d3c3ecaf-244d-4f87-a37c-17d0a0888fa2"
      },
      {
        "id": 5433,
        "createdDate": "2026-02-18T16:23:52.012Z",
        "memberId": 114411,
        "enterpriseId": 9876543,
        "employee": {
          "id": 314160,
          "employeeName": "Business Automation User",
          "userName": "automationuser"
        },
        "objectType": {
          "id": 2103,
          "name": "Member"
        },
        "operation": {
          "id": 2,
          "name": "Update"
        },
        "object": {
          "id": "1447640",
          "name": "MyObject"
        },
        "transactionId": "18360eb4-0ba7-4f48-a9ab-403c0dbfcc06"
      }
    ]
  }

• 400 Bad request.

  Media type: application/json. Schema: auditErrorResponse.

  Example

  {
    "message": "JSON Deserialization Exception: Location Unknown",
    "errorcode": 10004,
    "documentation": ""
  }

• 401 Invalid access token or tenant-specific endpoint.

  Media type: application/json. Schema: auditErrorResponse.

  Example

  {
    "documentation": "https://developer.salesforce.com/docs/atlas.en-us.mc-apis.meta/mc-apis/error-handling.htm",
    "errorcode": 0,
    "message": "Not Authorized"
  }