--- schema_version: "1" id: 1f3e0dad78fc8a43d7cacdec79bb1ad8506978fcb14e10c91406283f7b6016f4 title: Audits collection: developer version: current locale: en-us portal_url: https://docs.salesforce.com/developer/current/en-us/marketing-cloud/references/generated-api-specs/mc_rest_audit.md canonical_url: https://developer.salesforce.com/docs/marketing/marketing-cloud/references/mc_rest_audit source_site: developer.salesforce.com content_type: documentation content_hash: 389777c1bb8d0ee913ffec982bfeb813ef87bbbf85f12f317cadf9d404c8683b products: - Marketing Cloud Engagement APIs and Programmatic Languages - Marketing Cloud --- Audits # Audits Retrieve logged Audit Trail audit events and security events for the current account and its child accounts. Logins are audited at the enterprise level. Timestamps for Audit Trail data use the US Central Standard Time (GMT-6, CST) timezone. This table lists the use cases that the Audit Trail API supports. | Supported Use Case | HTTP Verb | URI | | --- | --- | --- | | [Get audit events](/docs/marketing/marketing-cloud/references/mc_rest_audit?meta=getAuditEvents) | GET | /data/v1/audit/auditEvents | | [Get security events](/docs/marketing/marketing-cloud/references/mc_rest_audit?meta=getSecurityEvents) | GET | /data/v1/audit/securityEvents | **Version:** 1.0 ## Servers * `https://{subdomain}.rest.marketingcloudapis.com` * `subdomain (default N/A) The unique API subdomain for your Marketing Cloud Engagement tenant. Find this value in the Installed Packages section of Marketing Cloud Engagement Setup.` ## Operations ### GET GET /data/v1/audit/auditEvents `GET /data/v1/audit/auditEvents` Operation ID: `getAuditEvents`. Retrieve logged Audit Trail audit events for the current account and its child accounts. Logins are audited at the enterprise level. Timestamps for Audit Trail data use the US Central Standard Time (GMT-6, CST) timezone. **Required Permission Scopes** To retrieve Audit Trail data, you must have the `Data | Tracking Event | Read` permission scope. #### Parameters * `Authorization` (header, string, required) A unique, time-limited token that you can use to issue requests to the Marketing Cloud Engagement API. Replace `YOUR_ACCESS_TOKEN` with your authentication token. _Example_ ``` Bearer YOUR_ACCESS_TOKEN ``` * `$orderBy` (query, string) The field and sort method to use to sort the results. You can sort based on the value of `createdDate` in ascending (`ASC`) or descending (`DESC`) order. The default value is `createdDate DESC`. * `$page` (query, number) The page number of results to retrieve. The default value is `1`. * `$pagesize` (query, number) The number of items to return on a page of results. The default value is `50`. * `enddate` (query, string (date-time)) End date of the date range to search for security events. Specify the value as an ISO 8601 timestamp. The value of `enddate` must occur after the value of `startdate`. The default value is today's date. * `startdate` (query, string (date-time)) Start date of the date range to search for security events. Specify the value as an ISO 8601 timestamp. The value of `startdate` must occur before the value of `enddate`. The default value is 30 days before today's date. #### Responses * **200** OK Media type: `application/json`. Schema: `auditEventsResponse`. _Example_ ``` { "page": 1, "pageSize": 50, "count": 2, "items": [ { "id": 5432, "createdDate": "2026-02-18T16:25:42.012Z", "memberId": 114411, "enterpriseId": 9876543, "employee": { "id": 314159, "employeeName": "D'Angelo Cunningham", "userName": "dcunningham@example.com" }, "objectType": { "id": 2101, "name": "MemberEmployee" }, "operation": { "id": 2, "name": "Update" }, "object": { "id": "918273", "name": "Marketer" }, "transactionId": "d3c3ecaf-244d-4f87-a37c-17d0a0888fa2" }, { "id": 5433, "createdDate": "2026-02-18T16:23:52.012Z", "memberId": 114411, "enterpriseId": 9876543, "employee": { "id": 314160, "employeeName": "Business Automation User", "userName": "automationuser" }, "objectType": { "id": 2103, "name": "Member" }, "operation": { "id": 2, "name": "Update" }, "object": { "id": "1447640", "name": "MyObject" }, "transactionId": "18360eb4-0ba7-4f48-a9ab-403c0dbfcc06" } ] } ``` * **400** Bad request. Media type: `application/json`. Schema: `auditErrorResponse`. _Example_ ``` { "message": "JSON Deserialization Exception: Location Unknown", "errorcode": 10004, "documentation": "" } ``` * **401** Invalid access token or tenant-specific endpoint. Media type: `application/json`. Schema: `auditErrorResponse`. _Example_ ``` { "documentation": "https://developer.salesforce.com/docs/atlas.en-us.mc-apis.meta/mc-apis/error-handling.htm", "errorcode": 0, "message": "Not Authorized" } ``` ### GET GET /data/v1/audit/securityEvents `GET /data/v1/audit/securityEvents` Operation ID: `getSecurityEvents`. Retrieve logged Audit Trail security events for the current account and its children. Logins are audited at the enterprise level. Timestamps for Audit Trail data use the US Central Standard Time (GMT-6, CST) timezone. **Required Permission Scopes** To retrieve Audit Trail data, you must have the `Data | Tracking Event | Read` permission scope. #### Parameters * `Authorization` (header, string, required) A unique, time-limited token that you can use to issue requests to the Marketing Cloud Engagement API. Replace `YOUR_ACCESS_TOKEN` with your authentication token. _Example_ ``` Bearer YOUR_ACCESS_TOKEN ``` * `$orderBy` (query, string) The field and sort method to use to sort the results. You can sort based on the value of `createdDate` in ascending (`ASC`) or descending (`DESC`) order. The default value is `createdDate DESC`. * `$page` (query, number) The page number of results to retrieve. The default value is `1`. * `$pagesize` (query, number) The number of items to return on a page of results. The default value is `50`. * `enddate` (query, string (date-time)) End date of the date range to search for security events. Specify the value as an ISO 8601 timestamp. The value of `enddate` must occur after the value of `startdate`. The default value is today's date. * `startdate` (query, string (date-time)) Start date of the date range to search for security events. Specify the value as an ISO 8601 timestamp. The value of `startdate` must occur before the value of `enddate`. The default value is 30 days before today's date. #### Responses * **200** OK Media type: `application/json`. Schema: `securityEventsResponse`. _Example_ ``` { "page": 1, "pageSize": 2, "count": 2556, "items": [ { "id": 7890, "createdDate": "2026-02-18T16:25:42.012Z", "memberId": 114411, "enterpriseId": 9876543, "employee": { "employeeName": "Event Notification App API app user", "userName": "dc36c890-6b7e-4f7f-b5ab-4615566b8eb0" }, "ipAddress": "192.168.1.100", "eventType": { "id": 1, "name": "Login Attempted" }, "loginStatus": { "id": 4, "name": "Successful" }, "eventSource": { "id": 21, "name": "Fuel API" } }, { "id": 7891, "createdDate": "2026-02-18T16:23:52.012Z", "memberId": 114411, "enterpriseId": 9876543, "employee": { "employeeName": "Event Notification App API app user", "userName": "740dd418-3844-406e-98e3-50f5e2025470" }, "ipAddress": "192.168.1.101", "eventType": { "id": 1, "name": "Login Attempted" }, "loginStatus": { "id": 4, "name": "Successful" }, "eventSource": { "id": 21, "name": "Fuel API" } } ] } ``` * **400** Bad request. Media type: `application/json`. Schema: `auditErrorResponse`. _Example_ ``` { "message": "JSON Deserialization Exception: Location Unknown", "errorcode": 10004, "documentation": "" } ``` * **401** Invalid access token or tenant-specific endpoint. Media type: `application/json`. Schema: `auditErrorResponse`. _Example_ ``` { "documentation": "https://developer.salesforce.com/docs/atlas.en-us.mc-apis.meta/mc-apis/error-handling.htm", "errorcode": 0, "message": "Not Authorized" } ``` ## Schemas ### auditEventsResponse OK * `page` (_number_) The page number of results. * `pageSize` (_number_) The number of items per page. * `count` (_number_) The number of items returned. * `items` (_array of auditEventItem_) ### auditErrorResponse * `message` (_string_) Error message. * `errorcode` (_number_) Error code for the exception. * `documentation` (_string_) Documentation for the error. ### securityEventsResponse OK * `page` (_number_) The page number of results. * `pageSize` (_number_) The number of items per page. * `count` (_number_) The number of items returned. * `items` (_array of securityEventItem_) ### auditEventItem * `id` (_number_) ID of the audit event. * `createdDate` (_string (date-time)_) Creation date of the audit event. * `memberId` (_number_) Member ID associated with the audit event. * `enterpriseId` (_number_) Enterprise ID or parent to which the member belongs. * `employee` (_employee_) * `objectType` (_objectType_) * `operation` (_operation_) * `object` (_auditObject_) * `transactionId` (_string (uuid)_) Unique value to identify the transaction in which the audit event was captured. ### securityEventItem * `id` (_number_) ID of the security event. * `createdDate` (_string (date-time)_) Creation date of the security event. * `memberId` (_number_) Member ID associated with the security event. * `enterpriseId` (_number_) Enterprise ID to which the member belongs. * `employee` (_employee_) * `ipAddress` (_string_) IP address associated with the security event. * `sessionId` (_string_) Session ID associated with the security event. Available only with Advanced Audit Trail. * `userAgent` (_string_) User agent associated with the security event. Available only with Advanced Audit Trail. * `eventType` (_eventType_) * `loginStatus` (_loginStatus_) * `eventSource` (_eventSource_) ### employee User associated with the audit event. * `id` (_number_) * `employeeName` (_string_) * `userName` (_string_) ### objectType Type of object used to describe the audit event. * `id` (_number_) * `name` (_string_) ### operation Action taken against the objectType. * `id` (_number_) * `name` (_string_) ### auditObject Additional information about the audited object. Can contain an ID, the name of the object, or both. * `id` (_string_) * `name` (_string_) ### eventType Type of security event. * `id` (_number_) * `name` (_string_) ### loginStatus Status of the security event. * `id` (_number_) * `name` (_string_) ### eventSource Source of the security event. * `id` (_number_) * `name` (_string_)