Search all audit events using POST
POST {{stripeUrl}}/admin/v1/AuditEvents/.search
Oracle Identity Cloud Service's Audit Events REST endpoints enable you to get Audit logs covering significant events, changes, or actions. Using these APIs, you can integrate all Security Information and Event Management (SIEM), User and Entity Behavior Analytics (UEBA), and Cloud Access Security Broker (CASB) to poll Audit data.
Audit events enable you to review the actions performed by members of your organization using details provided by the Audit logs, such as who performed the action and what the action was. Oracle Identity Cloud Service, an Identity and Access Management platform, is the central point of control for all activities happening in the system. It generates audit data in response to all administrator and end user operations, such as User Login, Application Access, Password Reset, User Profile Update, CRUD operations on Users, Group, Applications, and so on.
Oracle Identity Cloud Service Audit Event APIs provide read access to your organization's Audit records. These audit records are stored in Oracle Identity Cloud Service for a maximum of 90 days, and then purged.
For more information:
https://docs.oracle.com/en/cloud/paas/identity-cloud/rest-api/usingauditeventapis.html http://www.ateam-oracle.com/under-the-hood-oracle-identity-cloud-service-audits/ https://docs.oracle.com/en/cloud/paas/identity-cloud/rest-api/api-audit-audit-events.html
Request Body
{"schemas"=>["urn:ietf:params:scim:api:messages:2.0:SearchRequest"], "attributes"=>["actorName"], "filter"=>"actorName sw \"admin\"", "startIndex"=>1, "count"=>5}
HEADERS
| Key | Datatype | Required | Description |
|---|---|---|---|
Authorization | string | ||
Date | string | ||
Content-Type | string | ||
x-content-sha256 | string |
RESPONSES
status: OK
{"schemas":["urn:ietf:params:scim:api:messages:2.0:ListResponse"],"totalResults":1,"Resources":[{"idcsCreatedBy":{"type":"User","display":"Joe Smith","value":"7578e02560e24d1bae8d921cef8fd68a","$ref":"https://tenant-base-url/admin/v1/Users/7578e02560e24d1bae8d921cef8fd68a"},"actorName":"andre.correa@oracle.com","id":"c571cb3f40be496aadb1c1bb8417ef2f","actorDisplayName":"Joe Smith","meta":{"created":"2018-05-03T18:53:35.550Z","lastModified":"2018-05-03T18:53:35.550Z","resourceType":"AuditEvent","location":"https://tenant-base-url/admin/v1/AuditEvents/c571cb3f40be496aadb1c1bb8417ef2f"},"rId":"0:1:1:1246:1:13","actorId":"7578e02560e24d1bae8d921cef8fd68a","adminResourceId":"c0a99e23b8744f14a0d4def4e0a3609f","adminResourceName":"User115214","timestamp":"2018-05-03T18:53:35.549Z","idcsLastModifiedBy":{"value":"7578e02560e24d1bae8d921cef8fd68a","display":"Joe Smith","type":"User","$ref":"https://tenant-base-url/admin/v1/Users/7578e02560e24d1bae8d921cef8fd68a"},"quotaCount":0,"ecId":"CVJfC0J0700000000","clientIp":"160.xx.xx.xx","eventId":"admin.user.create.success","ssoAuthnLevel":0,"adminResourceType":"User","actorType":"User","serviceName":"Admin","adminValuesAdded":"{\"userName\":\"User115214\",\"name\":{\"familyName\":\"Kuhic115214\",\"givenName\":\"Akeem115214\",\"formatted\":\"Akeem115214 Kuhic115214\"},\"displayName\":\"Fredy Moen115214\",\"emails\":[{\"value\":\"115214cora.heathcote@stoltenbergnicolas.com\",\"primary\":\"false\",\"type\":\"recovery\",\"verified\":\"false\"},{\"value\":\"115214cora.heathcote@stoltenbergnicolas.com\",\"primary\":\"true\",\"type\":\"work\",\"verified\":\"false\"}],\"active\":\"true\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:userState:User\":{\"locked\":{\"on\":\"false\"},\"loginAttempts\":\"0\"},\"password\":\"*********\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:user:User\":{\"creationMechanism\":\"import\",\"status\":\"verified\"},\"schemas\":[\"urn:ietf:params:scim:schemas:oracle:idcs:extension:userState:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:passwordState:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:crossSso:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:socialAccount:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:posix:User\",\"urn:ietf:params:scim:schemas:core:2.0:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:kerberosUser:User\",\"urn:ietf:params:scim:schemas:extension:custom:2.0:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:selfRegistration:User\",\"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:user:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:mfa:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:securityQuestions:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:sff:User\"],\"id\":\"c0a99e23b8744f14a0d4def4e0a3609f\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:passwordState:User\":{\"mustChange\":\"false\",\"lastSuccessfulSetDate\":\"2018-05-03T18:53:35.304Z\",\"cantChange\":\"false\",\"expired\":\"false\",\"passwordHistory\":[{\"sequenceNumber\":\"1\",\"value\":\"*********\"}]},\"meta\":{\"created\":\"2018-05-03T18:53:35.307Z\",\"lastModified\":\"2018-05-03T18:53:35.307Z\"},\"idcsCreatedBy\":{\"value\":\"7578e02560e24d1bae8d921cef8fd68a\",\"type\":\"User\",\"display\":\"Andre Correa\"},\"idcsLastModifiedBy\":{\"value\":\"7578e02560e24d1bae8d921cef8fd68a\",\"type\":\"User\",\"display\":\"Andre Correa\"}}","schemas":["urn:ietf:params:scim:schemas:oracle:idcs:AuditEvent"]},{"idcsCreatedBy":{"type":"User","display":"Joe Smith","value":"7578e02560e24d1bae8d921cef8fd68a","$ref":"https://tenant-base-url/admin/v1/Users/7578e02560e24d1bae8d921cef8fd68a"},"actorName":"jane@oracle.com","id":"9c2545fec28d4bbf8c14ecda303cc13a","actorDisplayName":"Joe Smith","meta":{"created":"2018-05-03T18:53:35.932Z","lastModified":"2018-05-03T18:53:35.932Z","resourceType":"AuditEvent","location":"https://tenant-base-url/admin/v1/AuditEvents/9c2545fec28d4bbf8c14ecda303cc13a"},"rId":"0:1:1:1246:1:30","actorId":"7578e02560e24d1bae8d921cef8fd68a","adminResourceId":"f35693d16df04c888f38221ee8b7b34a","adminResourceName":"User130247","timestamp":"2018-05-03T18:53:35.931Z","idcsLastModifiedBy":{"value":"7578e02560e24d1bae8d921cef8fd68a","display":"Joe Smith","type":"User","$ref":"https://tenant-base-url/admin/v1/Users/7578e02560e24d1bae8d921cef8fd68a"},"quotaCount":0,"ecId":"CVJfC0J0700000000","clientIp":"160.34.11.91","eventId":"admin.user.create.success","ssoAuthnLevel":0,"adminResourceType":"User","actorType":"User","serviceName":"Admin","adminValuesAdded":"{\"userName\":\"User130247\",\"name\":{\"familyName\":\"Bernier130247\",\"givenName\":\"Wilfredo130247\",\"formatted\":\"Wilfredo130247 Bernier130247\"},\"displayName\":\"Jamie Monahan130247\",\"emails\":[{\"value\":\"130247natasha@kilback.com\",\"primary\":\"false\",\"type\":\"recovery\",\"verified\":\"false\"},{\"value\":\"130247natasha@kilback.com\",\"primary\":\"true\",\"type\":\"work\",\"verified\":\"false\"}],\"active\":\"true\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:userState:User\":{\"locked\":{\"on\":\"false\"},\"loginAttempts\":\"0\"},\"password\":\"*********\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:user:User\":{\"creationMechanism\":\"import\",\"status\":\"verified\"},\"schemas\":[\"urn:ietf:params:scim:schemas:oracle:idcs:extension:userState:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:passwordState:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:crossSso:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:socialAccount:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:posix:User\",\"urn:ietf:params:scim:schemas:core:2.0:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:kerberosUser:User\",\"urn:ietf:params:scim:schemas:extension:custom:2.0:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:selfRegistration:User\",\"urn:ietf:params:scim:schemas:extension:enterprise:2.0:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:user:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:mfa:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:securityQuestions:User\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:sff:User\"],\"id\":\"f35693d16df04c888f38221ee8b7b34a\",\"urn:ietf:params:scim:schemas:oracle:idcs:extension:passwordState:User\":{\"mustChange\":\"false\",\"lastSuccessfulSetDate\":\"2018-05-03T18:53:34.947Z\",\"cantChange\":\"false\",\"expired\":\"false\",\"passwordHistory\":[{\"sequenceNumber\":\"1\",\"value\":\"*********\"}]},\"meta\":{\"created\":\"2018-05-03T18:53:34.952Z\",\"lastModified\":\"2018-05-03T18:53:34.952Z\"},\"idcsCreatedBy\":{\"value\":\"7578e02560e24d1bae8d921cef8fd68a\",\"type\":\"User\",\"display\":\"Andre Correa\"},\"idcsLastModifiedBy\":{\"value\":\"7578e02560e24d1bae8d921cef8fd68a\",\"type\":\"User\",\"display\":\"Andre Correa\"}}","schemas":["urn:ietf:params:scim:schemas:oracle:idcs:AuditEvent"]}],"startIndex":1,"itemsPerPage":50}