openapi: 3.1.0
info:
  title: Cisco Webex Admin Audit Events API
  description: Access admin audit events for tracking administrative actions performed in Webex Control Hub. Available to full administrators for compliance monitoring and security auditing purposes.
  version: 1.0.0
  contact:
    name: Cisco Webex Developer Support
    url: https://developer.webex.com/support
  license:
    name: Cisco Webex API Terms of Service
    url: https://developer.webex.com/terms-of-service
servers:
- url: https://webexapis.com/v1
  description: Webex Production API
security:
- bearerAuth: []
tags:
- name: Events
  description: Operations for accessing compliance events
paths:
  /events:
    get:
      operationId: listEvents
      summary: Cisco Webex List Events
      description: Lists events in the organization. Events represent activities such as message creation, membership changes, and file shares. Only available to compliance officers with the spark-compliance:events_read scope.
      tags:
      - Events
      parameters:
      - name: resource
        in: query
        description: Filter by resource type.
        schema:
          type: string
          enum:
          - attachmentActions
          - files
          - meetings
          - meetingMessages
          - meetingTranscripts
          - memberships
          - messages
          - rooms
          - tabs
      - name: type
        in: query
        description: Filter by event type.
        schema:
          type: string
          enum:
          - created
          - updated
          - deleted
          - ended
      - name: actorId
        in: query
        description: Filter by person ID who performed the action.
        schema:
          type: string
      - name: from
        in: query
        description: List events after this date and time in ISO 8601 format.
        schema:
          type: string
          format: date-time
      - name: to
        in: query
        description: List events before this date and time in ISO 8601 format.
        schema:
          type: string
          format: date-time
      - name: max
        in: query
        description: Maximum number of events to return (default 100, max 1000).
        schema:
          type: integer
          default: 100
          minimum: 1
          maximum: 1000
      responses:
        '200':
          description: Successful response with list of events.
          content:
            application/json:
              schema:
                type: object
                properties:
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Event'
        '401':
          description: Unauthorized - invalid or missing access token.
  /events/{eventId}:
    get:
      operationId: getEventDetails
      summary: Cisco Webex Get Event Details
      description: Shows details for an event by ID. Returns the event metadata and associated resource data at the time the event occurred.
      tags:
      - Events
      parameters:
      - name: eventId
        in: path
        required: true
        description: Unique identifier for the event.
        schema:
          type: string
      responses:
        '200':
          description: Successful response with event details.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Event'
        '404':
          description: Event not found.
components:
  schemas:
    Event:
      type: object
      properties:
        id:
          type: string
          description: Unique identifier for the event.
        resource:
          type: string
          description: The resource type affected by the event.
          enum:
          - attachmentActions
          - files
          - meetings
          - meetingMessages
          - meetingTranscripts
          - memberships
          - messages
          - rooms
          - tabs
        type:
          type: string
          description: The type of event.
          enum:
          - created
          - updated
          - deleted
          - ended
        appId:
          type: string
          description: The application ID that triggered the event.
        actorId:
          type: string
          description: The person ID who performed the action.
        orgId:
          type: string
          description: The organization ID where the event occurred.
        created:
          type: string
          format: date-time
          description: Date and time the event occurred.
        data:
          type: object
          description: The resource data at the time of the event. Structure varies based on the resource type.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: Webex API access token. Obtain via OAuth 2.0 authorization flow. Requires audit:events_read scope.