openapi: 3.2.0 info: title: Iru Endpoint Management Audit API description: "# Welcome to the Iru Endpoint Management API Documentation\n\n**Note:** Kandji is in the process of changing to Iru. Many URLs and notes within this documentation will continue to reference Kandji for some time.\n\nYou can find your API URL in Settings > Access. The API URL will follow the below formats.\n\n- US - `https://SubDomain.api.kandji.io`\n \n- EU - `https://SubDomain.api.eu.kandji.io`\n \n\nFor information on how to obtain an API token, please refer to the Iru docs.\n\n[https://docs.iru.com/](https://docs.iru.com/)\n\n#### Rate Limit\n\nThe Iru Endpoint Management API currently has an API rate limit of 10,000 requests per hour per customer.\n\n#### Request Methods\n\nHTTP request methods supported by the API.\n\n| Method | Definition |\n| --- | --- |\n| GET | The `GET` method requests a representation of the specified resource. |\n| POST | The `POST` method submits an entity to the specified resource. |\n| PATCH | The `PATCH` method applies partial modifications to a resource. |\n| DELETE | The `DELETE` method deletes the specified resource. |\n\n#### Response codes\n\nNot all response codes apply to every endpoint.\n\n| Code | Response |\n| --- | --- |\n| 200 | OK |\n| 201 | Created |\n| 204 | No content |\n| | Typical response when sending the DELETE method. |\n| 400 | Bad Request |\n| | \"Command already running\" - The command may already be running in a _Pending_ state waiting on the device. |\n| | \"Command is not allowed for current device\" - The command may not be compatible with the target device. |\n| | \"JSON parse error - Expecting ',' delimiter: line 3 column 2 (char 65)\" |\n| 401 | Unauthorized |\n| | This error can occur if the token is incorrect, was revoked, or the token has expired. |\n| 403 | Forbidden |\n| | The request was understood but cannot be authorized. |\n| 404 | Not found |\n| | Unable to locate the resource in the Iru tenant. |\n| 415 | Unsupported Media Type |\n| | The request contains a media type which the server or resource does not support. |\n| 500 | Internal server error |\n| 503 | Service unavailable |\n| | This error can occur if a file upload is still being processed via the custom apps API. |\n\n#### Data structure\n\nThe API returns all structured responses in JSON schema format.\n\n#### Examples\n\nCode examples using the API can be found in the Iru Endpoint Management support [GitHub](https://github.com/kandji-inc/support/tree/main/api-tools)." version: 1.0.0 servers: - url: https://{subdomain}.api.kandji.io description: US Server variables: subdomain: default: your-subdomain description: Your Iru Endpoint Management subdomain - url: https://{subdomain}.api.eu.kandji.io description: EU Server variables: subdomain: default: your-subdomain description: Your Iru Endpoint Management subdomain security: - BearerAuth: [] tags: - name: Audit paths: /api/v1/audit/events: get: summary: List audit events description: This request returns audit log events from the Kandji Activity module. parameters: - name: limit in: query required: false description: A max upper `limit` is set at 500 records returned per request. Pagination should be used using the cursor in the `next` key to request more results. Additionally, parameter queries can be added to a request to filter the results. schema: type: string - name: sort_by in: query required: false description: Sort results by `occurred_at`, `id` either ascending (default behavior) or descending(-) order. schema: type: string - name: start_date in: query required: false description: Filter by start date in datetime or year-month-day (2024-11-26) formats schema: type: string - name: end_date in: query required: false description: Filter by end date in datetime or year-month-day (2024-12-06) formats schema: type: string - name: cursor in: query required: false description: You can pass the next cursor as a parameter or use the URL in the next key to get the next page of results or to start from where you left off last. schema: type: string responses: '200': description: success content: application/json: schema: type: object example: results: - id: 01JNGZW47KZKPXE1JWCFE4PHDW action: update occurred_at: '2025-03-04T16:29:55.253454Z' actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5 actor_type: user target_id: 449ec92a-186a-44f2-9421-d5ac6e465eb5 target_type: blueprint target_component: library_items new_state: library_items_added: - id: c7a5871a-1683-432f-87d4-30bbd404eb85 name: GitHub - id: 6c3c34cf-36c4-4812-bd3f-712d66458c80 name: Apple Configurator library_items_removed: [] library_items_scoped: - id: 6c3c34cf-36c4-4812-bd3f-712d66458c80 name: Apple Configurator - id: c7a5871a-1683-432f-87d4-30bbd404eb85 name: GitHub - id: 1af36ec2-111d-4ec4-bc3b-170facf1408b name: Apple Developer name: demo metadata: {} - id: 01JNGZWQ7WAN45PVTJ3686TXHT action: create occurred_at: '2025-03-04T16:30:14.143192Z' actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5 actor_type: user target_id: 2b1fd766-3ba4-49ba-9f88-8219d468b34c target_type: blueprint target_component: '' new_state: description: '' type: map name: audit_event_test metadata: source_id: null source: null - id: 01JNGZWQ7W0C1TD9MZAP6XSEGH action: update occurred_at: '2025-03-04T16:30:14.214831Z' actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5 actor_type: user target_id: 2b1fd766-3ba4-49ba-9f88-8219d468b34c target_type: blueprint target_component: parameters new_state: parameters: [] name: audit_event_test metadata: {} - id: 01JNGZX031XXXWS574PMJE5E52 action: update occurred_at: '2025-03-04T16:30:23.535596Z' actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5 actor_type: user target_id: 2b1fd766-3ba4-49ba-9f88-8219d468b34c target_type: blueprint target_component: library_items new_state: library_items_added: - id: d8a6b20f-9b7a-4af7-9ecb-1c7104116ca8 name: homebrew library_items_removed: [] library_items_scoped: - id: d8a6b20f-9b7a-4af7-9ecb-1c7104116ca8 name: homebrew name: audit_event_test metadata: {} - id: 01JNM1393ZTW3JAPWPRTVNH1JM action: update occurred_at: '2025-03-05T20:49:01.319307Z' actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5 actor_type: user target_id: 07194cf3-10c1-4b39-aa2b-763133b0347d target_type: library_item target_component: '' new_state: active: false label: null type: vpp-app name: 'Pocket Casts: Podcast Player' metadata: {} - id: 01JNM149BA16F2W42VVFP44VD0 action: update occurred_at: '2025-03-05T20:49:33.901017Z' actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5 actor_type: user target_id: 7a488f5a-082b-4039-8e11-9b92985300c4 target_type: blueprint target_component: library_items new_state: library_items_added: - id: 07194cf3-10c1-4b39-aa2b-763133b0347d name: 'Pocket Casts: Podcast Player' library_items_removed: [] library_items_scoped: - id: c0af8f59-8d96-49e3-a66b-80639bc43eac name: accuhive_wifi - id: 4418f6fa-0761-460f-b98d-c037f44ffad0 name: Iru Self Service - id: 92a8be7b-dc71-41f5-be27-138769080850 name: default skip - id: 07194cf3-10c1-4b39-aa2b-763133b0347d name: 'Pocket Casts: Podcast Player' name: _ipados_testing_2 metadata: {} - id: 01JNM1498JPRMZN6737HP4M2PT action: update occurred_at: '2025-03-05T20:49:34.008256Z' actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5 actor_type: user target_id: 9b1ce867-83dd-46bb-b79a-ba2b5c3a4acc target_type: blueprint target_component: library_items new_state: library_items_added: - id: 07194cf3-10c1-4b39-aa2b-763133b0347d name: 'Pocket Casts: Podcast Player' library_items_removed: [] library_items_scoped: - id: 3e2a8bd2-45a3-43e4-a1e6-7296a83abf65 name: agent_debug_logging - id: cc2e2e17-e046-4405-ba46-1c39790a69a0 name: 1Password 7 - id: 3eb5836a-c856-47a6-8614-0da2624e8577 name: audit test - id: 07956063-476a-4c53-9fec-1686a5b9ec5b name: wb - id: 03ece026-6d91-4616-a9de-c77c23a32555 name: wallpaper - id: 3ad11b1e-42fb-4405-b826-c9cdf6061e7e name: pppc_finder - id: 814351ef-d9ee-4ebe-bf3e-5fb6cc3086bc name: Microsoft Company Portal - id: 07194cf3-10c1-4b39-aa2b-763133b0347d name: 'Pocket Casts: Podcast Player' - id: 764706a2-f934-4808-85a4-7763d89327f4 name: brooklyn_screensaver - id: 24eb6c93-27d7-40a0-9092-d29e9d53a0ef name: Okta Verify name: _testing_something metadata: {} - id: 01JNM149BEX9ZK8YX7FVGARH4C action: update occurred_at: '2025-03-05T20:49:34.064939Z' actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5 actor_type: user target_id: ac4aba12-d2e5-430a-b7aa-42d25f9e6ead target_type: blueprint target_component: library_items new_state: library_items_added: - id: 07194cf3-10c1-4b39-aa2b-763133b0347d name: 'Pocket Casts: Podcast Player' library_items_removed: [] library_items_scoped: - id: 92a8be7b-dc71-41f5-be27-138769080850 name: default skip - id: f0c99039-355e-4793-8b6f-7b55d9e8b77c name: microsoft_sso_extension_mobile - id: 07194cf3-10c1-4b39-aa2b-763133b0347d name: 'Pocket Casts: Podcast Player' - id: c0af8f59-8d96-49e3-a66b-80639bc43eac name: accuhive_wifi - id: 4418f6fa-0761-460f-b98d-c037f44ffad0 name: Iru Self Service - id: 624cb961-0e69-4242-9cd1-3dffd3ca6830 name: Microsoft Authenticator name: _ipados_testing metadata: {} - id: 01JNM149BE4W1KJ3J8WNPMKTH3 action: update occurred_at: '2025-03-05T20:49:34.148395Z' actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5 actor_type: user target_id: 07194cf3-10c1-4b39-aa2b-763133b0347d target_type: library_item target_component: '' new_state: active: true label: null type: vpp-app name: 'Pocket Casts: Podcast Player' metadata: {} - id: 01JNM15XZVZ64S00H7BAZKHE4A action: update occurred_at: '2025-03-05T20:50:28.090682Z' actor_id: cf40d6e7-20cb-4da9-84a1-9ad0b7003ca5 actor_type: user target_id: a0726ca3-717d-41b9-a3af-c7d0bad8b784 target_type: api_token target_component: '' new_state: description: null permissions: - path: /api/v1/devices/{device_id} http_method: PATCH - path: /api/v1/users http_method: GET - path: /api/v1/users/{id} http_method: GET - path: /api/v1/users/{id} http_method: DELETE - path: /api/v1/audit/events http_method: GET label: audit log events metadata: {} previous: null next: https://accuhive.api.kandji.io/api/v1/audit/events?limit=2&sort_by=-occurred_at&cursor=PmR0OjIwMjUtMDMtMTcgMjI6Mjk6MjUuMzAxMDkyKzAwOjAw '400': description: Bad Request content: application/json: schema: type: object properties: error: type: string example: Bad Request '401': description: Unauthorized content: application/json: schema: type: object properties: error: type: string example: Unauthorized '404': description: Not Found content: application/json: schema: type: object properties: error: type: string example: Not Found tags: - Audit components: securitySchemes: BearerAuth: type: http scheme: bearer bearerFormat: JWT