openapi: 3.0.0 info: title: Webex Admin Address Book Security Audit Events API version: 1.0.0 description: The Webex Admin APIs provide comprehensive programmatic access to administrative functions for managing Webex organizations, users, licenses, and settings. These APIs enable automation of user provisioning, license assignment, compliance management, and audit event retrieval. Administrators can integrate with enterprise identity systems, enforce security policies, monitor usage, and streamline onboarding/offboarding processes. The APIs support granular control over organizational resources, making them ideal for large-scale deployments and custom admin tooling. tags: - name: Security Audit Events paths: /admin/securityAudit/events: get: responses: '200': description: OK headers: link: schema: type: string Content-Disposition: schema: type: string content: application/json: schema: $ref: '#/components/schemas/SecurityAuditEventCollectionResponse' example: items: - data: actorOrgName: Acme Inc. eventDescription: An Admin logged in actorName: Joe Smith actorEmail: joe@example.com actorUserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 trackingId: ATLAS_6f23a878-bcd4-c204-a4db-e701b42b0e5c_0 eventCategory: LOGINS actorIp: 128.107.241.191 actionText: Joe Smith logged into organization Acme Inc. created: '2019-01-02T16:58:36.845Z' actorOrgId: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE id: MjQ0ODhiZTYtY2FiMS00ZGRkLTk0NWQtZDFlYjkzOGQ4NGUy actorId: Y2lzY29zcGFyazovL3VzL1BFT1BMRS82ZWVmOGE4ZS1lNzg3LTQzMWUtOWM3ZC1hOGVjZmU1MjM5Nzc '400': description: 'Bad Request: The request was invalid or cannot be otherwise served. An accompanying error message will explain further.' '401': description: 'Unauthorized: Authentication credentials were missing or incorrect.' '403': description: 'Forbidden: The request is understood, but it has been refused or access is not allowed.' '404': description: 'Not Found: The URI requested is invalid or the resource requested, such as a user, does not exist. Also returned when the requested format is not supported by the requested method.' '405': description: 'Method Not Allowed: The request was made to a resource using an HTTP request method that is not supported.' '409': description: 'Conflict: The request could not be processed because it conflicts with some established rule of the system. For example, a person may not be added to a room more than once.' '410': description: 'Gone: The requested resource is no longer available.' '415': description: 'Unsupported Media Type: The request was made to a resource without specifying a media type or used a media type that is not supported.' '423': description: 'Locked: The requested resource is temporarily unavailable. A Retry-After header may be present that specifies how many seconds you need to wait before attempting the request again.' '428': description: 'Precondition Required: File(s) cannot be scanned for malware and need to be force downloaded.' '429': description: 'Too Many Requests: Too many requests have been sent in a given amount of time and the request has been rate limited. A Retry-After header should be present that specifies how many seconds you need to wait before a successful request can be made.' '500': description: 'Internal Server Error: Something went wrong on the server. If the issue persists, feel free to contact the [Webex Developer Support team](/explore/support).' '502': description: 'Bad Gateway: The server received an invalid response from an upstream server while processing the request. Try again later.' '503': description: 'Service Unavailable: Server is overloaded with requests. Try again later.' '504': description: 'Gateway Timeout: An upstream server failed to respond on time. If your query uses max parameter, please try to reduce it.' summary: List Security Audit Events operationId: List Security Audit Events description: 'List Security Audit Events. This API currently returns user sign-in and sign-out data. To call this API the `audit:events_read` scope must be selected for the Integration or Service App and authorized by a Full Admin. Several query parameters are available to filter the response. Long result sets will be split into multiple [pages](/docs/basics#pagination) **NOTE**: A maximum of one year of audit events can be returned per request.' tags: - Security Audit Events parameters: - name: orgId in: query description: List events in this organization, by ID. required: true example: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE schema: type: string - name: startTime in: query description: List events which occurred after a specific date and time. required: true example: '2018-01-01T13:12:11.789Z' schema: type: string - name: endTime in: query description: List events which occurred before a specific date and time. required: true example: '2018-01-01T14:12:11.789Z' schema: type: string - name: actorId in: query description: List events performed by this person, by ID. example: Y2lzY29zcGFyazovL3VzL1BFT1BMRS9iYzQ1YTdiMC00OTg1LTQzYzktYjI1OS00Y2MzOTgzYzY4NjQ schema: type: string - name: max in: query description: Limit the maximum number of events in the response. The maximum value is `1000`. example: '100' schema: type: number default: 100 - name: eventCategories in: query description: List events, by event categories. example: LOGINS schema: type: array items: type: string example: LOGINS description: List events, by event categories. components: schemas: SecurityAuditEventCollectionResponse: type: object properties: items: type: array items: $ref: '#/components/schemas/SecurityAuditEvent' description: array of monitoring Audit events SecurityAuditEvent: type: object properties: data: type: object properties: actorOrgName: type: string example: Acme Inc. description: The display name of the organization. eventDescription: type: string example: An Admin logged in description: A description for the event. actorName: type: string example: Joe Smith description: The name of the person who performed the action. actorEmail: type: string example: joe@example.com description: The email of the person who performed the action. actorUserAgent: type: string example: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 description: The browser user agent of the person who performed the action. trackingId: type: string example: ATLAS_6f23a878-bcd4-c204-a4db-e701b42b0e5c_0 description: A tracking identifier for the event. eventCategory: type: string example: LOGINS description: The category of resource changed by the event. actorIp: type: string example: 128.107.241.191 description: The IP address of the person who performed the action. actionText: type: string example: Joe Smith logged into organization Acme Inc. description: A more detailed description of the change made by the person. created: type: string example: '2019-01-02T16:58:36.845Z' description: The date and time the event took place. actorOrgId: type: string example: Y2lzY29zcGFyazovL3VzL09SR0FOSVpBVElPTi85NmFiYzJhYS0zZGNjLTExZTUtYTE1Mi1mZTM0ODE5Y2RjOWE description: The `orgId` of the person who made the change. id: type: string example: MjQ0ODhiZTYtY2FiMS00ZGRkLTk0NWQtZDFlYjkzOGQ4NGUy description: A unique identifier for the event. actorId: type: string example: Y2lzY29zcGFyazovL3VzL1BFT1BMRS82ZWVmOGE4ZS1lNzg3LTQzMWUtOWM3ZC1hOGVjZmU1MjM5Nzc description: The `personId` of the person who made the change. securitySchemes: oauth2: flows: authorizationCode: authorizationUrl: / scopes: {} tokenUrl: / type: oauth2 bearer-key: type: http description: e.g. Bearer YOUR_AUTHORIZATION_TOKEN scheme: bearer bearerFormat: JWT bearerAuth: type: oauth2 description: OAuth 2.0 Bearer token authentication flows: authorizationCode: authorizationUrl: https://webexapis.com/v1/authorize tokenUrl: https://webexapis.com/v1/access_token scopes: spark:applications_token: Create access tokens for Service Apps