> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Lists a page of audit events (SIEM)

`POST /api/web/v2/reports/auditeventspaged/siem`

Returns audit events for the provided search parameters in ascending order always. Caller requires the REPORTS:VIEW permission.The following searchByAttributes are supported: <ul><li>startTime: a <b>mandatory</b> String value representing an ISO-8601 date in UTC time (e.g., 2018-08-04T18:15:30). Allowed operators are: GREATER_THAN_OR_EQUAL. </li><li>endTime: a String value representing an ISO-8601 date in UTC time (e.g., 2018-08-31T18:15:30). Allowed operators are: LESS_THAN_OR_EQUAL. </li><li>outcome: SUCCESS or FAIL. Allowed operator: EQUALS. </li><li>category: AUTHENTICATION or MANAGEMENT. Allowed operator: EQUALS. </li></ul>If you provide more than one search attribute, they are joined with an AND condition.<br /><br />The orderByAttribute is not used even if provided. Results are returned in ascending order always (oldest to newest event)

## Request Body

Required.

### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "attributes": {
      "type": "array",
      "description": "Users search only: additional, non-core attributes to include in the returned object. Attribute names are specific to the returned object.",
      "items": {
        "type": "string",
        "description": "Users search only: additional, non-core attributes to include in the returned object. Attribute names are specific to the returned object."
      }
    },
    "cursor": {
      "type": "string",
      "description": "Identifies the page to return when paging over a result set--if present, search by / order by attributes are ignored."
    },
    "limit": {
      "maximum": 100,
      "minimum": 1,
      "type": "integer",
      "description": "Identifies the maximum number of items to include in a page (1-100).",
      "format": "int32"
    },
    "orderByAttribute": {
      "required": [
        "ascending",
        "name"
      ],
      "type": "object",
      "properties": {
        "ascending": {
          "type": "boolean",
          "description": "Identifies whether to order results in ascending order."
        },
        "name": {
          "type": "string",
          "description": "Identifies the attribute."
        }
      },
      "description": "An attribute used to sort the result from a search.",
      "title": "OrderByAttribute"
    },
    "searchByAttributes": {
      "type": "array",
      "description": "Identifies attributes for searching purposes. Some end-points have pre-defined values and ignore this attribute.",
      "items": {
        "required": [
          "name",
          "operator"
        ],
        "type": "object",
        "properties": {
          "name": {
            "type": "string",
            "description": "Identifies the attribute we are searching for."
          },
          "operator": {
            "type": "string",
            "description": "Identifies the operator.",
            "enum": [
              "EQUALS",
              "NOT_EQUALS",
              "CONTAINS",
              "NOT_CONTAINS",
              "STARTS_WITH",
              "ENDS_WITH",
              "GREATER_THAN",
              "GREATER_THAN_OR_EQUAL",
              "LESS_THAN",
              "LESS_THAN_OR_EQUAL",
              "IN",
              "EXISTS",
              "NOT_EXISTS"
            ]
          },
          "value": {
            "type": "string",
            "description": "Identifies the value of the attribute we are searching for."
          }
        },
        "description": "An attribute used during paging and/or searching.",
        "title": "SearchByAttribute"
      }
    }
  },
  "description": "Parameters specifying search attributes or a cursor to get results from a previous search.",
  "title": "SearchParms"
}
```

## Responses

### 200

Successful

#### application/json

Schema

```json
{
  "required": [
    "results"
  ],
  "type": "object",
  "properties": {
    "paging": {
      "required": [
        "limit"
      ],
      "type": "object",
      "properties": {
        "limit": {
          "maximum": 100,
          "minimum": 1,
          "type": "integer",
          "description": "The page limit used (1-100)",
          "format": "int32"
        },
        "nextCursor": {
          "type": "string",
          "description": "The cursor pointing to the next page."
        },
        "prevCursor": {
          "type": "string",
          "description": "The cursor pointing to the previous page."
        }
      },
      "description": "Contains navigation information.",
      "title": "Paging"
    },
    "results": {
      "type": "array",
      "description": "A single page from the list of audit events found.",
      "items": {
        "required": [
          "eventTime"
        ],
        "type": "object",
        "properties": {
          "accountId": {
            "type": "string",
            "description": "The UUID of the account containing this audit event."
          },
          "auditDetails": {
            "type": "object",
            "properties": {
              "entityAttributes": {
                "type": "array",
                "description": "A  list of attributes when an entity is added or removed.",
                "items": {
                  "type": "object",
                  "properties": {
                    "name": {
                      "type": "string",
                      "description": "The name of the attribute."
                    },
                    "value": {
                      "type": "string",
                      "description": "The value of the attribute."
                    }
                  },
                  "description": "Information about an attribute that was added or removed from an entity.",
                  "title": "EntityAttribute"
                }
              },
              "messageTokens": {
                "type": "array",
                "description": "List of tokens referencing event attributes that can be used in the audit message.",
                "items": {
                  "type": "string",
                  "description": "List of tokens referencing event attributes that can be used in the audit message."
                }
              },
              "modifiedEntityAttributes": {
                "type": "array",
                "description": "A  list of attributes when an entity is modified.",
                "items": {
                  "type": "object",
                  "properties": {
                    "name": {
                      "type": "string",
                      "description": "The name of the attribute."
                    },
                    "newValue": {
                      "type": "string",
                      "description": "The new value of the attribute."
                    },
                    "oldValue": {
                      "type": "string",
                      "description": "The old value of the attribute."
                    }
                  },
                  "description": "Information about an attribute that was modified for an entity.",
                  "title": "ModifiedEntityAttribute"
                }
              }
            },
            "description": "Additional audit details that may be included with an audit event.",
            "title": "AuditDetails"
          },
          "entityAction": {
            "type": "string",
            "description": "For a management event, the action that was performed."
          },
          "entityId": {
            "type": "string",
            "description": "For a management event, the UUID of the entity that was acted upon."
          },
          "entityName": {
            "type": "string",
            "description": "For a management event, the name of the entity that was acted upon."
          },
          "entityType": {
            "type": "string",
            "description": "For a management event, the entity type that was acted upon."
          },
          "eventCategory": {
            "type": "string",
            "description": "The category of the event.  Values are AUTHENTICATION or MANAGEMENT.",
            "enum": [
              "AUTHENTICATION",
              "MANAGEMENT",
              "ISSUANCE"
            ]
          },
          "eventOutcome": {
            "type": "string",
            "description": "The outcome of the event.  Values are success or fail.",
            "enum": [
              "SUCCESS",
              "FAIL"
            ]
          },
          "eventTime": {
            "type": "string",
            "description": "The time of this event.",
            "format": "date-time",
            "example": "2019-02-19T13:15:27Z"
          },
          "eventType": {
            "type": "string",
            "description": "The type of the event."
          },
          "eventVersion": {
            "type": "string",
            "description": "Version information for future use."
          },
          "id": {
            "type": "string",
            "description": "The UUID of this audit event."
          },
          "message": {
            "type": "string",
            "description": "A message key describing the event."
          },
          "requiredPermission": {
            "type": "string",
            "description": "The permission used for a management event."
          },
          "resourceId": {
            "type": "string",
            "description": "The UUID of the resource associated with the event.  For example the UUID of the application to which a user is authenticating."
          },
          "resourceName": {
            "type": "string",
            "description": "The name of the resource."
          },
          "serviceProviderAdminRoleId": {
            "type": "string",
            "description": "A UUID of the service provider role used for a management event."
          },
          "serviceProviderAdminRoleName": {
            "type": "string",
            "description": "The name of the service provider role."
          },
          "sourceIp": {
            "type": "string",
            "description": "The IP address of the client performing this event."
          },
          "subject": {
            "type": "string",
            "description": "The UUID of the subject that performed this event.  For administration events the subject will be the administrator or administration API application that performed the event.  For authentication events the subject will be the user that performed the authentication."
          },
          "subjectName": {
            "type": "string",
            "description": "The name of the subject that performed this event.  For users the value will be the user's user Id. For administration API applications, the value will be the application's name."
          },
          "subjectType": {
            "type": "string",
            "description": "The type of the subject that performed this event.  Values are USER or ADMIN_API.",
            "enum": [
              "USER",
              "ADMIN_API",
              "SERVICE_PROVIDER",
              "AGENT"
            ]
          },
          "subscriberAdminRoleId": {
            "type": "string",
            "description": "The UUID of the subscriber/site management role used for a management event."
          },
          "subscriberAdminRoleName": {
            "type": "string",
            "description": "The name of the subscriber/site management role."
          },
          "token": {
            "type": "string",
            "description": "Information about what authenticator was used for an authentication event."
          }
        },
        "description": "Information about an audit event returned when querying audit events.",
        "title": "AccountAuditEvent"
      }
    }
  },
  "description": "Contains paging information and audit events.",
  "title": "AuditEventPage"
}
```

### 400

Bad Request

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 401

Access denied

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 403

Forbidden

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 404

Not Found

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

### 409

Conflict

#### application/json

Schema

```json
{
  "type": "object",
  "properties": {
    "errorCode": {
      "type": "string",
      "description": "Error Codes specific to cause of failure.",
      "example": "invalid_user_response"
    },
    "errorMessage": {
      "type": "string",
      "description": "Additional Error Message describing the error.",
      "example": "Application id cannot be null"
    },
    "parameters": {
      "type": "array",
      "description": "Optional additional error information.",
      "items": {
        "type": "object",
        "description": "Optional additional error information."
      }
    }
  },
  "description": "Object containing information about errors reported by services.",
  "title": "ErrorInfo"
}
```

## Security

Requirements

```json
[
  {
    "AdminAPIAuthentication": [
      "REPORTS:VIEW"
    ]
  }
]
```