> For the complete documentation index, see [llms.txt](https://knowledgebase.fabricdata.com/studio/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledgebase.fabricdata.com/studio/integrations-and-apis/origin-studio-production-api/audit.md).

# Audit

Provides access to audit events for a tenant. Queries run asynchronously. Start a query with POST /auditQueries and poll for results with GET /auditQueries/{queryExecutionId}.

## Start an audit query

> Starts an asynchronous audit query for the caller's tenant. Returns 202 with a queryExecutionId. Poll GET /auditQueries/{queryExecutionId} until status is SUCCEEDED or FAILED.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Audit","description":"Provides access to audit events for a tenant. Queries run asynchronously. Start a query with POST /auditQueries and poll for results with GET /auditQueries/{queryExecutionId}."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"AuditQueryCreateOneRequest":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAuditQueryCreateOneRequest","description":"JSON:API request body to start a new audit query.","type":"object","additionalProperties":false,"required":["data"],"properties":{"meta":{"$ref":"#/components/schemas/WriteRequestMeta"},"data":{"type":"object","additionalProperties":false,"required":["type","attributes"],"properties":{"type":{"type":"string","enum":["auditQueries"]},"attributes":{"type":"object","additionalProperties":false,"required":["dateFrom","dateTo"],"properties":{"dateFrom":{"type":"string","format":"date","pattern":"^\\d{4}-\\d{2}-\\d{2}$","description":"Start of the date range (inclusive), YYYY-MM-DD"},"dateTo":{"type":"string","format":"date","pattern":"^\\d{4}-\\d{2}-\\d{2}$","description":"End of the date range (inclusive), YYYY-MM-DD"},"resourceTypes":{"type":"array","items":{"type":"string","pattern":"^KS::[A-Za-z]+$"},"description":"Optional list of KS:: resource type keys to filter by (OR semantics)"},"search":{"type":"string","maxLength":200,"description":"Optional search string — matched against resourceName (LIKE) or rootEntityId (exact)"}}}}}}},"WriteRequestMeta":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IWriteRequestMeta","description":"Optional audit metadata for a write request. `audit.source` is the issuing surface/channel (e.g. studio-web, mcp, api, system); `audit.reason` is a free-text justification. Both are optional and length-capped.","type":"object","additionalProperties":false,"properties":{"audit":{"type":"object","additionalProperties":false,"properties":{"source":{"type":"string","maxLength":64},"reason":{"type":"string","maxLength":256}}}}},"AuditQueryCreateOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAuditQueryCreateOneResponse","description":"202 response returned when an audit query is successfully started. Poll GET /auditQueries/{id} for results.","type":"object","additionalProperties":false,"required":["data"],"properties":{"data":{"type":"object","additionalProperties":false,"required":["id","type","attributes"],"properties":{"id":{"type":"string","description":"Query execution ID — use as path param to poll results"},"type":{"type":"string","enum":["auditQueries"]},"attributes":{"type":"object","additionalProperties":false,"required":["status"],"properties":{"status":{"type":"string","enum":["RUNNING"],"description":"Always RUNNING for a freshly started query"}}}}}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/auditQueries":{"post":{"summary":"Start an audit query","description":"Starts an asynchronous audit query for the caller's tenant. Returns 202 with a queryExecutionId. Poll GET /auditQueries/{queryExecutionId} until status is SUCCEEDED or FAILED.","operationId":"auditQueryCreateOne","tags":["Audit"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditQueryCreateOneRequest"}}}},"responses":{"202":{"description":"Query started — poll for results","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditQueryCreateOneResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```

## Poll an audit query for results

> Returns the current status of an audit query. While running, returns 202 with an empty data array. When SUCCEEDED, returns 200 with up to 1,000 audit events. If meta.hasMore is true, the result set was truncated — refine filters to see all results.

```json
{"openapi":"3.0.3","info":{"title":"Fabric API - Audit","version":"0.9.2264"},"tags":[{"name":"Audit","description":"Provides access to audit events for a tenant. Queries run asynchronously. Start a query with POST /auditQueries and poll for results with GET /auditQueries/{queryExecutionId}."}],"servers":[{"url":"{protocol}://{domain}/{basePath}","variables":{"protocol":{"enum":["http","https"],"default":"https"},"domain":{"default":"api.studio.fabricdata.com"},"basePath":{"default":"v1"}}}],"security":[{"jwt-apikey-authorizer":[]}],"components":{"securitySchemes":{"jwt-apikey-authorizer":{"type":"apiKey","name":"Authorization","in":"header"}},"schemas":{"AuditQueryFindOneResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAuditQueryFindOneResponse","description":"Response when polling an audit query. 202 while RUNNING or FAILED; 200 with events in data[] when SUCCEEDED.","type":"object","additionalProperties":false,"required":["data","meta"],"properties":{"data":{"type":"array","items":{"$ref":"#/components/schemas/AuditEvent"},"description":"Audit event resources. Populated only when status is SUCCEEDED."},"meta":{"type":"object","additionalProperties":false,"required":["status"],"properties":{"status":{"type":"string","enum":["QUEUED","RUNNING","SUCCEEDED","FAILED"],"description":"Current query execution state"},"hasMore":{"type":"boolean","description":"True when the result set exceeds 1,000 events. Refine filters to see all results."}}}}},"AuditEvent":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAuditEvent","description":"JSON:API resource object for a single audit event","type":"object","additionalProperties":false,"required":["id","type","attributes"],"properties":{"id":{"type":"string","description":"Unique event ID"},"type":{"type":"string","enum":["auditEvents"]},"attributes":{"$ref":"#/components/schemas/AuditEventAttributes"}}},"AuditEventAttributes":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IAuditEventAttributes","description":"Attributes of a single audit event captured from a Keystone entity change","type":"object","additionalProperties":false,"required":["rootEntityId","tenantId","timestamp","actorId","actorName","actorType","action","resourceType","resourceId","resourceName"],"properties":{"rootEntityId":{"type":"string","description":"ID of the root entity this event is grouped under"},"tenantId":{"type":"string","description":"Tenant that owns this event"},"timestamp":{"type":"string","description":"ISO 8601 timestamp of when the event occurred"},"actorId":{"type":"string","description":"ID of the user or system that triggered the change"},"actorName":{"type":"string","description":"Display name of the actor"},"actorType":{"type":"string","description":"Type of actor (e.g. user, system)"},"action":{"type":"string","description":"Cedar action that was performed (e.g. updateRecord)"},"changeSource":{"type":"string","description":"Source system or surface that triggered the change"},"changeReason":{"type":"string","description":"Optional free-text reason provided by the actor"},"resourceType":{"type":"string","description":"KS:: prefixed entity type (e.g. KS::Record)"},"resourceId":{"type":"string","description":"ID of the specific resource that changed"},"resourceName":{"type":"string","description":"Display name of the resource at the time of the event"},"changesJson":{"type":"string","description":"JSON-encoded diff of the changes made"}}},"ErrorResponse":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IErrorResponse","description":"Standard JSON:API error response returned when a request fails. Contains an `errors` array with one or more error objects (status, title, and optional detail).","type":"object","required":["errors"],"additionalProperties":false,"properties":{"errors":{"type":"array","items":{"$ref":"#/components/schemas/Error"}}}},"Error":{"$schema":"http://json-schema.org/draft-07/schema#","title":"IError","description":"A single JSON:API error object. `status` is the HTTP status code as a string. `title` is a short, human-readable summary. `detail` provides optional context. `meta` may include structured conflict or authorization details.","type":"object","additionalProperties":false,"required":["status","title"],"properties":{"status":{"type":"string"},"title":{"type":"string"},"detail":{"type":"string"},"source":{"type":"object","description":"A JSON Pointer to the request field that caused the error (e.g. `/data/attributes/title`).","properties":{"pointer":{"type":"string"}}},"meta":{"type":"object","additionalProperties":true,"properties":{"stack":{"type":"string","description":"Error stack trace. Only present in non-production environments."},"conflictItems":{"type":"array","items":{"type":"object","properties":{"key":{"type":"string"},"value":{"type":"string"}}}},"unauthorizedItems":{"type":"array","items":{"type":"string"}}}}}}}},"paths":{"/auditQueries/{queryExecutionId}":{"get":{"summary":"Poll an audit query for results","description":"Returns the current status of an audit query. While running, returns 202 with an empty data array. When SUCCEEDED, returns 200 with up to 1,000 audit events. If meta.hasMore is true, the result set was truncated — refine filters to see all results.","operationId":"auditQueryFindOne","tags":["Audit"],"parameters":[{"name":"queryExecutionId","in":"path","required":true,"description":"Query execution ID returned by POST /auditQueries","schema":{"type":"string"}}],"responses":{"200":{"description":"Query succeeded — audit events returned","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditQueryFindOneResponse"}}}},"202":{"description":"Query still running or failed — poll again or check queryStatus","content":{"application/json":{"schema":{"$ref":"#/components/schemas/AuditQueryFindOneResponse"}}}},"400":{"description":"Bad Request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}},"500":{"description":"Internal Server Error","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ErrorResponse"}}}}}}}}}
```