Accessing Audit Information Programmatically

TABLE OF CONTENTS

• Introduction
• Endpoint
• Authentication
  • Step 1: Create a Client Application in CafeX
  • Step 2: Generate an Authorization Token.
  • Step 3: Use the Authorization Token
• Date and Time format
• Search
• Request Body
  • Example Request Body
• Response Body
  • Response Body event object
  • Example Response Body
• Finding userId for searching
• Reference

Introduction

The CafeX Audit Events API allows the retrieval of audit event data for CafeX tenants. Data can be filtered by time and other event properties. Data access is secured using an authorization token which can be generated by CafeX tenants.

Endpoint

The API is available at:

https://app.cafex.com/audit-search-rest/search

Authentication

Access to the API is authenticated by including an authorization token in the request header. Below is the process for generating and using the token.

Step 1: Create a Client Application in CafeX

1. Click on the three dot header menu and select Tenant settings.

2. Under Management, click Client applications.

3. Click Add and provide the client application with a name, such as Audit Events API client application.

A client application will be created with a Client ID and a Client secret. Keep these credentials secure.

Step 2: Generate an Authorization Token.

To generate a token, make an HTTP POST request to:

Endpoint:
POST https://auth.cafex.com/authserver/token

Request Body: (use x-www-form-urlencoded format)

Replace {CLIENT ID HERE} and {CLIENT SECRET HERE} with your generated credentials.

Response:

The response will contain an access_token field.

Step 3: Use the Authorization Token

Include the token in the Authorization header for your API requests in the following format: Bearer {ACCESS TOKEN HERE}.

The token remains valid for 8 hours. After expiration, you can use the same Client ID and Client Secret to generate a new token.

Date and Time format

The API accepts date and time in the ISO 8601 format. Below are examples of valid formats:

• 2023-01-30T12:00:00.000
• 2023-01-30T12:00:00
• 2023-01-30T12:00
• 2023-01-30

If no offset is provided, the default is UTC. Time zone offsets can also be included, for example:

• 2023-01-30T12:00:00-05:00

All dates and times returned by the API use the full ISO 8601 format and are in UTC (no offset), for example:

• 2023-01-30T12:00:00.000+00:00

Search

You can perform searches by sending a POST request to:

Endpoint:
POST https://app.cafex.com/audit-search-rest/search

Request Requirements

1. Authorization Header:
   Make sure your request includes the necessary authorization token. For details, see Authentication.

2. JSON-Encoded Body:
   Include a JSON body with the required and optional attributes.

For best performance, make your queries as specific as possible (for example, use narrow date ranges and specify specify event types and services).

Important: Events are stored for a maximum of one year. Events older than this period will no longer be available for search.

Request Body

Example Request Body

{
   "page": {
       "pageSize": 100,
       "continuationToken": "abcdefghijklmnopqrstuvwxyz…"
   },
   "timestampFrom": "2023-01-01T09:00.00",
   "timestampTo": "2023-01-07T17:00.00",
   "service": ["TRACK", "ENTRY"],
   "secondaryAttributes": {
      "objectId": "23804d37-d753-4dad-84bb-8f691a50aa12"
   },
   "changes": {
      "status": "ACTIVE",
      "type": "STANDARD"
   },
   "sortDirection": "ASC"
}

Response Body

Response Body event object

Example Response Body

{
    "page": {
        "pageSize": 100,
        "continuationToken": "abcdefghijklmnopqrstuvwxyz…"
    },
    "events": [
        {
            "id": "61580af7-6def-4743-877f-3724fc83fc31",
            "service": "ENTRY",
            "type": "ENTRY_ACCESS",
            "action": "SUCCESS",
            "timestamp": "2022-01-01T09:00:00.123+00:00",
            "message": "Entry accessed: example.jpeg, filename type: jpeg",
            "trackId": "849c1214-fa97-4639-ade0-2219d3627823",
            "secondaryAttributes": {
                "objectId": "6e94b5a5-6753-4e4a-b57f-4ce220068a73"
            },
            "userEmail": "[email protected]",
            "userId": "910522e7-7664-4a81-98ca-16c1b725e14e",
            "userAccountId": "a6cc2b41-e251-44ce-9efa-a46d41dbe0cd",
            "ipAddress": "123.456.78.901"
        },
        ...
    ]
}

Finding userId for searching

To filter audit events by a specific user who carried out an action, include the userId in your search request. Follow these steps to locate the userId:

1. Log in to CafeX as a tenant administrator and click on the three dot header menu and select Tenant settings.
   
2. Under Management, click Users.
3. Find the user you would like to filter on and copy their ID from the correct row. You can use this as the userId value in a search request.
   

Reference

Service values

ACTION

API

ARTICLE

AUTH

CUSTOM_VIEW

DASHBOARD

ENTRY

PARTNER

RULES_ENGINE

SYSTEM

TENANT

TRACK

USER

USER_GROUP

Type values

API_KEY_CREATED

API_KEY_DELETED

AUDIT_QUERY

AUTH_LOGIN

AUTH_LOGOUT

CUSTOM_VIEW_EXIT_VIEW

CUSTOM_VIEW_INVOKE_ACTION

CUSTOM_VIEW_LOADED

CUSTOM_VIEW_LOGOUT

CUSTOM_VIEW_UI_ACTION

CUSTOM_VIEW_UI_CONTEXT_SWITCH

CUSTOM_VIEW_UI_INFO

DASHBOARD_ADD

DASHBOARD_DELETE

DASHBOARD_UPDATE

DATA_SOURCE_CREATED

DATA_SOURCE_DELETED

DATA_SOURCE_RECORDS_CREATE

DATA_SOURCE_RECORDS_DELETE

DATA_SOURCE_RECORDS_RETRIEVE

DATA_SOURCE_RECORDS_UPDATE

DATA_SOURCE_UPDATED

EMAIL_RULE_CHANGED

EMAIL_RULE_CREATED

EMAIL_RULE_DELETED

ENTRY_ACCESS

ENTRY_ACTION_ADD

ENTRY_ACTION_DELETE

ENTRY_ACTION_UPDATE

ENTRY_APPROVAL_REQUEST_ADD

ENTRY_APPROVAL_REQUEST_APPROVE

ENTRY_APPROVAL_REQUEST_DELETE

ENTRY_APPROVAL_REQUEST_UPDATE

ENTRY_CREATE

ENTRY_DELETE

ENTRY_FILE_DELETE

ENTRY_FILE_DOWNLOAD

ENTRY_FILE_SCAN

ENTRY_FILE_UPDATE

ENTRY_TEXT_FILE_DELETE

ENTRY_TEXT_FILE_UPDATE

ENTRY_TRANSCRIPTION_REQUEST

ENTRY_UPDATE

ENTRY_VIEW

GOOGLE_FILE_DOWNLOAD

GOOGLE_FILE_UPLOAD

GOOGLE_FILE_VIEW

KB_WIKI_CREATION

MINI_APP_ADDED

MINI_APP_DELETED

MINI_APP_UPDATED

MINI_APP_VIEW_ADDED

MINI_APP_VIEW_DELETED

MINI_APP_VIEW_UPDATED

ONEDRIVE_FILE_UPLOAD

ONEDRIVE_FILE_VIEW

PARTNERSHIP_CHANGED

PARTNERSHIP_CREATED

PARTNERSHIP_DELETED

RULESET_CREATED

RULESET_DELETED

RULESET_EXECUTED

RULESET_EXPORTED

RULESET_IMPORTED

RULESET_UPDATED

SYSTEM_SETTING_ACCESS

SYSTEM_SETTINGS_CHANGED

TASK_ADDED

TASK_DELETED

TASK_TABLE_ADDED

TASK_TABLE_DELETED

TASK_TABLE_UPDATED

TASK_UPDATED

TENANT_ACCESS

TENANT_CREATED

TENANT_SETTINGS_CHANGED

TRACK_ACCESS

TRACK_AUTO_ARCHIVE

TRACK_CHANGED

TRACK_COPY

TRACK_CREATED

TRACK_CREATION_SERVICE

TRACK_DELETED

TRACK_JOIN

TRACK_MEMBER_ADD

TRACK_MEMBER_ADD_PENDING

TRACK_MEMBER_ADD_REJECTED

TRACK_MEMBER_DELETE

TRACK_MEMBER_PENDING_ACCEPT

TRACK_MEMBER_PENDING_REJECT

TRACK_MEMBER_UPDATE

TRACK_RESTORE

TRACK_TRANSFER

UI_FLOW_ADDED

UI_FLOW_DELETED

UI_FLOW_UPDATED

USER_ANNOUNCEMENT_CHANGED

USER_ANNOUNCEMENT_CREATED

USER_ANNOUNCEMENT_DELETED

USER_CREATED

USER_GROUP_CREATED

USER_GROUP_DELETED

USER_GROUP_UPDATED

USER_SETTINGS_CHANGED

USER_UPDATED

WEBHOOK_NOTIFICATION_SENT

Action values

FAIL

START

SUCCESS