---
title: "Search Audit Trail Data"
method: POST
path: "/restapi/v1.0/account/{accountId}/audit-trail/search"
tags: ["Audit Trail"]
---

# Search Audit Trail Data

`POST /restapi/v1.0/account/{accountId}/audit-trail/search`

## Request

- Base URL: `https://platform.ringcentral.com`
- URL: `https://platform.ringcentral.com/restapi/v1.0/account/{accountId}/audit-trail/search`
- Auth: OAuth 2
  - Authorization code: `https://platform.ringcentral.com/restapi/oauth/authorize`
  - Token URL: `https://platform.ringcentral.com/restapi/oauth/token`
- TypeScript: <https://skmtc.dev/ringcentral/apis/ringcentral-api/docs/restapi/v1.0/account/:accountId/audit-trail/search/post.ts> (a function with typed inputs; its response is checked against the schema)

Returns the audit trail data with specific filters applied.
Audit trail searching is limited to the last 10,000 records or last 180 days, whichever comes first.

## Path parameters

- `accountId` string, required

## Request body

- AccountHistorySearchPublicRequest
  - `eventTimeFrom` string, date-time: The beginning of the time range to return records in ISO 8601 format in UTC timezone, default is "eventTimeFrom"-24 hours
  - `eventTimeTo` string, date-time: The end of the time range to return records in ISO 8601 format in UTC timezone, default is the current time
  - `initiatorIds` string[]: List of extension IDs of change initiators.
  - `page` integer: Page number in the result set
  - `perPage` integer: Number of records to be returned per page.
  - `targetIds` string[]: List of extension (user) IDs affected by this action.
  - `siteId` string: Site ID to apply as a filter
  - `actionIds` string[]: List of action IDs (exact keys) to search for (alternatively "excludeActionIds" option can be used).
  - `searchString` string: The (sub)string to search, applied to the following fields: - initiator.name - initiator.role - initiator.extensionNumber - target.name - target.extensionNumber - details.parameters.value
  - `excludeActionIds` string[]: List of action IDs (exact keys) to exclude from your search (alternatively "actionIds" option can be used).

## Response `200`

List of Account History Records

- AccountHistorySearchPublicResponse
  - `records` AccountHistoryPublicRecord[]: List of records
    - `id` string: Internal record identifier
    - `eventTime` string, date-time: Timestamp of an event (provided by a client), RFC3339 date-time format, UTC time zone.
    - `initiator` AccountHistoryRecordPublicInitiator: Event initiator info
      - `extensionId` string: Current user extension identifier
      - `extensionNumber` string: Current user extension (short) number
      - `name` string: Current user full name
      - `role` string: Current user role
    - `actionId` string: Action type
    - `eventType` string: Operation: "CREATE", "UPDATE", "DELETE" or custom
    - `accountId` string: Account identifier which is related with the particular record.
    - `accountName` string: Account (company) name
    - `target` AccountHistoryRecordTarget: Action target object (company/extension)
      - `objectId` string: Extension identifier of the affected entity or "0" for Company level
      - `objectType` 'Extension' | 'Account' | 'Company' | 'Template': Type of the entity.
      - `name` string: Target extension name
      - `extensionNumber` string: Target extension (short) number of the affected entity (if the objectType is EXTENSION).
      - `siteId` string: Target extension site identifier (if any)
    - `clientIp` string: IP-address of a client.
    - `comment` string: Custom top-level comment
    - `details` AccountHistoryRecordPublicDetails
      - `parameters` AccountHistoryRecordDetailsParameters[]: Event details (additional parameters)
        - `key` string, required
        - `value` string, required
  - `paging` AccountHistoryPaging
    - `page` integer: The current page number. 1-indexed, so the first page is 1 by default. May be omitted if result is empty (because non-existent page was specified or perPage=0 was requested)
    - `perPage` integer: Current page size, describes how many items are in each page. Matches "perPage" parameter from the request
    - `total` integer: Total number of pages in a dataset. May be omitted for some resources due to performance reasons
    - `totalFound` integer: Total number of elements in a dataset. May be omitted for some resources due to performance reasons

## Other responses

- `400`: General response with **HTTP 400 "Bad request"** status.<br> Reasons: unparsable request, path, query or body parameters are invalid. The error description may contain reference to particular parameter(s) which haven't passed the validation.
- `403`: General response with **HTTP 403 "Forbidden"** status.<br> Reasons: the requested operation is forbidden because of certain resource state, lack of permissions, feature unavailability, etc.
- `404`: General response with **HTTP 404 "Not found"** status.<br> Reasons: the entity with given ID (typically specified in a path parameter), is not found or inaccessible
- `500`: General response with **HTTP 500 "Internal Server Error"** status.<br> Reasons: general server-side error.
- `503`: General response with **HTTP 503 "Service not available"** status.<br> Reasons: server cannot process the request because of being overloaded, misconfiguration or other issues.

---

[API](https://skmtc.dev/ringcentral/apis/ringcentral-api.md) - [All operations](https://skmtc.dev/ringcentral/apis/ringcentral-api/llms.txt) - [OpenAPI document](https://skmtc.dev/ringcentral/apis/ringcentral-api/revisions/8d602198ec97?raw)