AuditEventDto

One entry of the portal audit trail: who changed what, from where, and where it belongs in the product.

Name	Type	Description	Notes
id	Integer (int32)	The ID of the recorded entry. Nothing accepts it as an argument - no operation fetches a single audit event - so it serves only to tell two otherwise identical entries apart.	[optional] [example: 1]
date	ApiDateTime	When the action happened, in the portal time zone. The from and to filters are read as UTC instants, so the two do not line up on a portal that is not on UTC.	[optional]
user	String	The display name of the user who acted, taken from the account as it stands now rather than as it stood when the entry was written. A localised placeholder stands in when there is no account to read: a portal background job, an anonymous guest, or a user who has since been deleted.	[optional] [example: John Doe] [nullable]
userId	UUID (uuid)	The ID of the user who acted, which is what the userId filter of this operation matches on. It stays readable after the account is deleted, which is when user falls back to a placeholder.	[optional] [example: 00000000-0000-0000-0000-000000000001]
action	String	The whole event as a readable sentence in the portal language, with the names of the objects involved substituted into it. On the two audit/.../last operations each substituted value is cut to 50 characters; the filtered operations substitute them in full. It is empty when the build has no wording for the action.	[optional] [example: User logged in] [nullable]
actionId	MessageAction	The action itself, as the action filter of this operation spells it and as GET api/2.0/security/audit/mappers lists it under messageAction. Use this rather than parsing action, which is prose and changes with the portal language.	[optional] [enum: 1000, 1001, 1002, 1003, 1004, 1005, 1006, 1007, 1008, 1009, 1010, 1011, 1012, 1013, 1014, 1015, 1016, 1017, 1018, 1019, 1020, 1021, 1022, 1023, 1024, 1025, 1026, 1027, 1028, 1029, 4000, 4001, 4002, 4003, 4004, 4005, 4006, 4007, 4008, 4009, 4010, 4011, 4012, 4013, 4014, 4015, 4016, 4017, 4018, 4019, 4020, 4021, 4022, 4023, 4024, 4025, 4026, 4027, 4028, 4029, 4030, 4031, 4032, 4033, 4034, 4035, 4036, 4037, 5000, 5001, 5002, 5003, 5004, 5005, 5006, 5007, 5008, 5009, 5010, 5011, 5012, 5013, 5014, 5015, 5016, 5017, 5018, 5019, 5020, 5021, 5022, 5023, 5024, 5025, 5026, 5027, 5028, 5029, 5030, 5031, 5032, 5033, 5034, 5035, 5036, 5037, 5038, 5039, 5040, 5041, 5042, 5043, 5044, 5045, 5046, 5047, 5048, 5049, 5050, 5053, 5054, 5055, 5056, 5057, 5058, 5059, 5060, 5061, 5062, 5063, 5064, 5065, 5066, 5068, 5069, 5070, 5071, 5072, 5073, 5074, 5075, 5076, 5077, 5078, 5079, 5080, 5081, 5082, 5083, 5084, 5085, 5086, 5087, 5088, 5089, 5090, 5091, 5092, 5093, 5094, 5095, 5096, 5097, 5098, 5099, 5100, 5101, 5102, 5103, 5104, 5105, 5106, 5107, 5108, 5109, 5110, 5111, 5112, 5113, 5114, 5115, 5116, 5117, 5118, 5119, 5120, 5121, 5122, 5123, 5124, 5125, 5126, 5127, 5128, 5129, 5130, 5131, 5132, 5133, 5150, 5151, 5152, 5153, 5154, 5155, 5156, 5157, 5158, 5159, 5160, 5161, 5162, 5163, 5201, 5202, 5203, 5204, 5205, 5206, 5207, 5300, 5301, 5302, 5303, 5304, 5305, 5306, 5307, 5308, 5309, 5501, 5502, 5503, 6000, 6001, 6002, 6003, 6004, 6005, 6006, 6007, 6008, 6009, 6010, 6011, 6012, 6013, 6014, 6015, 6016, 6017, 6018, 6019, 6020, 6021, 6022, 6023, 6024, 6025, 6026, 6027, 6028, 6029, 6030, 6031, 6032, 6033, 6034, 6035, 6036, 6037, 6038, 6039, 6040, 6041, 6042, 6043, 6044, 6045, 6046, 6047, 6048, 6049, 6050, 6051, 6052, 6053, 6054, 6055, 6056, 6057, 6058, 6059, 6060, 6061, 6062, 6063, 6064, 6065, 6066, 6067, 6068, 6069, 6070, 6071, 6072, 6073, 6074, 6075, 6076, 6077, 6078, 6079, 6080, 6081, 6082, 6083, 6084, 6085, 6086, 6087, 6088, 6089, 6090, 6091, 6092, 6093, 6094, 6095, 6096, 6097, 6098, 6099, 6100, 6101, 6102, 6103, 6104, 6105, 6106, 6107, 6108, 6109, 7000, 7001, 7002, 7003, 7004, 7005, 9901, 9902, 9903, 9904, 9905, 9906, 9907, 9908, 9909, -1]
ip	String	The IP address the request came from, with the port stripped off. It is empty for an action a portal background job performed, which has no request behind it.	[optional] [example: 192.0.2.1] [nullable]
country	String	The English name of the country the IP address is located in, empty when the address cannot be located - the normal outcome for private and loopback addresses.	[optional] [example: United States] [nullable]
city	String	The city the IP address is located in, empty under the same conditions as country.	[optional] [example: New York] [nullable]
browser	String	The browser and its version as parsed from the user agent of the request, empty when the client sent none that could be parsed or when no request was involved.	[optional] [example: Chrome 120.0] [nullable]
platform	String	The operating system as parsed from the same user agent, empty under the same conditions as browser.	[optional] [example: Windows] [nullable]
page	String	Where in the portal the action was made from: the referrer of the request, or that request's own path when it carried no referrer. Long values are cut off at 512 characters.	[optional] [example: /rooms/shared] [nullable]
actionType	ActionType	The kind of change the action stands for, as the actionType filter of this operation spells it. It is derived from actionId, not stored per entry, so it is the same on every entry of one action.	[optional] [enum: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19]
product	ProductType	The product the action belongs to. It cannot be filtered on here; the tree that groups actions by product is GET api/2.0/security/audit/mappers.	[optional] [enum: 2, 3, 7, 8]
location	LocationType	The location inside that product, as the moduleType filter of this operation spells it. It is also derived from actionId rather than stored per entry.	[optional] [enum: 0, 1, 2, 3, 27, 29, 30, 31]
target	List	The objects the action was applied to, as the trail recorded them - a title, an account, an ID - one string each. It is empty for an action that targets nothing, such as a settings change, and the target filter of this operation matches one of these values in full.	[optional] [example: [item1, item2]] [nullable]
entries	List	The kinds of object the action applies to, holding at most two entries and none at all for an action that targets nothing. Only the first of them can be filtered on, through entryType.	[optional] [example: [File, Folder]] [nullable]
context	String	Where the action took place, spelled out in the portal language rather than as a code: for a Documents event the room or the root folder it happened in, and for anything else the name of the module. Nothing filters on it.	[optional] [example: Security settings updated] [nullable]