Activity audit log API reference

This page provides a reference for the resource types and event types you can use as query parameters to filter responses from the Get activity audit log API.

• Resource types specify which resource categories the API should include in the activity audit log results. For example, use include_resource_types[]=flow to retrieve only activities related to recipes.
• Event types define the events logged for these resource types, such as creating or deleting a recipe.

The resource types and event types listed in this document are specific to the activities available in your workspace for direct customers and the admin workspace for Embedded partners. You can use the following query parameters to include or exclude these types in your results:

• include_resource_types[]
• include_event_types[]
• exclude_resource_types[]
• exclude_event_types[]

Resource types

The following table maps each resource_type used in the API to its corresponding display name in the user interface.

Resource type	Display name
Account	Embedded partners only. Account settings
AccountProperty	Environment properties
Adapter	Custom connectors
ApiAccessProfile	API access profiles
ApiClient	Developer API clients
ApiCustomer	API clients (API platform)
ApiEndpoint	API endpoints
ApiGroup	API collections
ApiPolicy	API access policies
ApiPrivilegeGroup	Developer API client roles
AuditLogReplicationSettings	Audit log streaming
CommunityAdapterPublication	Community connectors
CustomOauthKey	Custom OAuth profiles
CustomOauthKeyAssignment	Embedded partners only. Custom OAuth profile assignments
Deployment	Project deployments
ExportManifest	Manifests
Flow	Recipes
Folder	Folders
LCAP::Models::App	Direct only. Workflow apps
LCAP::Models::Page	Direct only. Workflow apps pages
LookupTable	Lookup tables
ManagedUserGrant	Workspace collaborators and moderators
MemberInvitation	Workspace invitations
OrganizationAdapterPublication	Shared connectors
Package	Packages
PrivilegeGroup	Collaborator roles
Project	Projects
ProjectBuild	Project builds
ProjectProperty	Project properties
SharedAccount	Connections
SharingToken	Sharing tokens
Tags::Models::Tag	Tags
TeamProfile	Workspace admin settings
Topic	Event topics
User	Users. This resource type includes the Workspace and Environments subtypes, which you may encounter as the resource[type] in the API response.
WorkatoDbTable	Data tables
WorkatoSchema	Common data models
WorkatoTemplate	Message templates
dashboards_page	Insights dashboards
field_map_schema	Dynamic field mapping
lcap_app_user_group_role_assignment	Direct only. Workflow apps user group role assignment
lcap_app_workflow_stage	Direct only. Workflow apps stages
lcap_apps_portal	Direct only. Workflow apps portal
lcap_user	Direct only. Workflow apps users
lcap_user_group	Direct only. Workflow apps user groups
test_case	Test cases

Event types

The following events are grouped by their associated resource type. Each resource type represents a category of activities tracked in the audit log.

Account

Event type	Description
branding_updated	Embedded partners only. The branding of admin and customer workspaces was updated.

AccountProperty

Event type	Description
account_property_created	An environment property was created.
account_property_deleted	An environment property was deleted.
account_property_updated	An environment property was updated.

Adapter

Event type	Description
connector_created	A custom connector was created.
connector_deleted	A custom connector was deleted.
connector_installed	A custom connector was installed in the workspace.
connector_released	A custom connector was released.
connector_shared	A custom connector was shared.
connector_shared_closed_source_changed	The source code sharing settings of a custom connector were modified.
connector_updated	A custom connector was updated.

ApiAccessProfile

Event type	Description
access_profile_api_key_refreshed	The API key for an access profile was refreshed.
access_profile_created	An API access profile was created.
access_profile_deleted	An API access profile was deleted.
access_profile_updated	An API access profile was updated.

ApiClient

Event type	Description
developer_api_client_created	A Developer API client was created.
developer_api_client_deleted	A Developer API client was deleted.
developer_api_client_updated	A Developer API client was updated.
token_leaked	The API token for a Developer API client was leaked.
token_regenerated	A token was regenerated for a Developer API client.

ApiCustomer

Event type	Description
api_customer_created	An API client was created in the API platform.
api_customer_deleted	An API client was deleted in the API platform.
api_customer_updated	An API client was updated in the API platform.

ApiEndpoint

Event type	Description
endpoint_activated	An API endpoint was activated in an API collection.
endpoint_created	An API endpoint was created in an API collection.
endpoint_deactivated	An API endpoint was deactivated in an API collection.
endpoint_deleted	An API endpoint was deleted from an API collection.
endpoint_updated	An API endpoint was updated in an API collection.

ApiGroup

Event type	Description
api_collection_created	An API collection was created.
api_collection_deleted	An API collection was deleted.
api_collection_updated	An API collection was updated.

ApiPolicy

Event type	Description
api_policy_created	An API policy was created.
api_policy_deleted	An API policy was deleted.
api_policy_updated	An API policy was updated.

ApiPrivilegeGroup

Event type	Description
api_privilege_group_created	A Developer API client role was created.
api_privilege_group_deleted	A Developer API client role was deleted.
api_privilege_group_updated	A Developer API client role was updated.

AuditLogReplicationSettings

Event type	Description
audit_log_streaming_content_updated	The audit log streaming content was updated.
audit_log_streaming_destination_updated	The audit log streaming destination was updated.
audit_log_streaming_disabled	Audit log streaming was disabled in Workspace admin or the Admin console (Embedded).
audit_log_streaming_enabled	Audit log streaming was enabled in Workspace admin or the Admin console (Embedded).

CommunityAdapterPublication

Event type	Description
community_adapter_publication_approved	A community connector listing was approved.
community_adapter_publication_deleted	A community connector listing was deleted.
community_adapter_publication_for_review	A community connector listing was submitted for review.
community_adapter_publication_updated_by_admin	A community connector listing was updated by an admin.

CustomOauthKey

Event type	Description
custom_oauth_key_created	A custom OAuth profile was created.
custom_oauth_key_deleted	A custom OAuth profile was deleted.
custom_oauth_key_updated	A custom OAuth profile was updated.

CustomOauthKeyAssignment

Event type	Description
custom_oauth_profile_assignment_created	Embedded partners only. A custom OAuth profile was assigned to a customer workspace or a specific environment in the customer workspace.
custom_oauth_profile_assignment_deleted	Embedded partners only. A custom OAuth profile was removed from a customer workspace or a specific environment in the customer workspace.

Deployment

Event type	Description
deployment_failed	A deployment failed.
deployment_finished	A deployment finished.
deployment_review_approved	A deployment was approved.
deployment_review_comment_created	A comment was added to a deployment asset.
deployment_review_created	A review was created for a deployment.
deployment_review_created_comment	A comment was added to a deployment review.
deployment_review_deleted	A deployment review was deleted.
deployment_review_rejected	A deployment was rejected.
deployment_review_reset	A deployment was re-opened for review.
deployment_review_updated_comment	A comment added to a deployment review was updated.
deployment_submitted_for_review	A deployment was submitted for review.

ExportManifest

Event type	Description
manifest_created	A manifest was created.
manifest_deleted	A manifest was deleted.
manifest_updated	A manifest was updated.

Flow

Event type	Description
recipe_concurrency_updated	A recipe's concurrency setting was updated.
recipe_copied	A recipe was copied.
recipe_created	A recipe was created.
recipe_data_retention_settings_updated	A recipe's data retention settings were updated.
recipe_deleted	A recipe was deleted.
recipe_made_private	A recipe was made private.
recipe_made_public	A recipe was made public.
recipe_moved	A recipe was moved to a different folder.
recipe_renamed	A recipe was renamed.
recipe_started	A recipe was started.
recipe_stopped	A recipe was stopped.
recipe_trigger_reset	A recipe's trigger was reset.
recipe_undeleted	A recipe was restored.
recipe_updated	A recipe was updated.
tags_added	Tags were added to a recipe.
tags_removed	Tags were removed from a recipe.

Folder

Event type	Description
folder_created	A folder was created.
folder_deleted	A folder was deleted.
folder_moved	A folder was moved to a different project or folder.
folder_renamed	A folder was renamed.

LCAP::Models::App

Event type	Description
lcap_app_created	Direct only. A Workflow app was created.
lcap_app_deleted	Direct only. A Workflow app was deleted.
lcap_app_published	Direct only. A Workflow app was published.
lcap_app_renamed	Direct only. A Workflow app was renamed.
lcap_app_unpublished	Direct only. A Workflow app was unpublished.
lcap_app_updated	Direct only. A Workflow app's configuration was updated.

LCAP::Models::Page

Event type	Description
lcap_page_created	Direct only. A Workflow app page was created.
lcap_page_deleted	Direct only. A Workflow app page was deleted.
lcap_page_moved	Direct only. A Workflow app page was moved.
lcap_page_renamed	Direct only. A Workflow app page was renamed.
lcap_page_updated	Direct only. A Workflow app page was updated.
tags_added	Direct only. Tags were added to a Workflow app page.
tags_removed	Direct only. Tags were removed from a Workflow app page.

LookupTable

Event type	Description
lookup_table_created	A lookup table was created.
lookup_table_deleted	A lookup table was deleted.
lookup_table_exported	A lookup table was exported as a CSV file.
lookup_table_imported	A lookup table was imported as a CSV file.
lookup_table_moved	A lookup table was moved to a different project.
lookup_table_renamed	A lookup table was renamed.
lookup_table_truncated	A lookup table was truncated.
lookup_table_updated	A lookup table was updated.

ManagedUserGrant

Event type	Description
customer_manager_assigned	Embedded partners only. A customer manager was created and assigned to customer workspace(s).
customer_manager_removed	Embedded partners only. A customer manager was removed from customer workspace(s).
customer_manager_updated	Embedded partners only. A customer manager assignment was updated.
team_membership_created	A user joined a workspace with a specific role.
team_membership_deleted	A user was removed from the workspace.
team_membership_updated	A user's collaborator role was updated.
workspace_moderator_assigned	A workspace moderator was assigned.
workspace_moderator_removed	A workspace moderator was removed.
workspace_moderator_updated	A workspace moderator was updated.

MemberInvitation

Event type	Description
saml_sso_team_invitation_accept	A collaborator accepted the workspace invitation for a workspace with SAML SSO enforcement enabled and joined with a specific role.
team_invitation_accept	A user accepted the workspace invitation and joined the workspace with a specific role.
team_invitation_created	A user invited another user to join the workspace with a specific role.
team_invitation_deleted	A user cancelled the invitation for a user to join the workspace.
team_invitation_reject	An invited user refused to join the workspace.
team_invitation_updated	A user updated another user's invitation by changing their collaborator role.

OrganizationAdapterPublication

Event type	Description
organization_adapter_publication_created	A shared connector was deployed either from Automation HQ to all workspaces or from the Admin console to Embedded customer workspaces.
organization_adapter_publication_updated	A shared connector was redeployed with a new version either from Automation HQ to all workspaces or from the Admin console to Embedded customer workspaces.
organization_adapter_publication_deleted	A shared connector was removed either from all workspaces or from customer workspaces.

Package

Event type	Description
package_exported	A package was exported.
package_imported	A package was imported.

PrivilegeGroup

Event type	Description
role_created	A collaborator role was created.
role_deleted	A collaborator role was deleted.
role_permissions_changed	The permissions for a collaborator role changed.
role_updated	A collaborator role was updated.

Project

Event type	Description
project_created	A project was created.
project_deleted	A project was deleted.

ProjectBuild

Event type	Description
project_build_downloaded	A project build was downloaded.

ProjectProperty

Event type	Description
project_property_created	A project property was created.
project_property_deleted	A project property was deleted.
project_property_updated	A project property was updated.

SharedAccount

Event type	Description
connection_connected	A connection was established successfully.
connection_created	A connection was created.
connection_deleted	A connection was deleted.
connection_disconnected	A connection was disconnected.
connection_moved	A connection was moved to a different folder.
connection_updated	A connection was edited.
tags_added	Tags were added to a connection.
tags_removed	Tags were removed from a connection.

SharingToken

Event type	Description
sharing_token_created	A sharing token was generated for a recipe.
sharing_token_deleted	A sharing token was revoked for a recipe.

Tags::Models::Tag

Event type	Description
tag_created	A tag was created.
tag_deleted	A tag was deleted.
tag_updated	A tag was updated.

TeamProfile

Event type	Description
scim_token_created	A System for Cross-domain Identity Management specification (SCIM) token was created.
scim_token_refreshed	A SCIM token was refreshed.
scim_token_revoked	A SCIM token was revoked.
team_profile_auth_method_changed	The workspace authentication method was changed.
team_profile_created	The workspace authentication method was created.
team_profile_handle_changed	The workspace ID was changed.
team_profile_jit_provisioning_disabled	SAML SSO Just-in-Time (JIT) provisioning was disabled for the workspace.
team_profile_jit_provisioning_enabled	SAML SSO Just-in-Time (JIT) provisioning was enabled for the workspace.
team_profile_name_changed	The workspace name was changed.
team_profile_role_sync_disabled	Roles sync through SAML SSO was disabled for the workspace.
team_profile_role_sync_enabled	Roles sync through SAML SSO was enabled for the workspace.
team_profile_saml_configured	SAML SSO setting was saved for the workspace using a specific SAML provider.
team_profile_saml_required_disabled	SAML SSO enforcement was disabled for the workspace.
team_profile_saml_required_enabled	SAML SSO enforcement was enabled for the workspace.

Topic

Event type	Description
topic_created	An event topic was created.
topic_deleted	An event topic was deleted.
topic_reset	An event topic was reset.
topic_retention_updated	The message history retention of the event topic was updated.
topic_schema_updated	An event topic schema was updated.
topic_updated	An event topic was updated.

User

Event type	Description
account_activated	A workspace was activated.
account_activation_email_resent	A workspace activation email was re-sent.
account_activation_email_sent	A workspace activation email was sent.
account_email_updated	An account email was updated.
admin_two_fa_disabled	Two-factor authentication (2FA) was disabled for the workspace.
app_access_changed	App access for the workspace or for an Embedded customer workspace was updated.
aws_iam_external_id_scope_updated	Amazon Web Services (AWS) Identity and Access Management (IAM) external scope was updated.
child_user_created	Embedded partners only. An Embedded customer workspace was provisioned.
child_user_deleted	Embedded partners only. An Embedded customer workspace was deleted, or a specific environment within a customer workspace was deleted.
data_retention_settings_updated	The workspace data retention settings were updated.
delegated_admin_password_updated	The delegated admin password was updated.
email_change_initiated	An email change was initiated.
emails_receiving_admin_notifications_updated	The admin notification email addresses were updated.
emails_receiving_error_notifications_updated	The error notification email addresses were updated.
embedding_configuration_changed	Embedded partners only. The embedding configuration was changed. For example, the origin URLs or frame ancestors were changed.
environment_provisioned	Environments were enabled for the workspace or a specific customer workspace.
error_notification_throttling_disabled	Error notification throttling was disabled.
error_notification_throttling_enabled	Error notification throttling was enabled.
external_id_updated	Embedded partners only. The external ID for a customer workspace or a specific environment in the customer workspace was updated.
flows_concurrency_batch_update	The recipe concurrency was updated.
kms.key_id_updated	The key management system key ID was updated.
kms.key_material_updated	The key management system key material was updated.
kms.policy_changed	The key management system policy was changed.
kms.policy_enabled	The key management system policy was enabled.
kms.policy_updated	The key management system policy was updated.
manager_added	A delegated admin was added to the workspace.
manager_removed	A delegated admin was removed from the workspace.
max_worker_concurrency_changed	The maximum number of concurrent workers that can be assigned to a recipe was changed.
password_changed	The account password was changed.
password_reset_requested	A password reset was requested.
password_set	An account password was set.
password_was_reset	An account password was reset.
plan_addons_changed	The add-ons for a workspace were changed.
plan_detail_changed	The plan detail was updated.
plan_limit_changed	The plan limit was changed.
secret_manager_cache_cleared	The secrets manager cache was cleared.
secret_manager_created	An external secrets manager was added to the workspace.
secret_manager_scope_updated	The external secrets manager scope was updated.
secret_manager_updated	The external secrets manager for the workspace was updated.
switch_environment	A user switched to a different environment.
two_factor_authentication_disabled	Two-factor authentication was disabled for an account.
two_factor_authentication_enabled	Two-factor authentication was enabled for an account.
two_factor_authentication_recovery_codes_downloaded	The two-factor authentication recovery codes for an account were downloaded.
two_factor_authentication_recovery_codes_viewed	The two-factor authentication recovery codes for an account were viewed.
user_deleted	A user account was deleted.
user_login	A user signed in to their account.
user_login_failed	A user's sign-in attempt failed.
user_logout	A user signed out of their account.
user_restored	A previously deleted user account was restored.
workspace_automatically_provisioned	Access to a workspace was automatically provisioned.
workspace_automatically_updated	Access to a workspace was automatically updated.

WorkatoDbTable

Event type	Description
tags_added	Tags were added to a data table.
tags_removed	Tags were removed from a data table.
workato_db_table_created	A data table was created.
workato_db_table_deleted	A data table was deleted.
workato_db_table_download	The CSV file was downloaded for a data table.
workato_db_table_file_column_download	A data table file column was downloaded.
workato_db_table_record_created	A record was added to a data table.
workato_db_table_record_deleted	A record was removed from a data table.
workato_db_table_record_updated	A record was edited in a data table.
workato_db_table_renamed	A data table was renamed.
workato_db_table_schema_updated	The structure of a data table was updated.

WorkatoSchema

Event type	Description
common_data_model_created	A common data model was created.
common_data_model_deleted	A common data model was deleted.
common_data_model_updated	A common data model was updated.

WorkatoTemplate

Event type	Description
message_template_created	A message template was created.
message_template_deleted	A message template was deleted.
message_template_updated	A message template was updated.

dashboards_page

Event type	Description
dashboards_page_created	An Insights dashboard was created.
dashboards_page_deleted	An Insights dashboard was deleted.
dashboards_page_renamed	An Insights dashboard was renamed.
dashboards_page_updated	An Insights dashboard was updated.

field_map_schema

Event type	Description
field_map_schema_updated	Dynamic field mapping for a recipe was updated.

lcap_app_user_group_role_assignment

Event type	Description
lcap_app_user_group_role_assignment_created	Direct only. A role was assigned to a Workflow app user group.
lcap_app_user_group_role_assignment_deleted	Direct only. A role was removed from a Workflow app user group.
lcap_app_user_group_role_assignment_updated	Direct only. A role was updated for a Workflow app user group.

lcap_app_workflow_stage

Event type	Description
lcap_app_workflow_stage_created	Direct only. A Workflow app stage was created.
lcap_app_workflow_stage_deleted	Direct only. A Workflow app stage was deleted.
lcap_app_workflow_stage_renamed	Direct only. A Workflow app stage was renamed.
lcap_app_workflow_stage_updated	Direct only. A Workflow app stage was updated.

lcap_apps_portal

Event type	Description
lcap_apps_portal_authentication_settings_updated	Direct only. The authentication settings of the Workflow apps portal were updated.
lcap_apps_portal_branding_settings_updated	Direct only. The branding settings of the Workflow apps portal were updated.
lcap_apps_portal_embedding_settings_updated	Direct only. The embedding settings of the Workflow apps portal were updated.
lcap_apps_portal_renamed	Direct only. The Workflow apps portal was renamed.
lcap_apps_portal_url_updated	Direct only. The Workflow apps portal URL was updated.

lcap_user

Event type	Description
lcap_user_deleted	Direct only. A Workflow apps portal user was deleted.
lcap_user_invited	Direct only. A Workflow apps portal user was invited and added.
lcap_user_renamed	Direct only. A Workflow apps portal user was renamed.
lcap_user_user_groups_changed	Direct only. A Workflow apps portal user was added to or removed from a user group.

lcap_user_group

Event type	Description
lcap_user_group_created	Direct only. A Workflow apps user group was created.
lcap_user_group_deleted	Direct only. A Workflow apps user group was deleted.
lcap_user_group_renamed	Direct only. A Workflow apps user group was renamed.

test_case

Event type	Description
test_case_copied	A test case was copied.
test_case_created	A test case was created.
test_case_deleted	A test case was deleted.
test_case_renamed	A test case was renamed.
test_case_updated	A test case was updated.