# Fetch audit logs

`POST /omni/executive-events/find`

Base URL: `https://demo-api.incodesmile.com` — Incode demo environment

Use this API to retrieve records of activities performed within your organization. These logs include key events such as changes to organization settings, executive actions, updates to flows, workflows and user identities, as well as changes made to organization’s watchlist.
Note: Requires admin login token.

## Path & query parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `avoidCounting` | query | boolean |  |  |
| `pageable` | query | object | yes |  |
| `api-version` | header | string | yes |  |

## Request body

Content-Type: `application/json`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `codes` | array[string] |  |  |
| `before` | string (date-time) |  |  |
| `after` | string (date-time) |  |  |
| `executiveIds` | array[string] |  |  |
| `entityTypes` | array[string] |  |  |
| `entityIds` | array[string] |  |  |
| `applications` | array[string] |  |  |
| `email` | string |  |  |
| `ipAddress` | string |  |  |
| `userAgent` | string |  |  |

## Responses

### 200

OK

Response body (`application/json`):

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `content` | array[ExecutiveEventDto] |  |  |
| `content.id` | string |  |  |
| `content.code` | string |  | Enum: `SESSION_DELETED`, `IDENTITY_DELETED`, `SESSION_FACE_ADDED`, `IDENTITY_FACE_ADDED`, `SESSION_MANUALLY_APPROVED`, `SESSION_MANUALLY_REJECTED`, `SESSION_VIEWED`, `SESSIONS_VIEWED`, `SESSION_PDF_DOWNLOADED`, `LOGIN_ATTEMPT`, `LOGOUT`, `USER_CREATED`, `USER_DELETED`, `USER_UPDATED`, `CONFIGURATION_CREATE`, `CONFIGURATION_CLONED`, `CONFIGURATION_RESET`, `CONFIGURATION_UPDATE`, `FLOW_CREATE`, `FLOW_UPDATE`, `FLOW_DELETE`, `FLOW_CLONE`, `IDENTITIES_REPORT_GENERATED`, `SESSIONS_REPORT_GENERATED`, `AUTHENTICATIONS_REPORT_GENERATED`, `WATCH_LISTS_REPORT_GENERATED`, `USERS_REPORT_GENERATED`, `DOUBLE_CHECK_RECORD_FETCHED`, `DOUBLE_CHECK_RECORD_UPDATED`, `DOUBLE_CHECK_FINISHED`, `SESSION_ANTIFRAUD_RESOLVED`, `WATCH_LISTS_ENTRY_CREATED`, `GOVERNMENT_VERIFICATION_PROVIDERS_UPDATED`, `GOVERNMENT_VERIFICATION_PROVIDERS_CREATED`, `GOVERNMENT_VERIFICATION_PROVIDERS_DELETED`, `WATCHLIST_PROVIDER_SETTINGS_CREATED`, `WATCHLIST_PROVIDER_SETTINGS_UPDATED`, `WATCHLIST_PROVIDER_SETTINGS_DELETED`, `PERSONAL_IDENTIFICATION_NUMBER_PROVIDERS_UPDATED`, `PERSONAL_IDENTIFICATION_NUMBER_PROVIDERS_DELETED`, `PERSONAL_IDENTIFICATION_NUMBER_PROVIDERS_CREATED`, `EKYB_PROVIDERS_UPDATED`, `EKYB_PROVIDERS_CREATED`, `EKYB_PROVIDERS_DELETED`, `EKYC_PROVIDERS_CREATED`, `EKYC_PROVIDERS_UPDATED`, `EKYC_PROVIDERS_DELETED`, `QES_PROVIDERS_UPDATED`, `QES_PROVIDERS_DELETED`, `QES_PROVIDERS_CREATED`, `GENERAL_PROVISIONING_SETTINGS_UPDATED`, `MODULES_PROVISIONING_SETTINGS_UPDATED`, `WORKFLOW_CREATED`, `WORKFLOW_IMPORTED`, `WORKFLOW_EDITED`, `WORKFLOW_UPDATED`, `WORKFLOW_DELETED`, `WORKFLOW_ACTIVATED`, `WORKFLOW_PAUSED`, `CONSENT_CREATED`, `CONSENT_UPDATED`, `CONSENT_DELETED`, `FRAUD_REPORTED`, `FRAUD_REPORT_REVOKED`, `WEBHOOK_CREATED`, `WEBHOOK_UPDATE`, `WEBHOOK_DELETE`, `WEBHOOK_AUTH_CONFIG_CREATE`, `WEBHOOK_AUTH_CONFIG_UPDATE`, `DATA_DELETION_UPDATE`, `WATCHLIST_ENTRY_DELETED`, `WATCHLIST_ENTRY_UPDATED`, `WATCHLIST_LIST_VIEWED`, `AUTHENTICATION_LIST_VIEWED`, `IDENTITY_VIEWED`, `SESSION_LIST_VIEWED`, `IDENTITY_LIST_VIEWED`, `AUDIT_LOG_REPORT_GENERATED`, `SINGLE_SESSION_REPORT_GENERATED`, `DATA_DELETION_DISABLE`, `FACE_ADDED_TO_DATABASE`, `SELFIE_ADDED_TO_IDENTITY_TEMPLATE`, `FRAUD_RING_RENAMED`, `FRAUD_RING_NOTE_ADDED` |
| `content.timestamp` | string (date-time) |  |  |
| `content.executiveId` | string |  |  |
| `content.managedEntityType` | string |  | Enum: `SESSION`, `IDENTITY`, `EXECUTIVE`, `FLOW`, `CONFIGURATION`, `WORKFLOW`, `WATCHLIST`, `PROVISIONING`, `CONSENT`, `DATA`, `WEBHOOK`, `AUDIT_LOG`, `AUTHENTICATION`, `USER`, `FRAUD_RING` |
| `content.managedEntityId` | string |  |  |
| `content.payload` | object |  |  |
| `content.apiKey` | string |  |  |
| `content.role` | string |  | Enum: `OPEN`, `STATISTICS`, `LIMITED`, `INCODE_IDENTITY`, `INCODE_ID_USER`, `ACCESS`, `AUTHENTICATOR`, `REFRESH`, `REGISTER`, `INCODE_ID_CLIENT`, `EXECUTIVE`, `ADMIN`, `SCIM_ADMIN`, `MULTI_ORG_ADMIN`, `INTEGRATOR`, `INCODE_EXECUTIVE`, `INCODE_ADMIN`, `WIDGET_CLIENT`, `INTERNAL_SERVICE`, `AUTHORIZATION_SERVER`, `KEYCLOAK_SESSION`, `HIPAA_ADMIN`, `HIPAA_VIEWER`, `WORKFORCE_ADMIN`, `WORKFORCE_HELPDESK_STAFF`, `WORKFORCE_RECRUITER`, `SERVER`, `IDENTITY_SERVICE` |
| `content.application` | string |  | Enum: `USER_SERVICE` |
| `content.ipAddress` | string |  |  |
| `content.userAgent` | string |  |  |
| `content.email` | string |  |  |
| `page` | object |  |  |
| `page.size` | integer (int32) |  |  |
| `page.totalElements` | integer (int64) |  |  |
| `page.totalPages` | integer (int64) |  |  |
| `page.currentPageNumber` | integer (int32) |  |  |
| `total` | integer (int64) |  |  |
| `more` | boolean |  |  |

### 400

Bad Request

Response body (`application/json`):

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `timestamp` | integer (int64) |  | UTC timestamp in milliseconds |
| `status` | integer (int32) |  | Custom error code or HTTP status code |
| `error` | string |  | HTTP status error |
| `message` | string |  | Custom error message |
| `path` | string |  | Endpoint path |
| `details` | object |  | Custom error details |