Returns module audit transitions and policy changes after scope filtering.

GET

/api/workspace/file-protection/signal-audit

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
    Method = HttpMethod.Get,
    RequestUri = new Uri("https://example.com/api/workspace/file-protection/signal-audit?PolicyKind=0&Severity=1"),
    Headers =
    {
        { "Authorization", "Bearer <token>" },
    },
};
using (var response = await client.SendAsync(request))
{
    response.EnsureSuccessStatusCode();
    var body = await response.Content.ReadAsStringAsync();
    Console.WriteLine(body);
}

const url = 'https://example.com/api/workspace/file-protection/signal-audit?PolicyKind=0&Severity=1';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://example.com/api/workspace/file-protection/signal-audit?PolicyKind=0&Severity=1' \
  --header 'Authorization: Bearer <token>'

Authorizations

WorkspaceBearer

Parameters

Query Parameters

SourceId

string

AgentId

string

SignalId

string

PolicyKind

integer format: int32

Allowed values: 0 1 2 3 4 5

Severity

integer format: int32

Allowed values: 1 2

Event

string

SearchTerm

string

From

string format: date-time

Until

string format: date-time

Page

integer format: int32

PageSize

integer format: int32

access_token

string

Optional access token for clients that cannot set Authorization headers. Prefer Authorization: Bearer <token> when possible.

Responses

200

application/json

object

Data

Scope-filtered module audit page, including policy and recipient configuration changes.

object

Items

Array<object>

nullable

One immutable episode transition.

object

string

nullable

Event

string

nullable

OccurredAtUtc

string format: date-time

Severity

integer format: int32

Allowed values: 1 2

ActorUserId

string

nullable

Reason

string

nullable

Comment

string

nullable

SourceId

string

nullable

AgentId

string

nullable

SignalId

string

nullable

PolicyKind

integer format: int32

Allowed values: 0 1 2 3 4 5

FileId

string

nullable

FileName

string

nullable

DiagnosticSnapshot

Only recorded, safe diagnostic facts; null means the historical event did not record that value.

object

PolicyKind

integer format: int32

Allowed values: 0 1 2 3 4 5

State

integer format: int32

Allowed values: 0 1 2

FileId

string

nullable

FileName

string

nullable

DiagnosticCode

string

nullable

SafeErrorCode

string

nullable

ResolutionCode

string

nullable

RunId

string

nullable

OccurrenceId

string

nullable

RecoveryPointId

string

nullable

RaisedAtUtc

string format: date-time

nullable

UpdatedAtUtc

string format: date-time

nullable

ResolvedAtUtc

string format: date-time

nullable

ReferenceAtUtc

string format: date-time

nullable

LastObservedAtUtc

string format: date-time

nullable

CountedMinutes

number format: double

nullable

ThresholdMinutes

integer format: int32

nullable

TimeZoneId

string

nullable

Calendar

Array<object>

nullable

One weekly local interval; day is ISO Monday=1 through Sunday=7. End less than start crosses midnight.

object

DayOfWeek

integer format: int32

StartMinute

integer format: int32

EndMinute

integer format: int32

Policies

Array<object>

nullable

Object-owned rule. Null thresholds disable the corresponding escalation level.

object

Kind

integer format: int32

Allowed values: 0 1 2 3 4 5

Enabled

boolean

EventSeverity

integer format: int32

Allowed values: 1 2

WarningAfterMinutes

integer format: int32

nullable

ErrorAfterMinutes

integer format: int32

nullable

Calendar

Array<object>

nullable

One weekly local interval; day is ISO Monday=1 through Sunday=7. End less than start crosses midnight.

object

DayOfWeek

integer format: int32

StartMinute

integer format: int32

EndMinute

integer format: int32

Recipients

Array<object>

nullable

Recipient selections for one type and level, with current workspace eligible audience count.

object

PolicyKind

integer format: int32

Allowed values: 0 1 2 3 4 5

Severity

integer format: int32

Allowed values: 1 2

Recipients

Array<object>

nullable

An explicit role or responsibility-group recipient selection.

object

Kind

integer format: int32

Allowed values: 0 1

string

nullable

DisplayName

string

nullable

EligibleRecipientCount

integer format: int32

TimeZoneId

string

nullable

ActorDisplayName

string

nullable

ObjectDisplayName

string

nullable

TotalCount

integer format: int32

Page

integer format: int32

PageSize

integer format: int32

Errors

Array<object>

nullable

object

Code

required

string

nullable

Message

required

string

nullable

Target

string

nullable

Field

string

nullable

Metadata

object

key

additional properties

string

nullable

Type

integer format: int32

Allowed values: 0 1 2

Severity

integer format: int32

Allowed values: 0 1 2

Warnings

Array<object>

nullable

object

Code

required

string

nullable

Message

required

string

nullable

Target

string

nullable

Field

string

nullable

Metadata

object

key

additional properties

string

nullable

Type

integer format: int32

Allowed values: 0 1 2

Severity

integer format: int32

Allowed values: 0 1 2

Success

boolean

Example

{
  "Data": {
    "Items": [
      {
        "Severity": 1,
        "PolicyKind": 0,
        "DiagnosticSnapshot": {
          "PolicyKind": 0,
          "State": 0
        },
        "Policies": [
          {
            "Kind": 0,
            "EventSeverity": 1
          }
        ],
        "Recipients": [
          {
            "PolicyKind": 0,
            "Severity": 1,
            "Recipients": [
              {
                "Kind": 0
              }
            ]
          }
        ]
      }
    ]
  },
  "Errors": [
    {
      "Type": 0,
      "Severity": 0
    }
  ],
  "Warnings": [
    {
      "Type": 0,
      "Severity": 0
    }
  ]
}