uip admin audit

Syntax and options for `uip admin audit`, which queries and exports UiPath admin audit events at organization and tenant scope.

uip admin audit queries and exports UiPath audit events — the platform-level admin audit trail (distinct from uip or audit-logs, which covers Orchestrator entity changes). Part of uip admin (overview), the UiPath admin tool.

Two scope subgroups register the identical three-verb shape:

• org — organization-scoped audit (admin events that are tenant-agnostic).
• tenant — tenant-scoped audit (events scoped to the active login tenant, or --tenant-id).

Typical workflow: audit <scope> sources (discover source IDs) → audit <scope> events --source <guid> --from-date … --to-date … (find the rows) → audit <scope> export --from-date … --to-date … --output-path … (download them).

大纲

uip admin audit org sources [--login-validity <minutes>]
uip admin audit org events [--from-date <iso>] [--to-date <iso>] [--source <guid>...] [--target <guid>...] [--type <guid>...] [--user-id <guid>...] [--search <term>] [--status Success|Failure] [--limit <n>]
uip admin audit org export --from-date <iso> --to-date <iso> --output-path <dir> [--file-format json|csv]

uip admin audit tenant sources [--tenant-id <guid>] [--login-validity <minutes>]
uip admin audit tenant events [--tenant-id <guid>] [... same filters as org events]
uip admin audit tenant export [--tenant-id <guid>] --from-date <iso> --to-date <iso> --output-path <dir> [--file-format json|csv]

tenant verbs additionally accept --tenant-id <guid> to override the tenant from your login context; org verbs do not (organization scope has no tenant to override).

uip admin audit org sources / uip admin audit tenant sources

List the audit event sources visible at this scope — each source is a top-level event category (for example Identity, Tenant, Robot). Use the returned id values with events --source <guid>.

选项

长	值	描述
--tenant-id <guid>	GUID	(tenant scope only.) Override the tenant from login context.
--login-validity <minutes>	整数	Override the interactive-login token lifetime for this call. Rarely needed.

示例

uip admin audit org sources

数据形状（--输出 json）

{
  "Code": "AuditOrgSources",
  "Data": [
    { "id": "11111111-1111-1111-1111-111111111111", "name": "Identity", "eventTargets": [] }
  ]
}

Code is AuditTenantSources under tenant.

uip admin audit org events / uip admin audit tenant events

Query audit events at this scope, paginated. Returns { auditEvents, next, previous } — not a bare array. Cursor naming is chronological: next is newer events, previous is older. When --limit exceeds 200 the CLI paginates internally (following previous) since the server clamps each call to 200 rows.

选项

长	值	描述
--from-date <iso>	ISO 8601	Start of the time interval. Inclusive.
--to-date <iso>	ISO 8601	End of the time interval. Inclusive.
--source <guid>	GUID, repeatable	Filter by event source IDs. Discover with sources.
--target <guid>	GUID, repeatable	Filter by event target IDs.
--type <guid>	GUID, repeatable	Filter by event type IDs.
--user-id <guid>	GUID, repeatable	Filter by acting user IDs.
--search <term>	字符串	Server-side substring search.
--status <status>	Success | Failure	Case-insensitive event-status filter.
--limit <n>	整数	Total events to return, 1–10000. Values over 200 are paginated client-side (server clamps each call to 200).
--tenant-id <guid>	GUID	(tenant scope only.) Override the tenant from login context.
--login-validity <minutes>	整数	Override the interactive-login token lifetime for this call. Rarely needed.

示例

# Fetch the latest 50 org audit events
uip admin audit org events --limit 50

# Filter by source and a 7-day window
uip admin audit tenant events --source 11111111-1111-1111-1111-111111111111 \
  --from-date 2026-04-22T00:00:00Z --to-date 2026-04-29T00:00:00Z

数据形状（--输出 json）

{
  "Code": "AuditOrgEvents",
  "Data": { "auditEvents": [], "next": null, "previous": null }
}

Code is AuditTenantEvents under tenant.

uip admin audit org export / uip admin audit tenant export

Export audit events from the long-term store. Issues one HTTP call per UTC day inside [--from-date, --to-date] and aggregates the results in memory before writing anything out — the full window is fetched first, and on any single day's failure the export aborts atomically (nothing is written; the failure names the day that failed).

--output-path is a base directory, not a file path — pass a folder, and the CLI generates a uniquely-named output inside it, stamped with the window and generation time (e.g. audit_2026-01-01_2026-02-01_20260617T112630), so repeated exports of the same window never collide:

• --file-format json (default) — a folder of one JSON file per UTC day.
• --file-format csv — a single CSV file with every event merged under a shared header.

选项

长	值	必填	描述
--from-date <iso>	ISO 8601	是	Start of the time interval.
--to-date <iso>	ISO 8601	是	End of the time interval.
--output-path <dir>	路径	conditionally	Base directory for the export (created if missing). Pass a directory only, never a filename — the CLI names the output for you. Required unless --output-file (deprecated alias) is passed instead.
--output-file <dir>	路径	否	Deprecated alias for --output-path, kept for backward compatibility. Despite the name, still treated as a base directory. When both are passed, --output-path wins and a deprecation warning is logged.
--file-format <format>	json | csv	否	Output shape. Default json.
--tenant-id <guid>	GUID	否	(tenant scope only.) Override the tenant from login context.
--login-validity <minutes>	整数	否	Override the interactive-login token lifetime for this call. Rarely needed.

示例

# JSON export — a timestamped folder of day-wise JSON files is created under the base dir
uip admin audit org export --from-date 2026-01-01 --to-date 2026-02-01 --output-path ./audit-exports

# CSV export — a single uniquely-named .csv file under the base dir
uip admin audit tenant export --from-date 2026-01-01 --to-date 2026-02-01 \
  --file-format csv --output-path ./audit-exports

数据形状（--输出 json）

JSON format:

{
  "Code": "AuditOrgExport",
  "Data": {
    "Path": "./audit-exports/audit_2026-01-01_2026-02-01_20260617T112630",
    "Format": "json",
    "Files": 27,
    "Bytes": 12345,
    "Days": 31,
    "NonEmptyDays": 27,
    "GeneratedAt": "2026-06-17T11:26:30.000Z"
  }
}

CSV format adds an Events count in place of Files:

{
  "Code": "AuditOrgExport",
  "Data": {
    "Path": "./audit-exports/audit_2026-01-01_2026-02-01_20260617T112630.csv",
    "Format": "csv",
    "Bytes": 98765,
    "Days": 31,
    "NonEmptyDays": 27,
    "Events": 1234,
    "GeneratedAt": "2026-06-17T11:26:30.000Z"
  }
}

Code is AuditTenantExport under tenant.

故障排除

• HTTP 401 — token is likely missing the Audit.Read scope. Run uip logout && uip login to mint a fresh token.
• HTTP 403 — the logged-in user lacks audit-read permission on this tenant; check role assignments in Automation Cloud.
• Tenant ID required (tenant scope) — pass --tenant-id <guid>, or log in and select a tenant first.
• HTTP 504 on export, or "Audit export failed for <date>" — a single day's chunk timed out. Re-run — the export is idempotent. If it persists, narrow --from-date/--to-date to skip the failing day.
• "resolves outside the output folder" / unsafe file name on export — indicates a malformed server response; re-run, and report it if it persists.

相关内容

• uip admin — overview of the whole uip admin tool.
• uip or audit-logs — the Orchestrator-entity audit trail, a distinct surface from this admin-level audit.

另请参阅

• 全局选项
• 退出代码