# uip admin audit > Syntax and options for `uip admin audit`, which queries and exports UiPath admin audit events at organization and tenant scope. `uip admin audit` queries and exports **UiPath audit events** — the platform-level admin audit trail (distinct from [`uip or audit-logs`](./uip-or-audit-logs.md), which covers Orchestrator entity changes). Part of `uip admin` ([overview](./uip-admin.md)), the UiPath admin tool. Two scope subgroups register the identical three-verb shape: - **`org`** — organization-scoped audit (admin events that are tenant-agnostic). - **`tenant`** — tenant-scoped audit (events scoped to the active login tenant, or `--tenant-id`). Typical workflow: `audit sources` (discover source IDs) → `audit events --source --from-date … --to-date …` (find the rows) → `audit export --from-date … --to-date … --output-path …` (download them). ## Synopsis ```text uip admin audit org sources [--login-validity ] uip admin audit org events [--from-date ] [--to-date ] [--source ...] [--target ...] [--type ...] [--user-id ...] [--search ] [--status Success|Failure] [--limit ] uip admin audit org export --from-date --to-date --output-path [--file-format json|csv] uip admin audit tenant sources [--tenant-id ] [--login-validity ] uip admin audit tenant events [--tenant-id ] [... same filters as org events] uip admin audit tenant export [--tenant-id ] --from-date --to-date --output-path [--file-format json|csv] ``` `tenant` verbs additionally accept `--tenant-id ` to override the tenant from your login context; `org` verbs do not (organization scope has no tenant to override). ## uip admin audit org sources / uip admin audit tenant sources List the audit event sources visible at this scope — each source is a top-level event category (for example `Identity`, `Tenant`, `Robot`). Use the returned `id` values with `events --source `. ### Options | Long | Value | Description | |---|---|---| | `--tenant-id ` | GUID | *(`tenant` scope only.)* Override the tenant from login context. | | `--login-validity ` | integer | Override the interactive-login token lifetime for this call. Rarely needed. | ### Example ```bash uip admin audit org sources ``` ### Data shape (--output json) ```json { "Code": "AuditOrgSources", "Data": [ { "id": "11111111-1111-1111-1111-111111111111", "name": "Identity", "eventTargets": [] } ] } ``` `Code` is `AuditTenantSources` under `tenant`. ## uip admin audit org events / uip admin audit tenant events Query audit events at this scope, paginated. Returns `{ auditEvents, next, previous }` — **not** a bare array. Cursor naming is chronological: `next` is newer events, `previous` is older. When `--limit` exceeds 200 the CLI paginates internally (following `previous`) since the server clamps each call to 200 rows. ### Options | Long | Value | Description | |---|---|---| | `--from-date ` | ISO 8601 | Start of the time interval. Inclusive. | | `--to-date ` | ISO 8601 | End of the time interval. Inclusive. | | `--source ` | GUID, repeatable | Filter by event source IDs. Discover with `sources`. | | `--target ` | GUID, repeatable | Filter by event target IDs. | | `--type ` | GUID, repeatable | Filter by event type IDs. | | `--user-id ` | GUID, repeatable | Filter by acting user IDs. | | `--search ` | string | Server-side substring search. | | `--status ` | `Success` \| `Failure` | Case-insensitive event-status filter. | | `--limit ` | integer | Total events to return, 1–10000. Values over 200 are paginated client-side (server clamps each call to 200). | | `--tenant-id ` | GUID | *(`tenant` scope only.)* Override the tenant from login context. | | `--login-validity ` | integer | Override the interactive-login token lifetime for this call. Rarely needed. | ### Examples ```bash # Fetch the latest 50 org audit events uip admin audit org events --limit 50 ``` ```bash # Filter by source and a 7-day window uip admin audit tenant events --source 11111111-1111-1111-1111-111111111111 \ --from-date 2026-04-22T00:00:00Z --to-date 2026-04-29T00:00:00Z ``` ### Data shape (--output json) ```json { "Code": "AuditOrgEvents", "Data": { "auditEvents": [], "next": null, "previous": null } } ``` `Code` is `AuditTenantEvents` under `tenant`. ## uip admin audit org export / uip admin audit tenant export Export audit events from the long-term store. Issues one HTTP call per UTC day inside `[--from-date, --to-date]` and aggregates the results in memory before writing anything out — the full window is fetched first, and on any single day's failure the export aborts atomically (nothing is written; the failure names the day that failed). `--output-path` is a **base directory**, not a file path — pass a folder, and the CLI generates a uniquely-named output inside it, stamped with the window and generation time (e.g. `audit_2026-01-01_2026-02-01_20260617T112630`), so repeated exports of the same window never collide: - `--file-format json` (default) — a folder of one JSON file per UTC day. - `--file-format csv` — a single CSV file with every event merged under a shared header. ### Options | Long | Value | Required | Description | |---|---|---|---| | `--from-date ` | ISO 8601 | **yes** | Start of the time interval. | | `--to-date ` | ISO 8601 | **yes** | End of the time interval. | | `--output-path ` | path | conditionally | Base directory for the export (created if missing). Pass a directory only, never a filename — the CLI names the output for you. Required unless `--output-file` (deprecated alias) is passed instead. | | `--output-file ` | path | no | Deprecated alias for `--output-path`, kept for backward compatibility. Despite the name, still treated as a base directory. When both are passed, `--output-path` wins and a deprecation warning is logged. | | `--file-format ` | `json` \| `csv` | no | Output shape. Default `json`. | | `--tenant-id ` | GUID | no | *(`tenant` scope only.)* Override the tenant from login context. | | `--login-validity ` | integer | no | Override the interactive-login token lifetime for this call. Rarely needed. | ### Examples ```bash # JSON export — a timestamped folder of day-wise JSON files is created under the base dir uip admin audit org export --from-date 2026-01-01 --to-date 2026-02-01 --output-path ./audit-exports ``` ```bash # CSV export — a single uniquely-named .csv file under the base dir uip admin audit tenant export --from-date 2026-01-01 --to-date 2026-02-01 \ --file-format csv --output-path ./audit-exports ``` ### Data shape (--output json) JSON format: ```json { "Code": "AuditOrgExport", "Data": { "Path": "./audit-exports/audit_2026-01-01_2026-02-01_20260617T112630", "Format": "json", "Files": 27, "Bytes": 12345, "Days": 31, "NonEmptyDays": 27, "GeneratedAt": "2026-06-17T11:26:30.000Z" } } ``` CSV format adds an `Events` count in place of `Files`: ```json { "Code": "AuditOrgExport", "Data": { "Path": "./audit-exports/audit_2026-01-01_2026-02-01_20260617T112630.csv", "Format": "csv", "Bytes": 98765, "Days": 31, "NonEmptyDays": 27, "Events": 1234, "GeneratedAt": "2026-06-17T11:26:30.000Z" } } ``` `Code` is `AuditTenantExport` under `tenant`. ## Troubleshooting - **`HTTP 401`** — token is likely missing the `Audit.Read` scope. Run `uip logout && uip login` to mint a fresh token. - **`HTTP 403`** — the logged-in user lacks audit-read permission on this tenant; check role assignments in Automation Cloud. - **`Tenant ID required`** (tenant scope) — pass `--tenant-id `, or log in and select a tenant first. - **`HTTP 504` on export, or "Audit export failed for ``"** — a single day's chunk timed out. Re-run — the export is idempotent. If it persists, narrow `--from-date`/`--to-date` to skip the failing day. - **"resolves outside the output folder" / unsafe file name on export** — indicates a malformed server response; re-run, and report it if it persists. ## Related - [`uip admin`](./uip-admin.md) — overview of the whole `uip admin` tool. - [`uip or audit-logs`](./uip-or-audit-logs.md) — the Orchestrator-entity audit trail, a distinct surface from this admin-level audit. ## See also - [Global options](./global-options.md) - [Exit codes](./exit-codes.md)