Searches messages for an audit and records the search in the audit log. This endpoint requires a license that includes the auditing module. Dates use ISO 8601 format. Requests are limited to ten per minute.
This endpoint replaces the deprecated auditGetMessages real-time method, which remains available until 9.0.0.
Permission required:
can-audit
Changelog
| Version | Description |
|---|---|
| 8.8.0 | Added |
The user ID.
The authentication token.
{
"rid": "GENERAL",
"startDate": "2026-08-01T00:00:00Z",
"endDate": "2026-08-20T23:59:59.999Z",
"users": [
"dana.reyes"
],
"msg": "incident report",
"type": "u"
}The ID of the room to search in. Optional.
The beginning of the period to search, as an ISO date string.
The end of the period to search, as an ISO date string.
The usernames whose messages are audited.
The text to search for in the messages.
The audit target. Use u for users, d for a direct message, or l for Omnichannel rooms. When rid is provided, the room ID determines the target.
The ID of the Omnichannel visitor to audit.
The ID of the Omnichannel agent to audit.
OK
{
"messages": [
{
"_id": "7aDSXtjMA3KPLxLjt",
"rid": "GENERAL",
"msg": "Please share the incident report",
"ts": "2026-08-12T09:14:03.412Z",
"u": {
"_id": "rbAXPnMktTFbNpwtJ",
"username": "dana.reyes",
"name": "Dana Reyes"
}
}
],
"success": true
}The messages matching the audit search.
Bad Request
Unauthorized
{
"status": "error",
"message": "You must be logged in to do this."
}Forbidden
{
"success": false,
"error": "User does not have the permissions required for this action [error-unauthorized]"
}