> ## Documentation Index
> Fetch the complete documentation index at: https://developer.rocket.chat/llms.txt
> Use this file to discover all available pages before exploring further.
# Audit Messages
>
Searches messages for an audit and records the search in the audit log. This endpoint requires a license that includes the `auditing` module. Dates use ISO 8601 format. Requests are limited to ten per minute.
This endpoint replaces the deprecated `auditGetMessages` real-time method, which remains available until 9.0.0.
**Permission required**:
- `can-audit`
### Changelog
| Version | Description |
| ---------------- | ------------|
|8.8.0 | Added |
## OpenAPI
````json POST /api/v1/audit.messages
{
"openapi": "3.0.0",
"info": {
"version": "1.0.0",
"title": "Settings"
},
"servers": [
{
"url": "https://apiexplorer.support.rocket.chat"
}
],
"tags": [
{
"name": "Settings"
},
{
"name": "Audit"
},
{
"name": "Cloud"
},
{
"name": "DNS"
},
{
"name": "E2E"
},
{
"name": "Import"
},
{
"name": "Bulk User Import"
},
{
"name": "Instances"
},
{
"name": "Federation"
},
{
"name": "Moderation"
},
{
"name": "Device Management"
},
{
"name": "Password policy"
},
{
"name": "Video Conference"
},
{
"name": "Media Calls"
}
],
"paths": {
"/api/v1/audit.messages": {
"parameters": [],
"post": {
"tags": [
"Audit"
],
"summary": "Audit Messages",
"description": "\n\nSearches messages for an audit and records the search in the audit log. This endpoint requires a license that includes the `auditing` module. Dates use ISO 8601 format. Requests are limited to ten per minute.\n\nThis endpoint replaces the deprecated `auditGetMessages` real-time method, which remains available until 9.0.0.\n\n**Permission required**:\n- `can-audit`\n\n### Changelog\n| Version | Description |\n| ---------------- | ------------|\n|8.8.0 | Added |",
"operationId": "post-api-v1-audit.messages",
"parameters": [
{
"$ref": "#/components/parameters/X-User-Id"
},
{
"$ref": "#/components/parameters/X-Auth-Token"
}
],
"requestBody": {
"required": "true",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"rid": {
"type": "string",
"description": "The ID of the room to search in. Optional.",
"example": "GENERAL"
},
"startDate": {
"type": "string",
"format": "date-time",
"description": "The beginning of the period to search, as an ISO date string.",
"example": "2026-08-01T00:00:00Z"
},
"endDate": {
"type": "string",
"format": "date-time",
"description": "The end of the period to search, as an ISO date string.",
"example": "2026-08-20T23:59:59.999Z"
},
"users": {
"type": "array",
"description": "The usernames whose messages are audited.",
"items": {
"type": "string"
},
"example": [
"dana.reyes"
]
},
"msg": {
"type": "string",
"nullable": "true",
"description": "The text to search for in the messages.",
"example": "incident report"
},
"type": {
"type": "string",
"description": "The audit target. Use `u` for users, `d` for a direct message, or `l` for Omnichannel rooms. When `rid` is provided, the room ID determines the target.",
"example": "u"
},
"visitor": {
"type": "string",
"nullable": "true",
"description": "The ID of the Omnichannel visitor to audit.",
"example": "8f4c2d1e9a7b6c5d3e2f1a0b"
},
"agent": {
"type": "string",
"nullable": "true",
"description": "The ID of the Omnichannel agent to audit.",
"example": "rbAXPnMktTFbNpwtJ"
}
},
"required": [
"startDate",
"endDate",
"users",
"msg",
"type"
],
"additionalProperties": "false"
},
"examples": {
"Example": {
"value": {
"rid": "GENERAL",
"startDate": "2026-08-01T00:00:00Z",
"endDate": "2026-08-20T23:59:59.999Z",
"users": [
"dana.reyes"
],
"msg": "incident report",
"type": "u"
}
}
}
}
}
},
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"messages": {
"type": "array",
"description": "The messages matching the audit search.",
"items": {
"type": "object",
"properties": {
"_id": {
"type": "string"
},
"rid": {
"type": "string"
},
"msg": {
"type": "string"
},
"ts": {
"type": "string"
},
"u": {
"type": "object",
"properties": {
"_id": {
"type": "string"
},
"username": {
"type": "string"
},
"name": {
"type": "string"
}
}
}
}
}
},
"success": {
"type": "boolean"
}
},
"required": [
"messages",
"success"
],
"additionalProperties": "false"
},
"examples": {
"Success Example": {
"value": {
"messages": [
{
"_id": "7aDSXtjMA3KPLxLjt",
"rid": "GENERAL",
"msg": "Please share the incident report",
"ts": "2026-08-12T09:14:03.412Z",
"u": {
"_id": "rbAXPnMktTFbNpwtJ",
"username": "dana.reyes",
"name": "Dana Reyes"
}
}
],
"success": "true"
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"success": {
"type": "boolean"
},
"error": {
"type": "string"
},
"errorType": {
"type": "string"
}
}
}
}
}
},
"401": {
"$ref": "#/components/responses/authorizationError"
},
"403": {
"$ref": "#/components/responses/forbiddenError"
}
}
}
}
},
"components": {
"parameters": {
"X-User-Id": {
"name": "X-User-Id",
"in": "header",
"required": "true",
"schema": {
"type": "string"
},
"example": "CkCPNctrgCDfmWLqC",
"description": "The user ID."
},
"X-Auth-Token": {
"name": "X-Auth-Token",
"in": "header",
"required": "true",
"schema": {
"type": "string"
},
"example": "1Dd4iN_ClKn5jl-xPC36snQ4s9Zd5GZnXCQuCNSKcVE",
"description": "The authentication token."
}
},
"responses": {
"authorizationError": {
"description": "Unauthorized",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"status": {
"type": "string"
},
"message": {
"type": "string"
}
}
},
"examples": {
"Authorization Error": {
"value": {
"status": "error",
"message": "You must be logged in to do this."
}
}
}
}
}
},
"forbiddenError": {
"description": "Forbidden",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"success": {
"type": "boolean"
},
"error": {
"type": "string"
}
}
},
"examples": {
"Permission Error": {
"value": {
"success": "false",
"error": "User does not have the permissions required for this action [error-unauthorized]"
}
}
}
}
}
}
}
}
}
````
![\"Premium](\"https://raw.githubusercontent.com/RocketChat/Rocket.Chat-Open-API/main/images/premium.svg\")