> ## Documentation Index
> Fetch the complete documentation index at: https://developer.rocket.chat/llms.txt
> Use this file to discover all available pages before exploring further.
# List ABAC audit events
>
- Lists ABAC audit events.
- Returns a paginated audit log of ABAC-related actions (attribute changes, room attribute changes/removals, and ABAC actions), filterable by time range (`start`, `end`) and optional `actor`, with optional sorting.
- Requires the ABAC and Auditing licenses, the `abac-management` and `view-abac-admin-audit` permissions.
### Changelog
| Version | Description |
| ------- | ----------- |
| 8.0.0 | Added |
| 8.5.0 | Added the `view-abac-admin-audit` granular permission requirement. |
## OpenAPI
````json GET /api/v1/abac/audit
{
"openapi": "3.0.0",
"info": {
"version": "1.0.0",
"title": "Rooms"
},
"servers": [
{
"url": "https://apiexplorer.support.rocket.chat"
}
],
"tags": [
{
"name": "Channels"
},
{
"name": "Directory"
},
{
"name": "Groups"
},
{
"name": "Rooms"
},
{
"name": "Teams"
},
{
"name": "Room Invites"
},
{
"name": "Subscriptions"
},
{
"name": "ABAC"
}
],
"paths": {
"/api/v1/abac/audit": {
"parameters": [],
"get": {
"summary": "List ABAC audit events",
"tags": [
"ABAC"
],
"responses": {
"200": {
"description": "OK",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"success": {
"type": "boolean"
},
"events": {
"type": "array",
"items": {
"type": "object",
"properties": {
"_id": {
"type": "string"
},
"t": {
"type": "string"
},
"ts": {
"type": "string"
},
"actor": {
"type": "object",
"properties": {
"_id": {
"type": "string"
},
"username": {
"type": "string"
},
"name": {
"type": "string"
}
}
},
"data": {
"type": "object",
"properties": {}
}
}
}
},
"offset": {
"type": "integer"
},
"count": {
"type": "integer"
},
"total": {
"type": "integer"
}
},
"x-examples": {
"Example 1": {
"success": true,
"events": [
{
"_id": "EVENT_ID",
"t": "abac.object.attribute.changed",
"ts": "2026-01-30T12:34:56.789Z",
"actor": {
"_id": "USER_ID",
"username": "admin",
"name": "Admin"
},
"data": {}
}
],
"offset": 0,
"count": 25,
"total": 1
}
}
},
"examples": {
"Success": {
"value": {
"success": true,
"events": [
{
"_id": "EVENT_ID",
"t": "abac.object.attribute.changed",
"ts": "2026-01-30T12:34:56.789Z",
"actor": {
"_id": "USER_ID",
"username": "admin",
"name": "Admin"
},
"data": {}
}
],
"offset": 0,
"count": 25,
"total": 1
}
}
}
}
}
},
"400": {
"description": "Bad Request",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"success": {
"type": "boolean"
},
"error": {
"type": "string"
}
},
"x-examples": {
"Example 1": {
"success": false,
"error": "error-invalid-query-parameters"
}
}
},
"examples": {
"Invalid query": {
"value": {
"success": false,
"error": "error-invalid-query-parameters"
}
}
}
}
}
},
"401": {
"description": "Unauthorized",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"success": {
"type": "boolean"
},
"error": {
"type": "string"
}
},
"x-examples": {
"Example 1": {
"success": false,
"error": "error-unauthorized"
}
}
},
"examples": {
"Unauthorized login attempt": {
"value": {
"success": false,
"error": "error-unauthorized"
}
}
}
}
}
},
"403": {
"description": "Forbidden",
"content": {
"application/json": {
"schema": {
"type": "object",
"properties": {
"success": {
"type": "boolean"
},
"error": {
"type": "string"
}
},
"x-examples": {
"Example 1": {
"success": false,
"error": "error-not-authorized"
}
}
},
"examples": {
"Missing required ABAC permissions": {
"value": {
"success": false,
"error": "error-not-authorized"
}
}
}
}
}
}
},
"operationId": "get-abac-audit",
"description": "\n\n- Lists ABAC audit events.\n- Returns a paginated audit log of ABAC-related actions (attribute changes, room attribute changes/removals, and ABAC actions), filterable by time range (`start`, `end`) and optional `actor`, with optional sorting.\n- Requires the ABAC and Auditing licenses, the `abac-management` and `view-abac-admin-audit` permissions.\n\n### Changelog\n| Version | Description |\n| ------- | ----------- |\n| 8.0.0 | Added |\n| 8.5.0 | Added the `view-abac-admin-audit` granular permission requirement. |",
"parameters": [
{
"schema": {
"type": "string"
},
"in": "query",
"name": "start",
"description": "start of time range (defaults to epoch if omitted)"
},
{
"schema": {
"type": "string"
},
"in": "query",
"name": "end",
"description": "end of time range (defaults to now if omitted)"
},
{
"schema": {
"type": "string"
},
"in": "query",
"description": "Filter by actor fields",
"name": "actor"
},
{
"schema": {
"type": "number"
},
"in": "query",
"name": "offset",
"description": "Pagination offset (default 0)"
},
{
"schema": {
"type": "number"
},
"in": "query",
"name": "count",
"description": "Page size (default 25)"
},
{
"schema": {
"type": "string"
},
"in": "query",
"name": "sort",
"description": "Sorting, typically { \"ts\": -1 } or { \"ts\": 1 }"
},
{
"$ref": "#/components/parameters/Auth-Token"
},
{
"$ref": "#/components/parameters/UserId"
}
]
}
}
},
"components": {
"parameters": {
"Auth-Token": {
"name": "X-Auth-Token",
"in": "header",
"description": "The `authToken` of the authenticated user.",
"required": true,
"schema": {
"type": "string"
},
"example": "RScctEHSmLGZGywfIhWyRpyofhKOiMoUIpimhvheU3f"
},
"UserId": {
"name": "X-User-Id",
"in": "header",
"description": "The `userId` of the authenticated user.",
"required": true,
"schema": {
"type": "string"
},
"example": "rbAXPnMktTFbNpwtJ"
}
}
}
}
````
![\"Defense\"](\"https://raw.githubusercontent.com/RocketChat/Rocket.Chat-Open-API/main/images/Defense.svg\")