List Audit Events : MinionWare

Queries the audit trail directly -- every mutating call anyone made, through any app, is in here (see Calling the API From Your Own Code for why there's no way around this). Filter by entity, who made the change, success/failure, or a time window; page through results with a keyset cursor rather than an offset.

Having trouble reaching the API, or logging in from another machine? See Network Access & Authentication Security -- by default the Api only answers localhost, and PowerShell needs an extra flag once it does answer elsewhere.

Order of Operations

Authenticate to the API.
Request events, filtered however you need.
Page further back using the last row's id as beforeId.

The call

GET /api/security/audit-events

Query params, all optional: entityType (string, e.g. "Job", "Credential", "AppUser"), entityId (long), changedBy (string, username), succeeded (bool), sinceUtc (datetime), beforeId (long, pagination cursor), top (int, page size, default 200, max 1000).

Permission needed: Audit.View -- a dedicated permission, separate from Security.Manage.

C# example

var jsonOptions = new JsonSerializerOptions(JsonSerializerDefaults.Web);

// Step 1: Authenticate to the API.
using var handler = new HttpClientHandler { UseDefaultCredentials = true };
using var client = new HttpClient(handler) { BaseAddress = new Uri("http://your-minion-agent-server:5443") };
client.DefaultRequestHeaders.Add("X-App-Name", "MyIntegration");

// Step 2: Every failed change to credentials in the last day.
var since = Uri.EscapeDataString(DateTime.UtcNow.AddDays(-1).ToString("o"));
var events = await client.GetFromJsonAsync<AuditEventSummary[]>($"/api/security/audit-events?entityType=Credential&succeeded=false&sinceUtc={since}", jsonOptions);
foreach (var e in events!)
    Console.WriteLine($"{e.AuditEventId}: {e.ChangedBy} -- {e.EventType} on {e.EntityLabel} at {e.ChangedAt}");

// Step 3: Page further back using the last row's id.
if (events.Length > 0)
{
    var nextPage = await client.GetFromJsonAsync<AuditEventSummary[]>($"/api/security/audit-events?entityType=Credential&beforeId={events[^1].AuditEventId}", jsonOptions);
}

record AuditEventSummary(long AuditEventId, string EntityType, long EntityId, string EventType, string ChangedBy, string? HostName,
    DateTime ChangedAt, string? BeforeJson, string? AfterJson, string? Reason, bool Succeeded, string EntityLabel,
    string? TargetServerLabel, string? BeforeCommandText, string? AfterCommandText, bool CommandTextRedacted);

Not on a domain machine? Swap in the app-account login from Calling the API From Your Own Code.

PowerShell example

# Step 1: Authenticate to the API.
$headers = @{ "X-App-Name" = "MyIntegration" }

# Step 2: Every failed change to credentials in the last day. (-AllowUnencryptedAuthentication: PowerShell requires this for Windows auth over plain http to anything but localhost -- see "Network Access & Authentication Security".)
$since = [Uri]::EscapeDataString((Get-Date).ToUniversalTime().AddDays(-1).ToString("o"))
$events = Invoke-RestMethod -Uri "http://your-minion-agent-server:5443/api/security/audit-events?entityType=Credential&succeeded=false&sinceUtc=$since" -UseDefaultCredentials -AllowUnencryptedAuthentication -Headers $headers
$events | ForEach-Object { "$($_.auditEventId): $($_.changedBy) -- $($_.eventType) on $($_.entityLabel) at $($_.changedAt)" }

# Step 3: Page further back using the last row's id.
if ($events.Count -gt 0) {
    $lastId = $events[-1].auditEventId
    $nextPage = Invoke-RestMethod -Uri "http://your-minion-agent-server:5443/api/security/audit-events?entityType=Credential&beforeId=$lastId" -UseDefaultCredentials -AllowUnencryptedAuthentication -Headers $headers
}

What you get back

200 OK, an array, newest first:

[
    { "auditEventId": 9042, "entityType": "Credential", "entityId": 12, "eventType": "Alter Credential", "changedBy": "jsmith",
      "hostName": "SQLPROD01", "changedAt": "2026-09-16T04:40:00Z", "beforeJson": null,
      "afterJson": "{\"CredentialName\":\"...\",\"AppName\":\"Minion.Agent.Console\"}", "reason": null, "succeeded": true,
      "entityLabel": "SQLPROD02 Service Account", "targetServerLabel": null, "beforeCommandText": null, "afterCommandText": null, "commandTextRedacted": false }
]

afterJson/beforeJson carry AppName (which app made the call -- see Calling the API From Your Own Code) embedded alongside the entity's own fields, never as a separate column. For a JobStep entity, beforeCommandText/afterCommandText are only populated (and decrypted) if you hold Job.ViewCode on that specific step -- otherwise they come back null with commandTextRedacted: true, so you can tell "nothing to show" apart from "hidden from you."

Codes this call can return

See API Response Codes for what each one means in general. For this specific call:

200 -- the page of events, even if empty.
403 -- you don't have Audit.View.

Not audited -- it's a read.

There's no get-by-id -- a single event's full detail is whatever comes back in the list. See also: audit-logging for the conceptual model.

List Audit Events Print