Skip to main content

API Endpoints

MethodEndpointPOST DataDescription
GET/netwrix/api/v1/activity_records/enum—Returns Activity Records. Retrieve Activity Records
POST/netwrix/api/v1/activity_records/enumContinuation MarkReturns next 1,000 Activity Records. Continuation Mark
POST/netwrix/api/v1/activity_records/searchSearch ParametersReturns Activity Records matching a criteria defined in search parameters. Search Activity Records
POST/netwrix/api/v1/activity_records/Activity RecordsWrites data to the Audit Database. Write Activity Records

Authentication​

All endpoints require authentication. The following authentication methods are supported:

  • NTLM—recommended

    If a group policy disables NTLM authentication, you can't address Netwrix Auditor Server by its IP address.

  • Negotiate

  • Digest

  • Basic

Account Permissions​

Netwrix Auditor restricts control to its configuration and data collected by the product. Role-based access system ensures that only relevant employees and services can access the exact amount of data they need. To retrieve activity records or supply data to the Audit Database, assign a role in the product to the account. Role-Based Access and Delegation

To...Required role
Retrieve all activity records and write dataThe user must have the Global administrator role in the product, or be a member of the Netwrix Auditor Administrators group on the computer that hosts Netwrix Auditor Server.
Retrieve all activity recordsThe user must have the Global reviewer role in the product or be a member of the Netwrix Auditor Client Users group on the computer that hosts Netwrix Auditor Server.
Retrieve activity records within a limited scopeThe user must have the Reviewer role on a monitoring plan or folder with plans. In this case, Netwrix Auditor Server will retrieve only activity records the user is allowed to review according to the scope delegated (e.g., a scope can be limited to a single domain or file share).
Write activity recordsThe user must have the Contributor role in the product.

Review the following example to see how to authenticate in cURL:

  • curl https://172.28.6.15:9699/netwrix/api/v1/activity_records/enum -u Enterprise\NetwrixUser:NetwrixIsCool