Skip to main content

Retrieve Activity Records

Endpoint​

Use to export data from the Audit Database. By default, Netwrix Auditor returns the first 1,000 Activity Records. To get the next Activity Records, send a POST request to the same endpoint containing a Continuation mark.

MethodEndpointPOST Data
GEThttps://{host:port}/netwrix/api/v1/activity_records/enum{?format=json}{&count=Number}—
POSThttps://{host:port}/netwrix/api/v1/activity_records/enum{?format=json}{&count=Number}Continuation Mark

Request Parameters​

ParameterMandatoryDescription
host:portYesReplace with the IP address or a name of your Netwrix Auditor Server host and port (e.g., 172.28.6.15:9699, stationwin12:9699, WKSWin2012.enterprise.local:9699). With enabled HTTPS, provide the computer name as it appears in certificate properties.
format=jsonNoAdd this parameter to retrieve data in JSON format. Otherwise, XML-formatted Activity Records will be returned.
count=Number NoAdd this parameter to define the number of Activity Records to be exported. Replace Number with a number (e.g., &count=1500).

Optional parameters (format and count) can be provided in any order. The first parameter must start with ?, others are joined with &, no spaces required (e.g., ?format=json&count=1500).

Response​

Request StatusResponse
SuccessThe HTTP status code in the response header is 200 OK. The response body contains Activity Records and Continuation Mark.
HTTP/1.1 200 OK
Server: Microsoft-HTTPAPI/2.0
Content-Length: 311896
Content-Type: application/xml
Date: Fri, 08 Apr 2017 13:56:22 GMT
orHTTP/1.1 200 OK
Server: Microsoft-HTTPAPI/2.0
Content-Length: 311896
Content-Type: application/json
Date: Fri, 08 Apr 2017 13:56:22 GMT
ErrorThe header status code is an error code. Depending on the error code, the response body may contain an error object.

Usage Example—Retrieve All Activity Records​

This example describes how to retrieve all Activity Records from the Audit Database.

Step 1 – Send a GET request. For example:

FormatRequest
XMLcurl https://WKSWin2012:9699/netwrix/api/v1/activity_records/enum -u Enterprise\NetwrixUser:NetwrixIsCool
JSONcurl https://WKSWin2012:9699/netwrix/api/v1/activity_records/enum?format=json -u Enterprise\NetwrixUser:NetwrixIsCool

Step 2 – Receive the response. Netwrix Auditor retrieves Activity Records according to the account's delegated scope. The following example shows a successful GET request. The status is 200 OK. For XML, a response body contains the ActivityRecordList root element with Activity Records and a Continuation mark inside. For JSON, a response body contains the ActivityRecordList array with Activity Records collected in braces and a Continuation mark.

XML:

<?xml version="1.0" standalone="yes"?>
<ActivityRecordList xmlns="http://schemas.netwrix.com/api/v1/activity_records/">
    <ContinuationMark>PG5yPjxuIG49IntFNzA...PjwvYT48L24+PC9ucj4A</ContinuationMark>
    <ActivityRecord>
        <MonitoringPlan>
            <Name>AD Monitoring</Name>
            <ID>{42F64379-163E-4A43-A9C5-4514C5A23798}</ID>
        </MonitoringPlan>
        <DataSource>Active Directory</DataSource>
        <Item>
            <Name>enterprise.local (Domain)</Name>
        </Item>
        <ObjectType>user</ObjectType>
        <RID>20160215110503420B9451771F5964A9EAC0A5F35307EA155</RID>
        <What>\local\enterprise\Users\Jason Smith</What>
        <Action>Added</Action>
        <When>2017-02-14T15:42:34Z</When>
        <Where>EnterpriseDC1.enterprise.local</Where>
        <Who>ENTERPRISE\Administrator</Who>
        <Workstation>EnterpriseDC1.enterprise.local</Workstation>
    </ActivityRecord>
    <ActivityRecord>...</ActivityRecord>
    <ActivityRecord>...</ActivityRecord>
</ActivityRecordList>

JSON:

{
    "ActivityRecordList": [
        {
            "Action": "Added",
            "MonitoringPlan": {
                "ID": "{42F64379-163E-4A43-A9C5-4514C5A23798}",
                "Name": "AD Monitoring"
            },
            "DataSource": "Active Directory",
            "Item": {"Name": "enterprise.local (Domain)"},
            "ObjectType": "user",
            "RID": "20160215110503420B9451771F5964A9EAC0A5F35307EA155",
            "What": "\\local\\enterprise\\Users\\Jason Smith",
            "When": "2017-02-14T15:42:34Z",
            "Where": "EnterpriseDC1.enterprise.local",
            "Who": "ENTERPRISE\\Administrator",
            "Workstation": "EnterpriseDC1.enterprise.local"
        },
        {...},
        {...}
    ],
    "ContinuationMark": "PG5yPjxuIG49IntFNzA...PjwvYT48L24+PC9ucj4A"
}

Step 3 – Continue retrieving Activity Records. Send a POST request containing this Continuation mark to the same endpoint. See the Continuation Mark topic for more information. For example:

XML
curl -H "Content-Type: application/xml; Charset=UTF-8" https://WKSWin2012:9699/netwrix/api/v1/activity_records/enum -u Enterprise\NetwrixUser:NetwrixIsCool --data-binary @C:\APIdocs\ContMark.xml <?xml version="1.0" standalone="yes"?> `````` <ContinuationMark xmlns="http://schemas.netwrix.com/api/v1/activity_records/"> `````` PG5yPjxuIG49IntFNzA...PjwvYT48L24+PC9ucj4A+PC9ucj4A `````` </ContinuationMark>
JSON
curl -H "Content-Type: application/json; Charset=UTF-8" https://WKSWin2012:9699/netwrix/api/v1/activity_records/enum?format=json -u Enterprise\NetwrixUser:NetwrixIsCool --data-binary ``````@C:\APIdocs\ContMark.json "PG5yPjxuIG49IntFNzA...PjwvYT48L24+PC9ucj4A+PC9ucj4A"

Ensure to pass information about transferred data, including Content-Type:application/xml or application/json and encoding. The syntax greatly depends on the tool you use.

Step 4 – Receive the next response. On success, the status is 200 OK. For XML, a response body contains the ActivityRecordList root element with next Activity Records and a new Continuation mark inside. For JSON, a response body contains the ActivityRecordSearch array with next Activity Records collected in braces and a new Continuation mark.

Step 5 – Continue retrieving Activity Records. Send POST requests containing new Continuation marks until you receive a 200 OK response with no Activity Records inside the ActivityRecordList. It means you reached the end of the Audit Database.