Auditlog API

This page provides a reference of the available operations in the Auditlog API.

All operations must be prefixed with the correct datacenter URL for your tenant. All requests must be authenticated via an API key.

The following operations are available:

Get auditlog

Returns an array of auditlog items.

Request

GET {datacenter}/auditlog

Name Description Type

apikey

The API key for connecting to your tenant.

String

All parameters can alternatively be passed as headers. All parameters are optional. If a parameter is passed both as a URL parameter and as a header, the URL parameter takes precedence.

Name Description Type

startid

The ID of the first entry to fetch. Can be used for incremental data retrieval.

Default: The first available ID.

Integer

take

The maximum number of entries to fetch.

Default: 50

Maximum: 10000. If you need to fetch more than 10000 entries, use pagination.

If the value is not a number, an empty array is returned.

Warning: Do not consistently set this parameter to high numbers. If you do, you will quickly exceed your quota, and your account will be blocked for the rest of the day.

Integer

last

Retrieve the latest last entries in descending order. Cannot be combined with take or startid.

Maximum: 10000

Default: All entries are returned in ascending order.

Integer

wantscandetails

If "true", return a detailed list of scan results. If "false", only return a summary.

Default: "false".

Boolean

type

The type of the request. Allowed values are:

  • app: "Run As Admin"

  • session: "Admin Session"

Unknown values are silently ignored. The filter is then not applied, so more entries are returned than expected.

Default: All entries are returned.

String, enum

status

The approval state of the request. Allowed values are:

  • Pending

  • Approved

  • Denied

  • Quarantined

The values are not case-sensitive.

The filter refers to the approval state, not to the status field in the response. For example, status=Approved returns approved entries, whose status field can be "Finished". Values of the status field (such as "Finished") and numeric status codes are not supported.

Unknown values are silently ignored. The filter is then not applied, so more entries are returned than expected.

Default: All entries are returned.

String, enum

days

The number of days for which entries are returned. If startdate is set, this parameter is ignored.

Days are counted as calendar days, not as 24-hour periods. For example, days=0 returns only today's entries.

Default: 30

Integer

startdate

Only return entries created on or after the specified date. The date must be given in the format yyyy-mm-dd. Dates in a different format are silently ignored.

Default: All entries are returned.

Date

enddate

Only return entries created on or before the specified date. The date must be given in the format yyyy-mm-dd. Dates in a different format are silently ignored.

Default: All entries are returned.

Date
Response
200 - OK - Success response

The operation returns an array of JSON objects. Each object corresponds to one auditlog entry.

Name Description Type

id

The unique ID of the entry .

Integer

traceNo

The trace number with which the entry was logged in the auditlog.

Integer

settingsName

The name of the sub-settings set which matches the entry. If no sub-settings match, "Global" is returned instead.

String

type

The type of the request. Possible values are:

  • Run As Admin

  • Admin Session

  • Server Session

String, enum

typeCode

The type of the request. Possible values are:

  • 0 (Run As Admin)

  • 1 (Admin Session)

  • 2 (Server Session)

Integer

status

The status of the request. Possible values are:

  • Open

  • Running

  • Finished

  • Denied

  • Pending approval

  • Quarantined

  • Expired

String, enum

statusCode

The status of the request. Possible values are:

  • 0 (Open)

  • 1 (Running)

  • 2 (Finished)

  • 3 (Denied)

  • 4 (Pending approval)

  • 5 (Quarantined)

  • 6 (Expired)

Integer

reason

The reason the user gave when issuing the request.

String

approvedBy

The name of the administrator who approved the request.

String

approvedByEmail

The email address of the administrator who approved the request.

String

deniedReason

The reason the administrator gave for denying the request.

String

deniedBy

The name of the administrator who denied the request.

String

deniedByEmail

The email address of the administrator who denied the request.

String

requestTime

The time when the request was sent, in local time.

String, dateTime

requestTimeUTC

The time when the request was sent, in UTC. If unavailable, local time is used instead.

String, dateTime

responseTime

The time span from sending the request until an administrator approved or denied it.

String, time

startTime

The time when the requested application or session was started, in local time.

String, dateTime

startTimeUTC

The time when the requested application or session was started, in UTC. If unavailable, local time is used instead.

String, dateTime

endTime

The time when the requested application or session was finished, in local time.

String, dateTime

endTimeUTC

The time when the requested application or session was finished, in UTC. If unavailable, local time is used instead.

String, dateTime

ssoValidated

Indicates whether or not the request was validated by single sign-on on the endpoint.

Boolean

auditlogLink

A link to the auditlog entry in the Admin By Request Portal.

String

user

Information about the user who sent the request.

Object

account

The log-in name of the user.

String

fullName

The full name of the user.

String

email

The email address that the user entered into the request form.

String

phone

The phone number that the user entered into the request form.

String

isAdmin

Indicates whether or not the user is a local administrator on their computer.

Boolean

computer

Information about the computer from which the request was sent.

Object

name

The name of the computer.

String

platform

The operating system of the computer. Possible values are:

  • Windows

  • Mac

  • Server

String, enum

platformCode

The operating system of the computer. Possible values are:

  • 0: Windows

  • 1: Mac

  • 2: Server

Integer

make

The vendor of the computer as it appears in the inventory.

String

model

The model of the computer as it appears in the inventory.

String

application

Information about the application that the user requested to run as administrator.

Object

file

The name of the file that the user wanted to execute.

String

path

The path to the file that the user wanted to execute.

String

name

The name of the application (not the file name) that the user wanted to execute.

String

vendor

The vendor who published the application that the user wanted to execute.

String

version

The version of the application that the user wanted to execute.

String

sha256

The check sum of the file that the user wanted to execute.

String

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String, enum

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String

virustotalLink

The link to the report for the file on virustotal.com.

String

preapproved

Indicates whether the file was pre-approved by an administrator.

Boolean

installs

Information about all applications that the user installed during an admin session. Each application is an object in the array with the following properties:

Array of Object

application

The name of the application (not the file name).

String

vendor

The vendor who published the application.

String

version

The version of the application.

String

uninstalls

Information about all applications that the user uninstalled during an admin session. Each application is an object in the array with the following properties:

Array of Object

application

The name of the application (not the file name).

String

vendor

The vendor who published the application.

String

version

The version of the application.

String

elevatedApplications

Information about all applications that the user ran with administrator rights during an admin session. Each application is an object in the array with the following properties:

Array of Object

file

The name of the file that the user wanted to execute.

String

path

The path to the file that the user wanted to execute.

String

name

The name of the application (not the file name) that the user wanted to execute.

String

vendor

The vendor who published the application that the user wanted to execute.

String

version

The version of the application that the user wanted to execute.

String

sha256

The check sum of the file that the user wanted to execute.

String

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String

virustotalLink

The link to the report for the file on virustotal.com.

String

scanResults

Information about the scan results returned by the different engines. Each scan result is an object in the array with the following properties:

Array of Object

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

engine

The name of the malware detection engine that ran the scan.

String

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String
Examples

Request: GET https://dc1api.adminbyrequest.com/auditlog

Response:

Copy 
[  
    {
        "installs": [
            {
                "application": "Notepad++ (64-bit x64)",
                "version": "8.9.8.1",
                "vendor": "Notepad++ Team"
            }
        ],
        "uninstalls": [],
        "elevatedApplications": [
            {
                "name": "Notepad++ : a free (GNU) source code editor",
                "path": "C:\\Users\\jdoe\\Downloads",
                "file": "npp.8.9.8.1.Installer.x64.exe",
                "version": "8.9.8.1",
                "vendor": "Notepad++\"",
                "sha256": "26F3BCCED788FADBAC4E7E577B430EA2CE6060CF3BCAD993EF4612ECD7D743DA",
                "scanResult": "Clean",
                "scanResultCode": 0,
                "threat": null,
                "virustotalLink": "https://www.virustotal.com/gui/file/26F3BCCED788FADBACF3BCAD993EF4612ECD7D743DA"
            },
            {
                "name": "Windows PowerShell",
                "path": "C:\\windows\\SysWOW64\\WindowsPowerShell\\v1.0",
                "file": "powershell.exe",
                "version": "10.0.22621.1 (WinBuild.160101.0800)",
                "vendor": "Microsoft Corporation",
                "sha256": "D4CC57797F43E2744E5F46CFB9E6993928F453E59076F0CD",
                "scanResult": "Clean",
                "scanResultCode": 0,
                "threat": null,
                "virustotalLink": "https://www.virustotal.com/gui/file/D4CC57797F4A93928F453E59076F0CD"
            }
        ],
        "scanResults": [],
        "id": 58423266,
        "traceNo": "39136032",
        "settingsName": "Global",
        "type": "Run As Admin",
        "typeCode": 0,
        "status": "Finished",
        "statusCode": 2,
        "application": {
            "file": "npp.8.9.8.1.Installer.x64.exe",
            "path": "C:\\Users\\jdoe\\Downloads",
            "name": "Notepad++ : a free (GNU) source code editor",
            "vendor": "Notepad++\"",
            "version": "8.9.8.1",
            "sha256": "26F3BCCED788FADBAC4E7E577B430EA2CE603EF4612ECD7D743DA",
            "scanResult": "Clean",
            "scanResultCode": 0,
            "threat": null,
            "virustotalLink": "https://www.virustotal.com/gui/file/26F3BCCED788FA993EF4612ECD7D743DA",
            "preapproved": false
        },
        "user": {
            "account": "jdoe",
            "fullName": "John Doe",
            "email": "jdoe@acme.com",
            "phone": "123456787",
            "isAdmin": false
        },
        "computer": {
            "name": "WIN0815",
            "platform": "Windows",
            "platformCode": 0,
            "make": "Microsoft Corporation",
            "model": "Office PC"
        },
        "reason": "Setting up work environment",
        "approvedBy": "Adam Admin",
        "approvedByEmail": "aadmin@acme.com",
        "deniedReason": null,
        "deniedBy": null,
        "deniedByEmail": null,
        "ssoValidated": false,
        "requestTime": "2026-10-05T03:03:05",
        "requestTimeUTC": "2026-10-05T10:03:05",
        "startTime": "2026-10-05T03:03:18",
        "startTimeUTC": "2026-10-05T10:03:18",
        "endTime": "2026-10-05T03:03:37",
        "endTimeUTC": "2026-10-05T10:03:37",
        "responseTime": "00:00:07.9070000",
        "auditlogLink": "https://eu2.adminbyrequest.com/AuditLog?Page=AppElevations&ID=39136032&ShowFilter=false"
    },
        {
        "installs": [
            {
                "application": "Mozilla Firefox (x64 en-US)",
                "version": "158.0.1",
                "vendor": "Mozilla"
            },
            {
                "application": "Notepad++ (64-bit x64)",
                "version": "8.9.8.1",
                "vendor": "Notepad++ Team"
            }
        ],
        "uninstalls": [],
        "elevatedApplications": [
            {
                "name": "Firefox",
                "path": "C:\\Users\\User\\Downloads",
                "file": "Firefox Installer.exe",
                "version": "18.05",
                "vendor": "Mozilla Corporation",
                "sha256": "8E8634C29671BC9873B5A3375F34B165C31DCA7467E622",
                "scanResult": null,
                "scanResultCode": 0,
                "threat": null,
                "virustotalLink": "https://www.virustotal.com/gui/file/8E86344B165C31DCA7467E622"
            },
            {
                "name": "Firefox Installer",
                "path": "C:\\Users\\User\\AppData\\Local\\Temp\\7zS40B27C54",
                "file": "setup-stub.exe",
                "version": "158.0.1",
                "vendor": "Mozilla Corporation",
                "sha256": "186E4D973F07EE5A489586B190A92C95A5271A1158FCBC",
                "scanResult": null,
                "scanResultCode": 0,
                "threat": null,
                "virustotalLink": "https://www.virustotal.com/gui/file/186E4D973271A1158FCBC"
            },
            {
                "name": "notepad++",
                "path": "C:\\Program Files\\Notepad++",
                "file": "notepad++.exe",
                "version": "8.9.8.1",
                "vendor": "Notepad++\"",
                "sha256": "C52C9ED2EC6D0B5B3F243B29F2129AF2665709464B3CF",
                "scanResult": null,
                "scanResultCode": 0,
                "threat": null,
                "virustotalLink": "https://www.virustotal.com/gui/file/C52C9ED2ECA9AF2665709464B3CF"
            }
        ],
        "scanResults": [],
        "id": 58943715,
        "traceNo": "29656481",
        "settingsName": "Global",
        "type": "Admin Session",
        "typeCode": 1,
        "status": "Finished",
        "statusCode": 2,
        "application": {
            "file": null,
            "path": null,
            "name": null,
            "vendor": null,
            "version": null,
            "sha256": null,
            "scanResult": null,
            "scanResultCode": 0,
            "threat": null,
            "virustotalLink": null,
            "preapproved": false
        },
        "user": {
            "account": "jdoe",
            "fullName": "John Doe",
            "email": "jdoe@acme.com",
            "phone": "12345678",
            "isAdmin": false
        },
        "computer": {
            "name": "WINDEV2407EVAL",
            "platform": "Windows",
            "platformCode": 0,
            "make": "Microsoft Corporation",
            "model": "Virtual Machine"
        },
        "reason": "Set up my new machine",
        "approvedBy": "Adam Admin",
        "approvedByEmail": "aadmin@acme.com",
        "deniedReason": null,
        "deniedBy": null,
        "deniedByEmail": null,
        "ssoValidated": false,
        "requestTime": "2026-10-23T12:40:04",
        "requestTimeUTC": "2026-10-23T10:40:04",
        "startTime": "2026-10-23T12:40:22",
        "startTimeUTC": "2026-10-23T10:40:22",
        "endTime": "2026-10-23T12:50:23",
        "endTimeUTC": "2026-10-23T10:50:23",
        "responseTime": "00:00:12.2540000",
        "auditlogLink": "https://eu2.adminbyrequest.com/AuditLog?Page=AdminSessions&ID=29656481&ShowFilter=false"
    }
]

Request: https://dc4api.adminbyrequest.com/auditlog?wantscandetails=true&last=1&type=app

Response:

Copy 
    {
        "installs": [],
        "uninstalls": [],
        "elevatedApplications": [
            {
                "name": "7-Zip Installer",
                "path": "C:\\Users\\jdoe\\Downloads",
                "file": "7z2603-x64.exe",
                "version": "26.03",
                "vendor": null,
                "sha256": "0859C524B8A63551848F0C246ABDDCB1D0BBFE879F8D85E61A9E6EDD",
                "scanResult": "Clean",
                "scanResultCode": 0,
                "threat": null,
                "virustotalLink": "https://www.virustotal.com/gui/file/0859C524B80B7B656B0FBFE879F8D85E61A9E6EDD"
            }
        ],
        "scanResults": [
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "AhnLab",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "Aurora",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "Avira",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "Bitdefender",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "Bkav Pro",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "ClamAV",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "CMC",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "ESET",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "IKARUS",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "K7",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "Lionic",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "OPSWAT Predictive Alin AI",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "Quick Heal",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "SentinelOne",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "Sophos",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "TACHYON",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "Trellix",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "Varist",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "Webroot SMD",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "Xcitium",
                "threat": null
            },
            {
                "scanResult": "Clean",
                "scanResultCode": 0,
                "engine": "Xvirus Anti-Malware",
                "threat": null
            }
        ],
        "id": 58388103,
        "traceNo": "39100869",
        "settingsName": "Global",
        "type": "Run As Admin",
        "typeCode": 0,
        "status": "Finished",
        "statusCode": 2,
        "application": {
            "file": "7z2603-x64.exe",
            "path": "C:\\Users\\jdoe\\Downloads",
            "name": "7-Zip Installer",
            "vendor": "",
            "version": "26.03",
            "sha256": "0859C524B8A63551848F0879F8D85E61A9E6EDD",
            "scanResult": "Clean",
            "scanResultCode": 0,
            "threat": null,
            "virustotalLink": "https://www.virustotal.com/gui/file/0859C524B8A639F8D85E61A9E6EDD",
            "preapproved": false
        },
        "user": {
            "account": "jdoe",
            "fullName": "John Doe",
            "email": "jdoe@acme.com",
            "phone": "12345678",
            "isAdmin": false
        },
        "computer": {
            "name": "WIN0815",
            "platform": "Windows",
            "platformCode": 0,
            "make": "Microsoft Corporation",
            "model": "Office PC"
        },
        "reason": "Setting up my new PC",
        "approvedBy": "Adam Admin",
        "approvedByEmail": "aadmin@acme.com",
        "deniedReason": null,
        "deniedBy": null,
        "deniedByEmail": null,
        "ssoValidated": false,
        "requestTime": "2026-10-02T04:19:12",
        "requestTimeUTC": "2026-10-02T11:19:12",
        "startTime": "2026-10-02T04:19:12",
        "startTimeUTC": "2026-10-02T11:19:12",
        "endTime": "2026-10-02T04:19:15",
        "endTimeUTC": "2026-10-02T11:19:15",
        "responseTime": "00:00:08.4830000",
        "auditlogLink": "https://eu2.adminbyrequest.com/AuditLog?Page=AppElevations&ID=39100869&ShowFilter=false"
    }

Get auditlog entry

Returns the auditlog entry with the specified ID.

Request

GET {datacenter}/auditlog/{id}

Name Description Type

apikey

The API key for connecting to your tenant.

String

All parameters can alternatively be passed as headers. All parameters are optional. If a parameter is passed both as a URL parameter and as a header, the URL parameter takes precedence.

Name Description Type

wantscandetails

If "true", return a detailed list of scan results. If "false", only return a summary.

Default: "false".

Boolean
Name Description Type

id

The ID of the entry to retrieve.

Integer
Response
200 - OK - Success response

The operation returns the auditlog entry with the specified ID as a JSON object.

Name Description Type

id

The unique ID of the entry .

Integer

traceNo

The trace number with which the entry was logged in the auditlog.

Integer

settingsName

The name of the sub-settings set which matches the entry. If no sub-settings match, "Global" is returned instead.

String

type

The type of the request. Possible values are:

  • Run As Admin

  • Admin Session

  • Server Session

String, enum

typeCode

The type of the request. Possible values are:

  • 0 (Run As Admin)

  • 1 (Admin Session)

  • 2 (Server Session)

Integer

status

The status of the request. Possible values are:

  • Open

  • Running

  • Finished

  • Denied

  • Pending approval

  • Quarantined

  • Expired

String, enum

statusCode

The status of the request. Possible values are:

  • 0 (Open)

  • 1 (Running)

  • 2 (Finished)

  • 3 (Denied)

  • 4 (Pending approval)

  • 5 (Quarantined)

  • 6 (Expired)

Integer

reason

The reason the user gave when issuing the request.

String

approvedBy

The name of the administrator who approved the request.

String

approvedByEmail

The email address of the administrator who approved the request.

String

deniedReason

The reason the administrator gave for denying the request.

String

deniedBy

The name of the administrator who denied the request.

String

deniedByEmail

The email address of the administrator who denied the request.

String

requestTime

The time when the request was sent, in local time.

String, dateTime

requestTimeUTC

The time when the request was sent, in UTC. If unavailable, local time is used instead.

String, dateTime

responseTime

The time span from sending the request until an administrator approved or denied it.

String, time

startTime

The time when the requested application or session was started, in local time.

String, dateTime

startTimeUTC

The time when the requested application or session was started, in UTC. If unavailable, local time is used instead.

String, dateTime

endTime

The time when the requested application or session was finished, in local time.

String, dateTime

endTimeUTC

The time when the requested application or session was finished, in UTC. If unavailable, local time is used instead.

String, dateTime

ssoValidated

Indicates whether or not the request was validated by single sign-on on the endpoint.

Boolean

auditlogLink

A link to the auditlog entry in the Admin By Request Portal.

String

user

Information about the user who sent the request.

Object

account

The log-in name of the user.

String

fullName

The full name of the user.

String

email

The email address that the user entered into the request form.

String

phone

The phone number that the user entered into the request form.

String

isAdmin

Indicates whether or not the user is a local administrator on their computer.

Boolean

computer

Information about the computer from which the request was sent.

Object

name

The name of the computer.

String

platform

The operating system of the computer. Possible values are:

  • Windows

  • Mac

  • Server

String, enum

platformCode

The operating system of the computer. Possible values are:

  • 0: Windows

  • 1: Mac

  • 2: Server

Integer

make

The vendor of the computer as it appears in the inventory.

String

model

The model of the computer as it appears in the inventory.

String

application

Information about the application that the user requested to run as administrator.

Object

file

The name of the file that the user wanted to execute.

String

path

The path to the file that the user wanted to execute.

String

name

The name of the application (not the file name) that the user wanted to execute.

String

vendor

The vendor who published the application that the user wanted to execute.

String

version

The version of the application that the user wanted to execute.

String

sha256

The check sum of the file that the user wanted to execute.

String

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String, enum

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String

virustotalLink

The link to the report for the file on virustotal.com.

String

preapproved

Indicates whether the file was pre-approved by an administrator.

Boolean

installs

Information about all applications that the user installed during an admin session. Each application is an object in the array with the following properties:

Array of Object

application

The name of the application (not the file name).

String

vendor

The vendor who published the application.

String

version

The version of the application.

String

uninstalls

Information about all applications that the user uninstalled during an admin session. Each application is an object in the array with the following properties:

Array of Object

application

The name of the application (not the file name).

String

vendor

The vendor who published the application.

String

version

The version of the application.

String

elevatedApplications

Information about all applications that the user ran with administrator rights during an admin session. Each application is an object in the array with the following properties:

Array of Object

file

The name of the file that the user wanted to execute.

String

path

The path to the file that the user wanted to execute.

String

name

The name of the application (not the file name) that the user wanted to execute.

String

vendor

The vendor who published the application that the user wanted to execute.

String

version

The version of the application that the user wanted to execute.

String

sha256

The check sum of the file that the user wanted to execute.

String

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String

virustotalLink

The link to the report for the file on virustotal.com.

String

scanResults

Information about the scan results returned by the different engines. Each scan result is an object in the array with the following properties:

Array of Object

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

engine

The name of the malware detection engine that ran the scan.

String

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String
Example
Copy 
    {
        "installs": [
            {
                "application": "Notepad++ (64-bit x64)",
                "version": "8.9.8.1",
                "vendor": "Notepad++ Team"
            }
        ],
        "uninstalls": [],
        "elevatedApplications": [
            {
                "name": "Notepad++ : a free (GNU) source code editor",
                "path": "C:\\Users\\jdoe\\Downloads",
                "file": "npp.8.9.8.1.Installer.x64.exe",
                "version": "8.9.8.1",
                "vendor": "Notepad++\"",
                "sha256": "26F3BCCED788FADBAC4E7E57D993EF4612ECD7D743DA",
                "scanResult": "Clean",
                "scanResultCode": 0,
                "threat": null,
                "virustotalLink": "https://www.virustotal.com/gui/file/26F3BCCED788FADBAC4E7E60CF3BCAD993EF4612ECD7D743DA"
            },
            {
                "name": "Windows PowerShell",
                "path": "C:\\windows\\SysWOW64\\WindowsPowerShell\\v1.0",
                "file": "powershell.exe",
                "version": "10.0.22621.1 (WinBuild.160101.0800)",
                "vendor": "Microsoft Corporation",
                "sha256": "D4CC57797F43E2744E5F46FA93928F453E59076F0CD",
                "scanResult": "Clean",
                "scanResultCode": 0,
                "threat": null,
                "virustotalLink": "https://www.virustotal.com/gui/file/D4CC57797F43E2744E4D4C809A5FA93928F453E59076F0CD"
            }
        ],
        "scanResults": [],
        "id": 58423266,
        "traceNo": "39136032",
        "settingsName": "Global",
        "type": "Run As Admin",
        "typeCode": 0,
        "status": "Finished",
        "statusCode": 2,
        "application": {
            "file": "npp.8.9.8.1.Installer.x64.exe",
            "path": "C:\\Users\\jdoe\\Downloads",
            "name": "Notepad++ : a free (GNU) source code editor",
            "vendor": "Notepad++\"",
            "version": "8.9.8.1",
            "sha256": "26F3BCCED788FADBAC4E7E57F3BCAD993EF4612ECD7D743DA",
            "scanResult": "Clean",
            "scanResultCode": 0,
            "threat": null,
            "virustotalLink": "https://www.virustotal.com/gui/file/26F3BCCED788FADB2CE6060CF3BCAD993EF4612ECD7D743DA",
            "preapproved": false
        },
        "user": {
            "account": "jdoe",
            "fullName": "John Doe",
            "email": "jdoe@acme.com",
            "phone": "123456787",
            "isAdmin": false
        },
        "computer": {
            "name": "WIN0815",
            "platform": "Windows",
            "platformCode": 0,
            "make": "Microsoft Corporation",
            "model": "Office PC"
        },
        "reason": "Setting up work environment",
        "approvedBy": "Adam Admin",
        "approvedByEmail": "aadmin@acme.com",
        "deniedReason": null,
        "deniedBy": null,
        "deniedByEmail": null,
        "ssoValidated": false,
        "requestTime": "2026-10-05T03:03:05",
        "requestTimeUTC": "2026-10-05T10:03:05",
        "startTime": "2026-10-05T03:03:18",
        "startTimeUTC": "2026-10-05T10:03:18",
        "endTime": "2026-10-05T03:03:37",
        "endTimeUTC": "2026-10-05T10:03:37",
        "responseTime": "00:00:07.9070000",
        "auditlogLink": "https://eu2.adminbyrequest.com/AuditLog?Page=AppElevations&ID=39136032&ShowFilter=false"
    }

Get computer auditlog

Returns the auditlog entries for the specified computer.

Request
GET {datacenter}/computers/{computer}/auditlog
Name Description Type

apikey

The API key for connecting to your tenant.

String

All parameters can alternatively be passed as headers. All parameters are optional. If a parameter is passed both as a URL parameter and as a header, the URL parameter takes precedence.

Name Description Type

startid

The ID of the first entry to fetch. Can be used for incremental data retrieval.

Default: The first available ID.

Integer

take

The maximum number of entries to fetch.

Default: 50

Maximum: 10000. If you need to fetch more than 10000 entries, use pagination.

If the value is not a number, an empty array is returned.

Warning: Do not consistently set this parameter to high numbers. If you do, you will quickly exceed your quota, and your account will be blocked for the rest of the day.

Integer

last

Retrieve the latest last entries in descending order. Cannot be combined with take or startid.

Maximum: 10000

Default: All entries are returned in ascending order.

Integer

wantscandetails

If "true", return a detailed list of scan results. If "false", only return a summary.

Default: "false".

Boolean

type

The type of the request. Allowed values are:

  • app: "Run As Admin"

  • session: "Admin Session"

Unknown values are silently ignored. The filter is then not applied, so more entries are returned than expected.

Default: All entries are returned.

String, enum

status

The approval state of the request. Allowed values are:

  • Pending

  • Approved

  • Denied

  • Quarantined

The values are not case-sensitive.

The filter refers to the approval state, not to the status field in the response. For example, status=Approved returns approved entries, whose status field can be "Finished". Values of the status field (such as "Finished") and numeric status codes are not supported.

Unknown values are silently ignored. The filter is then not applied, so more entries are returned than expected.

Default: All entries are returned.

String, enum

days

The number of days for which entries are returned. If startdate is set, this parameter is ignored.

Days are counted as calendar days, not as 24-hour periods. For example, days=0 returns only today's entries.

Default: 30

Integer

startdate

Only return entries created on or after the specified date. The date must be given in the format yyyy-mm-dd. Dates in a different format are silently ignored.

Default: All entries are returned.

Date

enddate

Only return entries created on or before the specified date. The date must be given in the format yyyy-mm-dd. Dates in a different format are silently ignored.

Default: All entries are returned.

Date
Name Description Type

computer

The name of the computer for which to retrieve events. Not case-sensitive.

If there is no computer with this name, an empty array is returned.

String
Response

200 - OK - Success response

The operation returns an array of JSON objects. Each object corresponds to one auditlog entry.

Name Description Type

id

The unique ID of the entry .

Integer

traceNo

The trace number with which the entry was logged in the auditlog.

Integer

settingsName

The name of the sub-settings set which matches the entry. If no sub-settings match, "Global" is returned instead.

String

type

The type of the request. Possible values are:

  • Run As Admin

  • Admin Session

  • Server Session

String, enum

typeCode

The type of the request. Possible values are:

  • 0 (Run As Admin)

  • 1 (Admin Session)

  • 2 (Server Session)

Integer

status

The status of the request. Possible values are:

  • Open

  • Running

  • Finished

  • Denied

  • Pending approval

  • Quarantined

  • Expired

String, enum

statusCode

The status of the request. Possible values are:

  • 0 (Open)

  • 1 (Running)

  • 2 (Finished)

  • 3 (Denied)

  • 4 (Pending approval)

  • 5 (Quarantined)

  • 6 (Expired)

Integer

reason

The reason the user gave when issuing the request.

String

approvedBy

The name of the administrator who approved the request.

String

approvedByEmail

The email address of the administrator who approved the request.

String

deniedReason

The reason the administrator gave for denying the request.

String

deniedBy

The name of the administrator who denied the request.

String

deniedByEmail

The email address of the administrator who denied the request.

String

requestTime

The time when the request was sent, in local time.

String, dateTime

requestTimeUTC

The time when the request was sent, in UTC. If unavailable, local time is used instead.

String, dateTime

responseTime

The time span from sending the request until an administrator approved or denied it.

String, time

startTime

The time when the requested application or session was started, in local time.

String, dateTime

startTimeUTC

The time when the requested application or session was started, in UTC. If unavailable, local time is used instead.

String, dateTime

endTime

The time when the requested application or session was finished, in local time.

String, dateTime

endTimeUTC

The time when the requested application or session was finished, in UTC. If unavailable, local time is used instead.

String, dateTime

ssoValidated

Indicates whether or not the request was validated by single sign-on on the endpoint.

Boolean

auditlogLink

A link to the auditlog entry in the Admin By Request Portal.

String

user

Information about the user who sent the request.

Object

account

The log-in name of the user.

String

fullName

The full name of the user.

String

email

The email address that the user entered into the request form.

String

phone

The phone number that the user entered into the request form.

String

isAdmin

Indicates whether or not the user is a local administrator on their computer.

Boolean

computer

Information about the computer from which the request was sent.

Object

name

The name of the computer.

String

platform

The operating system of the computer. Possible values are:

  • Windows

  • Mac

  • Server

String, enum

platformCode

The operating system of the computer. Possible values are:

  • 0: Windows

  • 1: Mac

  • 2: Server

Integer

make

The vendor of the computer as it appears in the inventory.

String

model

The model of the computer as it appears in the inventory.

String

application

Information about the application that the user requested to run as administrator.

Object

file

The name of the file that the user wanted to execute.

String

path

The path to the file that the user wanted to execute.

String

name

The name of the application (not the file name) that the user wanted to execute.

String

vendor

The vendor who published the application that the user wanted to execute.

String

version

The version of the application that the user wanted to execute.

String

sha256

The check sum of the file that the user wanted to execute.

String

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String, enum

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String

virustotalLink

The link to the report for the file on virustotal.com.

String

preapproved

Indicates whether the file was pre-approved by an administrator.

Boolean

installs

Information about all applications that the user installed during an admin session. Each application is an object in the array with the following properties:

Array of Object

application

The name of the application (not the file name).

String

vendor

The vendor who published the application.

String

version

The version of the application.

String

uninstalls

Information about all applications that the user uninstalled during an admin session. Each application is an object in the array with the following properties:

Array of Object

application

The name of the application (not the file name).

String

vendor

The vendor who published the application.

String

version

The version of the application.

String

elevatedApplications

Information about all applications that the user ran with administrator rights during an admin session. Each application is an object in the array with the following properties:

Array of Object

file

The name of the file that the user wanted to execute.

String

path

The path to the file that the user wanted to execute.

String

name

The name of the application (not the file name) that the user wanted to execute.

String

vendor

The vendor who published the application that the user wanted to execute.

String

version

The version of the application that the user wanted to execute.

String

sha256

The check sum of the file that the user wanted to execute.

String

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String

virustotalLink

The link to the report for the file on virustotal.com.

String

scanResults

Information about the scan results returned by the different engines. Each scan result is an object in the array with the following properties:

Array of Object

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

engine

The name of the malware detection engine that ran the scan.

String

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String
Example

Request: GET https://dc1api.adminbyrequest.com/computers/WIN0815/auditlog?status=denied

Response:

Copy 
[
    {
        "installs": [],
        "uninstalls": [],
        "elevatedApplications": [],
        "scanResults": [],
        "id": 58563354,
        "traceNo": "39276120",
        "settingsName": "Global",
        "type": "Run As Admin",
        "typeCode": 0,
        "status": "Denied",
        "statusCode": 3,
        "application": {
            "file": "cmd.exe",
            "path": "C:\\WINDOWS\\system32",
            "name": "Windows Command Processor",
            "vendor": "Microsoft Corporation",
            "version": "10.0.22621.1 (WinBuild.160101.0800)",
            "sha256": "ED1358CB5F7A7E4FA21E6B07EF1C41AFF43F5602A0B3F6E",
            "scanResult": "Clean",
            "scanResultCode": 0,
            "threat": null,
            "virustotalLink": "https://www.virustotal.com/gui/file/ED1358CB5F70D363C60B4641AFF43F5602A0B3F6E",
            "preapproved": false
        },
        "user": {
            "account": "jdoe",
            "fullName": "John Doe",
            "email": "johndoe@acme.com",
            "phone": "123456787",
            "isAdmin": false
        },
        "computer": {
            "name": "WIND0815",
            "platform": "Windows",
            "platformCode": 0,
            "make": "Microsoft Corporation",
            "model": "Office PC"
        },
        "reason": "Network troubleshooting",
        "approvedBy": null,
        "approvedByEmail": null,
        "deniedReason": "Dont do that.",
        "deniedBy": "Adam Admin",
        "deniedByEmail": "aadmin@acme.com",
        "ssoValidated": false,
        "requestTime": "2026-10-09T12:30:27",
        "requestTimeUTC": "2026-10-09T10:30:27",
        "startTime": null,
        "startTimeUTC": null,
        "endTime": null,
        "endTimeUTC": null,
        "responseTime": "00:01:21.8570000",
        "auditlogLink": "https://eu2.adminbyrequest.com/AuditLog?Page=AppElevations&ID=39276120&ShowFilter=false"
    }
]

Get user auditlog

Returns the auditlog entries for the computers of the specified user.

Note: The user is matched against the last user who logged in to the computer, as reported in the inventory. It is not matched against the user who made the request (user.account or user.fullName in the response). The result can therefore contain entries made by other users on the same computer, and miss entries the specified user made on other computers.

Request

GET {datacenter}/users/{user}/auditlog

Name Description Type

apikey

The API key for connecting to your tenant.

String

All parameters can alternatively be passed as headers. All parameters are optional. If a parameter is passed both as a URL parameter and as a header, the URL parameter takes precedence.

Name Description Type

startid

The ID of the first entry to fetch. Can be used for incremental data retrieval.

Default: The first available ID.

Integer

take

The maximum number of entries to fetch.

Default: 50

Maximum: 10000. If you need to fetch more than 10000 entries, use pagination.

If the value is not a number, an empty array is returned.

Warning: Do not consistently set this parameter to high numbers. If you do, you will quickly exceed your quota, and your account will be blocked for the rest of the day.

Integer

last

Retrieve the latest last entries in descending order. Cannot be combined with take or startid.

Maximum: 10000

Default: All entries are returned in ascending order.

Integer

wantscandetails

If "true", return a detailed list of scan results. If "false", only return a summary.

Default: "false".

Boolean

type

The type of the request. Allowed values are:

  • app: "Run As Admin"

  • session: "Admin Session"

Unknown values are silently ignored. The filter is then not applied, so more entries are returned than expected.

Default: All entries are returned.

String, enum

status

The approval state of the request. Allowed values are:

  • Pending

  • Approved

  • Denied

  • Quarantined

The values are not case-sensitive.

The filter refers to the approval state, not to the status field in the response. For example, status=Approved returns approved entries, whose status field can be "Finished". Values of the status field (such as "Finished") and numeric status codes are not supported.

Unknown values are silently ignored. The filter is then not applied, so more entries are returned than expected.

Default: All entries are returned.

String, enum

days

The number of days for which entries are returned. If startdate is set, this parameter is ignored.

Days are counted as calendar days, not as 24-hour periods. For example, days=0 returns only today's entries.

Default: 30

Integer

startdate

Only return entries created on or after the specified date. The date must be given in the format yyyy-mm-dd. Dates in a different format are silently ignored.

Default: All entries are returned.

Date

enddate

Only return entries created on or before the specified date. The date must be given in the format yyyy-mm-dd. Dates in a different format are silently ignored.

Default: All entries are returned.

Date
Name Description Type

user

The account name or full name of the user for which to retrieve auditlog entries

String
Response

200 - OK - Success response

The operation returns an array of JSON objects. Each object corresponds to one auditlog entry.

Name Description Type

id

The unique ID of the entry .

Integer

traceNo

The trace number with which the entry was logged in the auditlog.

Integer

settingsName

The name of the sub-settings set which matches the entry. If no sub-settings match, "Global" is returned instead.

String

type

The type of the request. Possible values are:

  • Run As Admin

  • Admin Session

  • Server Session

String, enum

typeCode

The type of the request. Possible values are:

  • 0 (Run As Admin)

  • 1 (Admin Session)

  • 2 (Server Session)

Integer

status

The status of the request. Possible values are:

  • Open

  • Running

  • Finished

  • Denied

  • Pending approval

  • Quarantined

  • Expired

String, enum

statusCode

The status of the request. Possible values are:

  • 0 (Open)

  • 1 (Running)

  • 2 (Finished)

  • 3 (Denied)

  • 4 (Pending approval)

  • 5 (Quarantined)

  • 6 (Expired)

Integer

reason

The reason the user gave when issuing the request.

String

approvedBy

The name of the administrator who approved the request.

String

approvedByEmail

The email address of the administrator who approved the request.

String

deniedReason

The reason the administrator gave for denying the request.

String

deniedBy

The name of the administrator who denied the request.

String

deniedByEmail

The email address of the administrator who denied the request.

String

requestTime

The time when the request was sent, in local time.

String, dateTime

requestTimeUTC

The time when the request was sent, in UTC. If unavailable, local time is used instead.

String, dateTime

responseTime

The time span from sending the request until an administrator approved or denied it.

String, time

startTime

The time when the requested application or session was started, in local time.

String, dateTime

startTimeUTC

The time when the requested application or session was started, in UTC. If unavailable, local time is used instead.

String, dateTime

endTime

The time when the requested application or session was finished, in local time.

String, dateTime

endTimeUTC

The time when the requested application or session was finished, in UTC. If unavailable, local time is used instead.

String, dateTime

ssoValidated

Indicates whether or not the request was validated by single sign-on on the endpoint.

Boolean

auditlogLink

A link to the auditlog entry in the Admin By Request Portal.

String

user

Information about the user who sent the request.

Object

account

The log-in name of the user.

String

fullName

The full name of the user.

String

email

The email address that the user entered into the request form.

String

phone

The phone number that the user entered into the request form.

String

isAdmin

Indicates whether or not the user is a local administrator on their computer.

Boolean

computer

Information about the computer from which the request was sent.

Object

name

The name of the computer.

String

platform

The operating system of the computer. Possible values are:

  • Windows

  • Mac

  • Server

String, enum

platformCode

The operating system of the computer. Possible values are:

  • 0: Windows

  • 1: Mac

  • 2: Server

Integer

make

The vendor of the computer as it appears in the inventory.

String

model

The model of the computer as it appears in the inventory.

String

application

Information about the application that the user requested to run as administrator.

Object

file

The name of the file that the user wanted to execute.

String

path

The path to the file that the user wanted to execute.

String

name

The name of the application (not the file name) that the user wanted to execute.

String

vendor

The vendor who published the application that the user wanted to execute.

String

version

The version of the application that the user wanted to execute.

String

sha256

The check sum of the file that the user wanted to execute.

String

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String, enum

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String

virustotalLink

The link to the report for the file on virustotal.com.

String

preapproved

Indicates whether the file was pre-approved by an administrator.

Boolean

installs

Information about all applications that the user installed during an admin session. Each application is an object in the array with the following properties:

Array of Object

application

The name of the application (not the file name).

String

vendor

The vendor who published the application.

String

version

The version of the application.

String

uninstalls

Information about all applications that the user uninstalled during an admin session. Each application is an object in the array with the following properties:

Array of Object

application

The name of the application (not the file name).

String

vendor

The vendor who published the application.

String

version

The version of the application.

String

elevatedApplications

Information about all applications that the user ran with administrator rights during an admin session. Each application is an object in the array with the following properties:

Array of Object

file

The name of the file that the user wanted to execute.

String

path

The path to the file that the user wanted to execute.

String

name

The name of the application (not the file name) that the user wanted to execute.

String

vendor

The vendor who published the application that the user wanted to execute.

String

version

The version of the application that the user wanted to execute.

String

sha256

The check sum of the file that the user wanted to execute.

String

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String

virustotalLink

The link to the report for the file on virustotal.com.

String

scanResults

Information about the scan results returned by the different engines. Each scan result is an object in the array with the following properties:

Array of Object

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

engine

The name of the malware detection engine that ran the scan.

String

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String
Example

Request: https://dc1api.adminbyrequest.com/users/jdoe/auditlog?type=session

Response:

Copy 
[
    {
        "installs": [
            {
                "application": "Microsoft Visual Studio Code (User)",
                "version": "1.143.1",
                "vendor": "Microsoft Corporation"
            }
        ],
        "uninstalls": [],
        "elevatedApplications": [],
        "scanResults": [],
        "id": 58974108,
        "traceNo": "29686874",
        "settingsName": "Global",
        "type": "Admin Session",
        "typeCode": 1,
        "status": "Finished",
        "statusCode": 2,
        "application": {
            "file": null,
            "path": null,
            "name": null,
            "vendor": null,
            "version": null,
            "sha256": null,
            "scanResult": null,
            "scanResultCode": 0,
            "threat": null,
            "virustotalLink": null,
            "preapproved": false
        },
        "user": {
            "account": "jdoe",
            "fullName": "John Doe",
            "email": "jdoe@acme.com",
            "phone": "12345678",
            "isAdmin": false
        },
        "computer": {
            "name": "WIN0815",
            "platform": "Windows",
            "platformCode": 0,
            "make": "Microsoft Corporation",
            "model": "Office PC"
        },
        "reason": "Troubleshooting",
        "approvedBy": "Adam Admin",
        "approvedByEmail": "aadmin@acme.com",
        "deniedReason": null,
        "deniedBy": null,
        "deniedByEmail": null,
        "ssoValidated": false,
        "requestTime": "2026-10-26T08:14:42",
        "requestTimeUTC": "2026-10-26T07:14:42",
        "startTime": "2026-10-26T08:15:04",
        "startTimeUTC": "2026-10-26T07:15:04",
        "endTime": "2026-10-26T08:17:18",
        "endTimeUTC": "2026-10-26T07:17:18",
        "responseTime": "00:00:17.2500000",
        "auditlogLink": "https://eu2.adminbyrequest.com/AuditLog?Page=AdminSessions&ID=29686874&ShowFilter=false"
    }
]

Get delta

Returns the new and changed entries since the last call, as well as a timestamp to pass to the next call. This can be used to incrementally fetch changed entries.

  1. Call the operation once without deltaTime. This first call returns the first page of entries, like Get auditlog, together with a timeNow value.

  2. Save the timeNow value and pass it as deltaTime in the next call. The response contains the entries that changed since then, and a new timeNow value for the following call.

When deltaTime is set:

  • All changed entries are returned, newest first. The take and last parameters are ignored.

  • All other filters are applied, and timeNow is calculated over the filtered entries. Use the same filters in every call. If you change the filters between calls, you can miss changes.

Request
GET {datacenter}/auditlog/delta
Name Description Type

apikey

The API key for connecting to your tenant.

String

All parameters can alternatively be passed as headers. All parameters are optional. If a parameter is passed both as a URL parameter and as a header, the URL parameter takes precedence.

Name Description Type

startid

The ID of the first entry to fetch. Can be used for incremental data retrieval.

Default: The first available ID.

Integer

wantscandetails

If "true", return a detailed list of scan results. If "false", only return a summary.

Default: "false".

Boolean

type

The type of the request. Allowed values are:

  • app: "Run As Admin"

  • session: "Admin Session"

Unknown values are silently ignored. The filter is then not applied, so more entries are returned than expected.

Default: All entries are returned.

String, enum

status

The approval state of the request. Allowed values are:

  • Pending

  • Approved

  • Denied

  • Quarantined

The values are not case-sensitive.

The filter refers to the approval state, not to the status field in the response. For example, status=Approved returns approved entries, whose status field can be "Finished". Values of the status field (such as "Finished") and numeric status codes are not supported.

Unknown values are silently ignored. The filter is then not applied, so more entries are returned than expected.

Default: All entries are returned.

String, enum

days

The number of days for which entries are returned. If startdate is set, this parameter is ignored.

Days are counted as calendar days, not as 24-hour periods. For example, days=0 returns only today's entries.

Default: 30

Integer

startdate

Only return entries created on or after the specified date. The date must be given in the format yyyy-mm-dd. Dates in a different format are silently ignored.

Default: All entries are returned.

Date

enddate

Only return entries created on or before the specified date. The date must be given in the format yyyy-mm-dd. Dates in a different format are silently ignored.

Default: All entries are returned.

Date

deltaTime

Return entries that were changed after the specified timestamp. Pass the timeNow value of the previous response.

The timestamp is given in .NET ticks (UTC).

Default: No timestamp. The operation returns the first page of entries, like Get auditlog.

Integer
Response

200 - OK - Success response

The operation returns an object consisting of an array of JSON objects and the timestamp of the last change to the auditlog. Each object in the array corresponds to one auditlog entry.

Name Description Type

id

The unique ID of the entry .

Integer

traceNo

The trace number with which the entry was logged in the auditlog.

Integer

settingsName

The name of the sub-settings set which matches the entry. If no sub-settings match, "Global" is returned instead.

String

type

The type of the request. Possible values are:

  • Run As Admin

  • Admin Session

  • Server Session

String, enum

typeCode

The type of the request. Possible values are:

  • 0 (Run As Admin)

  • 1 (Admin Session)

  • 2 (Server Session)

Integer

status

The status of the request. Possible values are:

  • Open

  • Running

  • Finished

  • Denied

  • Pending approval

  • Quarantined

  • Expired

String, enum

statusCode

The status of the request. Possible values are:

  • 0 (Open)

  • 1 (Running)

  • 2 (Finished)

  • 3 (Denied)

  • 4 (Pending approval)

  • 5 (Quarantined)

  • 6 (Expired)

Integer

reason

The reason the user gave when issuing the request.

String

approvedBy

The name of the administrator who approved the request.

String

approvedByEmail

The email address of the administrator who approved the request.

String

deniedReason

The reason the administrator gave for denying the request.

String

deniedBy

The name of the administrator who denied the request.

String

deniedByEmail

The email address of the administrator who denied the request.

String

requestTime

The time when the request was sent, in local time.

String, dateTime

requestTimeUTC

The time when the request was sent, in UTC. If unavailable, local time is used instead.

String, dateTime

responseTime

The time span from sending the request until an administrator approved or denied it.

String, time

startTime

The time when the requested application or session was started, in local time.

String, dateTime

startTimeUTC

The time when the requested application or session was started, in UTC. If unavailable, local time is used instead.

String, dateTime

endTime

The time when the requested application or session was finished, in local time.

String, dateTime

endTimeUTC

The time when the requested application or session was finished, in UTC. If unavailable, local time is used instead.

String, dateTime

ssoValidated

Indicates whether or not the request was validated by single sign-on on the endpoint.

Boolean

auditlogLink

A link to the auditlog entry in the Admin By Request Portal.

String

user

Information about the user who sent the request.

Object

account

The log-in name of the user.

String

fullName

The full name of the user.

String

email

The email address that the user entered into the request form.

String

phone

The phone number that the user entered into the request form.

String

isAdmin

Indicates whether or not the user is a local administrator on their computer.

Boolean

computer

Information about the computer from which the request was sent.

Object

name

The name of the computer.

String

platform

The operating system of the computer. Possible values are:

  • Windows

  • Mac

  • Server

String, enum

platformCode

The operating system of the computer. Possible values are:

  • 0: Windows

  • 1: Mac

  • 2: Server

Integer

make

The vendor of the computer as it appears in the inventory.

String

model

The model of the computer as it appears in the inventory.

String

application

Information about the application that the user requested to run as administrator.

Object

file

The name of the file that the user wanted to execute.

String

path

The path to the file that the user wanted to execute.

String

name

The name of the application (not the file name) that the user wanted to execute.

String

vendor

The vendor who published the application that the user wanted to execute.

String

version

The version of the application that the user wanted to execute.

String

sha256

The check sum of the file that the user wanted to execute.

String

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String, enum

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String

virustotalLink

The link to the report for the file on virustotal.com.

String

preapproved

Indicates whether the file was pre-approved by an administrator.

Boolean

installs

Information about all applications that the user installed during an admin session. Each application is an object in the array with the following properties:

Array of Object

application

The name of the application (not the file name).

String

vendor

The vendor who published the application.

String

version

The version of the application.

String

uninstalls

Information about all applications that the user uninstalled during an admin session. Each application is an object in the array with the following properties:

Array of Object

application

The name of the application (not the file name).

String

vendor

The vendor who published the application.

String

version

The version of the application.

String

elevatedApplications

Information about all applications that the user ran with administrator rights during an admin session. Each application is an object in the array with the following properties:

Array of Object

file

The name of the file that the user wanted to execute.

String

path

The path to the file that the user wanted to execute.

String

name

The name of the application (not the file name) that the user wanted to execute.

String

vendor

The vendor who published the application that the user wanted to execute.

String

version

The version of the application that the user wanted to execute.

String

sha256

The check sum of the file that the user wanted to execute.

String

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String

virustotalLink

The link to the report for the file on virustotal.com.

String

scanResults

Information about the scan results returned by the different engines. Each scan result is an object in the array with the following properties:

Array of Object

scanResult

The result of the malware scan for the file. Possible values are:

  • Clean

  • Malicious

  • Suspicious

String

scanResultCode

The result of the malware scan for the file. Possible values are:

  • 0: Clean

  • 1: Malicious

  • 2: Suspicious

Integer

engine

The name of the malware detection engine that ran the scan.

String

threat

The name of the recognized malware, if the file is malicious or suspicious. NULL if the file is clean.

String
Name Description Type

timeNow

The timestamp to pass to the next call as deltaTime to retrieve new changes. The timestamp is given in .NET ticks (UTC).

  • If deltaTime was set, this is the time of the last change to the (filtered) auditlog, not the current time. It often stays the same between calls.

  • If deltaTime was not set, this is the current time. It changes on every call.

Integer
Examples

Request: GET https://dc1api.adminbyrequest.com/auditlog/delta

Response:

Copy 
{
    "entries": [
        {
        "installs": [
            {
                "application": "Mozilla Firefox (x64 en-US)",
                "version": "158.0.1",
                "vendor": "Mozilla"
            },
            {
                "application": "Notepad++ (64-bit x64)",
                "version": "8.9.8.1",
                "vendor": "Notepad++ Team"
            }
        ],
        "uninstalls": [],
        "elevatedApplications": [
            {
                "name": "Firefox",
                "path": "C:\\Users\\User\\Downloads",
                "file": "Firefox Installer.exe",
                "version": "18.05",
                "vendor": "Mozilla Corporation",
                "sha256": "8E8634C29671BC9873B5A3372CB3F24B165C31DCA7467E622",
                "scanResult": null,
                "scanResultCode": 0,
                "threat": null,
                "virustotalLink": "https://www.virustotal.com/gui/file/8E8634C29671BC980D496412A8975F34B165C31DCA7467E622"
            },
            {
                "name": "Firefox Installer",
                "path": "C:\\Users\\User\\AppData\\Local\\Temp\\7zS40B27C54",
                "file": "setup-stub.exe",
                "version": "158.0.1",
                "vendor": "Mozilla Corporation",
                "sha256": "186E4D973F07EE5A489586B490A92C95A5271A1158FCBC",
                "scanResult": null,
                "scanResultCode": 0,
                "threat": null,
                "virustotalLink": "https://www.virustotal.com/gui/file/186E4D973FB3E8E3A1957B190A92C95A5271A1158FCBC"
            },
            {
                "name": "notepad++",
                "path": "C:\\Program Files\\Notepad++",
                "file": "notepad++.exe",
                "version": "8.9.8.1",
                "vendor": "Notepad++\"",
                "sha256": "C52C9ED2EC6D0B5B3F243B2A92BB42A9AF2665709464B3CF",
                "scanResult": null,
                "scanResultCode": 0,
                "threat": null,
                "virustotalLink": "https://www.virustotal.com/gui/file/C52C9ED2EC6D0B5B56B6BA92BB42A9AF2665709464B3CF"
            }
        ],
        "scanResults": [],
        "id": 58943715,
        "traceNo": "29656481",
        "settingsName": "Global",
        "type": "Admin Session",
        "typeCode": 1,
        "status": "Finished",
        "statusCode": 2,
        "application": {
            "file": null,
            "path": null,
            "name": null,
            "vendor": null,
            "version": null,
            "sha256": null,
            "scanResult": null,
            "scanResultCode": 0,
            "threat": null,
            "virustotalLink": null,
            "preapproved": false
        },
        "user": {
            "account": "jdoe",
            "fullName": "John Doe",
            "email": "jdoe@acme.com",
            "phone": "12345678",
            "isAdmin": false
        },
        "computer": {
            "name": "WIN0815",
            "platform": "Windows",
            "platformCode": 0,
            "make": "Microsoft Corporation",
            "model": "Virtual Machine"
        },
        "reason": "Set up my new machine",
        "approvedBy": "Adam Admin",
        "approvedByEmail": "aadmin@acme.com",
        "deniedReason": null,
        "deniedBy": null,
        "deniedByEmail": null,
        "ssoValidated": false,
        "requestTime": "2026-10-23T12:40:04",
        "requestTimeUTC": "2026-10-23T10:40:04",
        "startTime": "2026-10-23T12:40:22",
        "startTimeUTC": "2026-10-23T10:40:22",
        "endTime": "2026-10-23T12:50:23",
        "endTimeUTC": "2026-10-23T10:50:23",
        "responseTime": "00:00:12.2540000",
        "auditlogLink": "https://eu2.adminbyrequest.com/AuditLog?Page=AdminSessions&ID=29656481&ShowFilter=false"
    }
  ],
  "timeNow": 639285986750201647
}

Request: GET https://dc1api.adminbyrequest.com/auditlog/delta?deltaTime=639285955488619735

Response:

Copy 
{
    "entries": [
        {
            "installs": [
                {
                    "application": "Microsoft Visual Studio Code (User)",
                    "version": "1.143.1",
                    "vendor": "Microsoft Corporation"
                }
            ],
            "uninstalls": [],
            "elevatedApplications": [],
            "scanResults": [],
            "id": 58974108,
            "traceNo": "29686874",
            "settingsName": "Global",
            "type": "Admin Session",
            "typeCode": 1,
            "status": "Finished",
            "statusCode": 2,
            "application": {
                "file": null,
                "path": null,
                "name": null,
                "vendor": null,
                "version": null,
                "sha256": null,
                "scanResult": null,
                "scanResultCode": 0,
                "threat": null,
                "virustotalLink": null,
                "preapproved": false
            },
            "user": {
                "account": "jdoe",
                "fullName": "John Doe",
                "email": "jdoe@acme.com",
                "phone": "12345678",
                "isAdmin": false
            },
            "computer": {
                "name": "WIN0815",
                "platform": "Windows",
                "platformCode": 0,
                "make": "Microsoft Corporation",
                "model": "Virtual Machine"
            },
            "reason": "Troubleshooting",
            "approvedBy": "Adam Admin",
            "approvedByEmail": "aadmin@acme.com",
            "deniedReason": null,
            "deniedBy": null,
            "deniedByEmail": null,
            "ssoValidated": false,
            "requestTime": "2026-10-26T08:14:42",
            "requestTimeUTC": "2026-10-26T07:14:42",
            "startTime": "2026-10-26T08:15:04",
            "startTimeUTC": "2026-10-26T07:15:04",
            "endTime": "2026-10-26T08:17:18",
            "endTimeUTC": "2026-10-26T07:17:18",
            "responseTime": "00:00:17.2500000",
            "auditlogLink": "https://eu2.adminbyrequest.com/AuditLog?Page=AdminSessions&ID=29686874&ShowFilter=false"
        }
    ],
    "timeNow": 639285958351170000
}

Request: GET https://dc1api.adminbyrequest.com/auditlog/delta?deltaTime=639285958351170000

Response:

Copy 
{
    "entries": [],
    "timeNow": 639285958351170000
}