Skip to main content

query auditing events

GET 
/org/:orgId/auditingEvent/query

Query auditing events with advanced filtering, sorting, and pagination using CRUD query language. Supports complex filters, sorting by multiple fields, and pagination.

Request​

Path Parameters

    orgId stringrequired

    Organization ID

Query Parameters

    page_size integer

    Number of items per page (default: 20, max: 1000)

    page_number integer

    Page number (default: 1)

    q string

    LISP-style filter expression (e.g., '(= event_type \

    s string

    Sort fields: 'field:asc,field2:desc' or '-field,field2' format (e.g., 'creation_time:desc,event_type:asc' or '-creation_time,event_type')

Responses​

Paginated list of auditing events

Schema

    data

    object[]

  • Array [

    • aceEventBridgeEvent

    object

    account string

    detail

    object

    catalog string

    "AWS" or "Sandbox"

    engagementInvitation

    object

    Engagement invitation-related events

    arn string

    opportunity

    object

    Opportunity-related events

    identifier string
    url string
    schemaVersion string
    detail-type string
    id string
    region string
    resources string[]
    source string

    "aws.partnercentral-selling"

    time date-time
    version string

    alibabaMarketplaceEvent

    object

    action AlibabaMarketplaceAction (string)

    Possible values: [createInstance, renewInstance, upgradeInstance, expiredInstance, releaseInstance, verify, createIdaas, PushMeteringData]

    aliUid string

    The Alibaba UID of the buyer's Alibaba Account.

    expiredOn date-time
    instanceId string
    isRefund boolean
    orderBizId string

    Used as the Instance ID, and as the external ID for the Suger Entitlement.

    orderId string
    productCode string
    skuId string
    sugerOrganizationId string

    Suger organization ID of this event. Populated by Suger Service.

    template string
    timeStamp date-time

    When the event was received by the Suger.

    token string

    SPI security token.

    trial boolean

    If true, the event is for a trial.

    awsMarketplaceEvent

    object

    action string
    customer-identifier string
    id string
    isFreeTrialTermPresent string

    Possible values: [true, false]

    offer-identifier string
    product-code string
    sugerOrganizationId string

    Populated by Suger Service.

    awsMarketplaceEventBridgeEvent

    object

    account string

    The seller/ISV AWS Account Id.

    detail

    object

    catalog string
    eventCategory string
    eventID string
    eventName string
    eventSource string
    eventType string
    eventVersion string
    managementEvent boolean

    manufacturer

    object

    The seller/ISV's AWS Account Id.

    accountId string
    name string

    offer

    object

    arn string
    expirationDate date-time
    id string
    name string

    product

    object

    arn string
    id string
    title string
    requestID string
    requestParameters
    responseElements

    sellerOfRecord

    object

    For private offer created by a channel partner, this is the channel partner's AWS Account Id. For private offer created by a seller/ISV, this is the seller/ISV's AWS Account Id.

    accountId string
    name string
    targetedBuyerAccountIds string[]
    detail-type string
    id string
    region string
    resources string[]
    source string

    "aws.marketplacecatalog"

    time date-time
    version string

    azureMarketplaceEvent

    object

    action AzureMarketplaceEventAction (string)

    Possible values: [ChangePlan, ChangeQuantity, Renew, Suspend, Unsubscribe, Reinstate]

    activityId string
    id string

    The Operation Id.

    offerId string
    operationRequestSource string

    Possible values: [Azure, Partner]

    planId string
    publisherId string
    purchaseToken string
    quantity integer
    status string

    Possible values: [Succeeded, InProgress]

    subscription

    object

    allowedCustomerOperations string[]

    Possible values: [Read, Update, Delete]

    autoRenew boolean

    beneficiary

    object

    billingAccountId string

    Azure Billing Account ID

    customerId string
    emailId string

    Email address

    firstName string
    lastName string
    licenseType string

    Azure License Type

    objectId string
    puid string

    ID of the user, used as External ID of suger IdentityBuyer.

    sellerId string

    Azure MPO seller ID

    tenantId string

    The Azure Active Directory Tenant ID of the buyer or the reseller partner ID (the same as TenantId).

    created date-time
    fulfillmentId string
    id string
    isFreeTrial boolean
    isTest boolean
    lastModified string
    name string
    offerId string
    planId string
    publisherId string

    purchaser

    object

    billingAccountId string

    Azure Billing Account ID

    customerId string
    emailId string

    Email address

    firstName string
    lastName string
    licenseType string

    Azure License Type

    objectId string
    puid string

    ID of the user, used as External ID of suger IdentityBuyer.

    sellerId string

    Azure MPO seller ID

    tenantId string

    The Azure Active Directory Tenant ID of the buyer or the reseller partner ID (the same as TenantId).

    quantity integer
    saasSubscriptionStatus AzureMarketplaceSubscriptionStatus (string)

    Possible values: [NotStarted, PendingFulfillmentStart, Subscribed, Suspended, Unsubscribed]

    sandboxType string

    Possible values: [None, Csp]

    sessionId string
    sessionMode string

    Possible values: [None, DryRun]

    storeFront string

    term

    object

    chargeDuration string
    endDate date-time
    startDate date-time
    termUnit string
    subscriptionId string
    sugerOrganizationId string

    Populated by Suger Service.

    timeStamp date-time
    creationTime date-time

    When the event is received and audited.

    eventType string

    Possible values: [AWS_MARKETPLACE, AWS_CHINA_MARKETPLACE, AWS_EVENT_BRIDGE, AWS_ACE_EVENT_BRIDGE, AZURE_MARKETPLACE, GCP_MARKETPLACE, GCP_MARKETPLACE_CHROME, ALIBABA_MARKETPLACE]

    gcpMarketplaceEvent

    object

    account

    object

    approvals

    object[]

    The approvals for this account, that are permitted or have been completed.

  • Array [

    • name string
    reason string

    An explanation for the state of the approval.

    state GcpMarketplaceUserAccountApprovalState (string)

    Possible values: [STATE_UNSPECIFIED, PENDING, APPROVED, REJECTED]

    updateTime string

    RFC3339 UTC timestamp

  • ]

    • billingAccountId string

    The buyer's GCP billing account ID if it's a company account.

    createTime date-time

    RFC3339 UTC timestamp

    id string

    GCP Marketplace User Account ID.

    inputProperties integer[]
    name string

    The resource name of the account, in format of providers/{provider_id}/accounts/{account_id}.

    parentBillingAccountId string

    The parent account ID of the BillingAccountId if the buyer is from a reseller in GCP Marketplace. It is the GCP billing account ID of the reseller in GCP Marketplace.

    provider string

    The identifier of the service provider (SaaS Seller) that this account was created against.

    state GcpMarketplaceUserAccountState (string)

    Possible values: [ACCOUNT_STATE_UNSPECIFIED, ACCOUNT_ACTIVE]

    The state of the account. An account might not be able to make a purchase if the billing account is suspended.

    updateTime date-time

    RFC3339 UTC timestamp

    userInfo

    object

    orders string[]

    a list of unique order IDs for each entitlement ID that indicates the different offers on the same product. This field is available only if multiple orders of the same product is enabled

    roles string[]

    An array of strings representing the user's roles. Right now, it can be either: ** account_admin, which indicates that the user is a Billing Account Administrator of the billing account that purchased the product, or ** project_editor, which indicates that the user is a Project Editor, but not a Billing Administrator, of the project under that billing account.

    user_identity string

    The user's obfuscated GAIA ID, which can be used to initiate Open ID Connect.

    entitlement

    object

    account string

    The resource name of the account that this entitlement is based on, if any, in format ""providers/{provider_id}/accounts/{account_id}"

    consumers

    object[]

    The resources using this entitlement, if applicable.

  • Array [

    • project string

    The project name with format projects/.

  • ]

    • createTime date-time
    id string

    Entitlement Id generated by GCP Marketplace. For Marketplace pub/sub event.

    inputProperties integer[]

    The custom properties that were collected from the user to create this entitlement.

    messageToUser string

    Provider-supplied message that is displayed to the end user. Currently this is used to communicate progress and ETA for provisioning. This field can be updated only when a user is waiting for an action from the provider, i.e. entitlement state is EntitlementState.ENTITLEMENT_ACTIVATION_REQUESTED or EntitlementState.ENTITLEMENT_PENDING_PLAN_CHANGE_APPROVAL. This field is cleared automatically when the entitlement state changes.

    name string

    The resource name of the entitlement. Entitlement names have the form of providers/{provider_id}/entitlements/{entitlement_id}.

    newOfferDuration string

    in ISO 8601 duration format, such as "P2Y3M". For Marketplace pub/sub event.

    newOfferEndTime string

    Output only. The end time of the new offer. Field is empty if the pending plan change is not moving to an offer. If the offer was created with a term instead of a specified end date, this field is empty.

    newOfferStartTime string

    Output only. The start time of the new offer. Field is empty if the pending plan change is not moving to an offer.

    newPendingOffer string

    The name of the offer the entitlement is switching to upon a pending plan change. Only exists if the pending plan change is moving to an offer. Format: 'projects/{project}/services/{service}/privateOffers/{offer-id}' OR 'projects/{project}/services/{service}/standardOffers/{offer-id}', depending on whether the offer is private or public.

    newPendingOfferDuration string

    The offer duration of the new offer in ISO 8601 duration format. Field is empty if the pending plan change is not moving to an offer since the entitlement is not pending, only the plan change is pending.

    newPendingPlan string

    The identifier of the pending new plan. Required if the product has plans and the entitlement has a pending plan change.

    newPlan string

    When the buyer changes plan, For Marketplace pub/sub event.

    offer string

    The name of the offer that was procured. Field is empty if order was not made using an offer. Format: 'projects/{project}/services/{service}/privateOffers/{offer-id}' OR 'projects/{project}/services/{service}/standardOffers/{offer-id}', depending on whether the offer is private or public.

    offerDuration string

    The offer duration of the current offer in ISO 8601 duration format. Field is empty if entitlement was not made using an offer, such as "P1Y", "P2M"

    offerEffectiveTime date-time

    When the offer is effective.

    offerEndTime date-time

    Output only. End time for the Offer association corresponding to this entitlement. The field is only populated if the entitlement is currently associated with an Offer.

    plan string

    The identifier of the plan that was procured. Required if the product has plans.

    product string

    The identifier of the entity that was purchased. This may actually represent a product, quote, or offer. For Private offer, "projects/project-id/services/product-id.endpoints.partner-id.cloud.goog/privateOffers/private-offer-id"

    productExternalName string

    The identifier of the product that was procured.

    provider string

    The ID of the service provider under Cloud Commerce platform that this entitlement was created against.

    quoteExternalName string

    The identifier of the quote that was used to procure, such as the private offer Id. Empty if the order is not purchased using a quote.

    state GcpMarketplaceEntitlementState (string)

    Possible values: [ENTITLEMENT_STATE_UNSPECIFIED, ENTITLEMENT_ACTIVATION_REQUESTED, ENTITLEMENT_ACTIVE, ENTITLEMENT_PENDING_CANCELLATION, ENTITLEMENT_CANCELLED, ENTITLEMENT_PENDING_PLAN_CHANGE, ENTITLEMENT_PENDING_PLAN_CHANGE_APPROVAL, ENTITLEMENT_SUSPENDED]

    Enums of the Entitlement State. https://cloud.google.com/marketplace/docs/partners/commerce-procurement-api/reference/rest/v1/providers.entitlements#EntitlementState

    subscriptionEndTime date-time

    The End time for the subscription corresponding to this entitlement.

    updateTime date-time

    The last update timestamp. It is the endTime for the cancelled entitlement.

    usageReportingId string

    The consumerId to use when reporting usage through the Service Control API. See the consumerId field at Reporting Metrics (https://cloud.google.com/service-control/reporting-metrics) for more details. This field is present only if the product has usage-based billing configured.

    eventId string
    eventType GcpMarketplacceEventType (string)

    Possible values: [ACCOUNT_ACTIVE, ACCOUNT_DELETED, ENTITLEMENT_CREATION_REQUESTED, ENTITLEMENT_ACTIVE, ENTITLEMENT_PLAN_CHANGE_REQUESTED, ENTITLEMENT_PLAN_CHANGED, ENTITLEMENT_PLAN_CHANGE_CANCELLED, ENTITLEMENT_PENDING_CANCELLATION, ENTITLEMENT_CANCELLATION_REVERTED, ENTITLEMENT_CANCELLED, ENTITLEMENT_CANCELLING, ENTITLEMENT_RENEWED, ENTITLEMENT_OFFER_ENDED, ENTITLEMENT_OFFER_ACCEPTED, ENTITLEMENT_DELETED]

    providerId string

    GCP Partner ID of the SaaS Seller.

    publishTime date-time

    The Publish Time of the event.

    sugerOrganizationId string

    Populated by Suger Service.

    id string
    lastUpdateTime date-time

    when the event is updated.

    organizationID string
    otherTypeEvent

    Nullable, applicable when eventType is other types.

    status string

    Possible values: [AUDITED, PENDING, FAILED, DONE]

  • ]

    • page_number integer
    page_size integer
    total_count integer
Loading...