This use case shows how to retrieve Mapp Engage Log Tracker (audit) events through the Engage API — for example, to collect them in a security information and event management (SIEM) or log-management platform such as Splunk or Microsoft Sentinel for monitoring and retention.
Prerequisites
Before you begin, make sure you have valid authorization credentials. See Getting Started with Engage API for more information. Your API user needs the same permission as the Log Tracker in the interface; without it, the request returns 403. Events are returned only for your own account.
Query parameters
Retrieve events for a bounded time window and, optionally, narrow the results with filters:
Parameter | Description |
|---|---|
| Start of the time window, inclusive. Required. |
| End of the time window, exclusive. |
| Restricts results to a Log Tracker action category, for example |
| Maximum number of events to return per page. |
| Cursor for the next page, taken from the previous response. |
Additional optional filters are available, including entryType, executorId, referenceType, and referenceId.
Procedure
Send a GET request to the audit log endpoint for the time window you want to retrieve. The example below returns message events for a twelve-hour window.
GET 'https://your-engage-domain.com/api/rest/auditlog/events?since=2026-07-16T00:00:00Z&until=2026-07-16T12:00:00Z&actionCategory=MESSAGE'Conclusion
You receive a 200 response containing the matching events and a pagination object. Each event includes fields such as its timestamp, actionCategory, the executor (executorId, executorEmail), sourceIp, and a details string. When pagination.nextPageToken is present, pass it as pageToken on the next request to page through the full window, and repeat until no token is returned. A 403 response indicates the API user is missing the Log Tracker permission; a 400 response indicates invalid request parameters.