# Refining a REST query for audit logs
**URL:** https://community.cumulocity.com/t/refining-a-rest-query-for-audit-logs/1427
**Category:** Forum
**Tags:** cumulocity
**Created:** [September 26, 2024, 2:25pm UTC](https://community.cumulocity.com/t/refining-a-rest-query-for-audit-logs/1427 "2024-09-26T14:25:05Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@david.presuhn](https://community.cumulocity.com/u/david.presuhn)
#### Post date: [September 26, 2024, 2:25pm UTC](https://community.cumulocity.com/t/refining-a-rest-query-for-audit-logs/1427/1 "2024-09-26T14:25:05Z")
#### _ **Product/components** used and **version/fix** level:_
Cumulocity IoT, v 1018
#### _Detailed explanation of the problem:_
I’m looking for help with syntax for a rest query. The query so far is (using Postman):
‘{{url}}/audit/auditRecords?withTotalPages=true&dateFrom=2024-09-25T20:40:00.000Z&dateTo=2024-09-25T23:00:00.000Z&pageSize=100&type=Operation’
That finds the audit records in the timeframe I want; from there I want to retrieve specific records.
One record I want to retrieve has this entry (I’ve masked some data to not post a prod URL):
'{
“activity”: “Operation created”,
“creationTime”: “2024-09-25T21:01:46.194Z”,
“source”: {
“self”: “[https://t](https://t)\*\*\*.iot.\*\*\*.com/inventory/managedObjects/9923485”,
“id”: “9923485”
},
“type”: “Operation”,
“self”: “[https://t907.iot.bsci.com/audit/auditRecords/9923486](https://t907.iot.bsci.com/audit/auditRecords/9923486)”,
“id”: “9923486”,
“text”: “Operation created: status=‘PENDING’, description=‘Downloading software package with id 868355031’, device name=‘3300\_004089’.”,
“time”: “2024-09-25T21:01:46.194Z”,
“user”: “device\_3300\_004089”,
“com\_cumulocity\_model\_event\_AuditSourceDevice”: {
“\_id”: “35249”
}
’
I’d like to retrieve just records that have the description of downloading software or just audit records for the managed object. Is there any way to refine my query to retrieve that information? I’m not successful putting the JSON info in the query line.
#### _Error messages / **full error** message screenshot / **log** file:_
No error message
#### _Question related to a **free trial** , or to a **production (customer)** instance?_
Production instance.
---
### Author:  [@Harald\_Meyer](https://community.cumulocity.com/u/Harald_Meyer)
#### Post date: [September 27, 2024, 5:56am UTC](https://community.cumulocity.com/t/refining-a-rest-query-for-audit-logs/1427/2 "2024-09-27T05:56:10Z")
Hi Dave,
you can find the API definition here:
[https://www.cumulocity.com/api/core/#operation/getAuditRecordCollectionResource](https://www.cumulocity.com/api/core/#operation/getAuditRecordCollectionResource)
searching for text in the description is not possible.
---
### Author:  [@system](https://community.cumulocity.com/u/system)
#### Post date: [March 26, 2025, 5:56am UTC](https://community.cumulocity.com/t/refining-a-rest-query-for-audit-logs/1427/3 "2025-03-26T05:56:58Z")
This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.