Return One Event from One Organization

GET /api/atlas/v2/orgs/{orgId}/events/{eventId}

Returns one event for the specified organization. Events identify significant database, billing, or security activities or status changes. To use this resource, the requesting Service Account or API Key must have the Organization Member role. Use the Return Events from One Organization endpoint to retrieve all events to which the authenticated user has access.

This resource remains under revision and may change.

Return Events from One Organization

Path parameters

orgId string Required

Unique 24-hexadecimal digit string that identifies the organization that contains your projects. Use the /orgs endpoint to retrieve all organizations to which the authenticated user has access.

Format should match the following pattern: ^([a-f0-9]{24})$.
eventId string Required

Unique 24-hexadecimal digit string that identifies the event that you want to return.

Format should match the following pattern: ^([a-f0-9]{24})$.

Query parameters

envelope boolean

Flag that indicates whether Application wraps the response in an envelope JSON object. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. Endpoints that return a list of results use the results object as an envelope. Application adds the status parameter to the response body.

Default value is false.
pretty boolean

Flag that indicates whether the response body should be in the prettyprint format.

Default value is false.

Prettyprint
includeRaw boolean

Flag that indicates whether to include the raw document in the output. The raw document contains additional meta information about the event.

Default value is false.

Responses

200 application/vnd.atlas.2023-01-01+json

OK
One of:
DefaultEventViewForOrg object AlertAudit object AlertConfigAudit object ApiUserEventViewForOrg object ServiceAccountOrgEvents object BillingEventViewForOrg object NDSAuditViewForOrg object OrgEventViewForOrg object TeamEvent object UserEventViewForOrg object ResourceEventViewForOrg object AtlasResourcePolicyAuditForOrg object
Other events which don't have extra details beside of basic one.

Hide attributes Show attributes

apiKeyId string

Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

Create Programmatic API Key

created string(date-time) Required

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

eventTypeName string Required

Unique identifier of event type.

One of:
Federation Settings Event Types string Group Audit Types string Mlab Migration Audit Types string Partner Event Types string Support Event Types string

Values are FEDERATION_SETTINGS_CREATED, FEDERATION_SETTINGS_DELETED, FEDERATION_SETTINGS_UPDATED, IDENTITY_PROVIDER_CREATED, IDENTITY_PROVIDER_UPDATED, IDENTITY_PROVIDER_DELETED, IDENTITY_PROVIDER_ACTIVATED, OIDC_IDENTITY_PROVIDER_UPDATED, IDENTITY_PROVIDER_DEACTIVATED, IDENTITY_PROVIDER_JWKS_REVOKED, OIDC_IDENTITY_PROVIDER_ENABLED, OIDC_IDENTITY_PROVIDER_DISABLED, DOMAINS_ASSOCIATED, DOMAIN_CREATED, DOMAIN_DELETED, DOMAIN_VERIFIED, ORG_SETTINGS_CONFIGURED, ORG_SETTINGS_UPDATED, ORG_SETTINGS_DELETED, RESTRICT_ORG_MEMBERSHIP_ENABLED, RESTRICT_ORG_MEMBERSHIP_DISABLED, ROLE_MAPPING_CREATED, ROLE_MAPPING_UPDATED, or ROLE_MAPPING_DELETED.

Values are MLAB_MIGRATION_COMPLETED, MLAB_MIGRATION_TARGET_CLUSTER_CREATED, MLAB_MIGRATION_DATABASE_USERS_IMPORTED, MLAB_MIGRATION_IP_WHITELIST_IMPORTED, MLAB_MIGRATION_TARGET_CLUSTER_SET, MLAB_MIGRATION_DATABASE_RENAMED, MLAB_MIGRATION_LIVE_IMPORT_STARTED, MLAB_MIGRATION_LIVE_IMPORT_READY_FOR_CUTOVER, MLAB_MIGRATION_LIVE_IMPORT_CUTOVER_COMPLETE, MLAB_MIGRATION_LIVE_IMPORT_ERROR, MLAB_MIGRATION_LIVE_IMPORT_CANCELLED, MLAB_MIGRATION_DUMP_AND_RESTORE_TEST_STARTED, MLAB_MIGRATION_DUMP_AND_RESTORE_TEST_SKIPPED, MLAB_MIGRATION_DUMP_AND_RESTORE_STARTED, MLAB_MIGRATION_SUPPORT_PLAN_SELECTED, or MLAB_MIGRATION_SUPPORT_PLAN_OPTED_OUT.

Values are AWS_SELF_SERVE_ACCOUNT_LINKED, AWS_SELF_SERVE_ACCOUNT_LINK_PENDING, AWS_SELF_SERVE_ACCOUNT_CANCELLED, AWS_SELF_SERVE_ACCOUNT_LINK_FAILED, GCP_SELF_SERVE_ACCOUNT_LINK_PENDING, GCP_SELF_SERVE_ACCOUNT_LINK_FAILED, AZURE_SELF_SERVE_ACCOUNT_LINKED, AZURE_SELF_SERVE_ACCOUNT_LINK_PENDING, AZURE_SELF_SERVE_ACCOUNT_CANCELLED, AZURE_SELF_SERVE_ACCOUNT_LINK_FAILED, GCP_SELF_SERVE_ACCOUNT_LINKED, GCP_SELF_SERVE_ACCOUNT_CANCELLED, VERCEL_SELF_SERVE_ACCOUNT_LINKED, VERCEL_SELF_SERVE_ACCOUNT_LINK_PENDING, VERCEL_SELF_SERVE_ACCOUNT_CANCELLED, VERCEL_SELF_SERVE_ACCOUNT_LINK_FAILED, VERCEL_INVOICE_CREATED, VERCEL_INVOICE_NOT_PAID, VERCEL_INVOICE_PAID, or VERCEL_INVOICE_REFUNDED.

groupId string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.

Format should match the following pattern: ^([a-f0-9]{24})$.

id string Required

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

isGlobalAdmin boolean

Flag that indicates whether a MongoDB employee triggered the specified event.

links array[object]

List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

Web Linking Specification (RFC 5988)

Hide links attributes Show links attributes object

href string

Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

rel string

Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

publicKey string

Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.

External documentation

raw object

Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.

Hide raw attributes Show raw attributes object

_t string

Unique identifier of event type.

alertConfigId string

Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

cid string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred.

Format should match the following pattern: ^([a-f0-9]{24})$.

cre string(date-time)

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

description string

Description of the event.

gn string

Human-readable label that identifies the project.

Minimum length is 1, maximum length is 64.

id string

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgName string

Human-readable label that identifies the organization that contains the project.

Minimum length is 1, maximum length is 64.

severity string

Severity of the event.

Values are INFO, WARNING, ERROR, or CRITICAL.

remoteAddress string

IPv4 or IPv6 address from which the user triggered this event.

Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.

userId string

Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

username string(email)

Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
Alert audit indicates acknowledgement status of an alert.

Hide attributes Show attributes

alertId string

Unique 24-hexadecimal digit string that identifies the alert associated with the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

apiKeyId string

Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

Create Programmatic API Key

created string(date-time) Required

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

eventTypeName string Required

Unique identifier of event type.

Values are ALERT_ACKNOWLEDGED_AUDIT or ALERT_UNACKNOWLEDGED_AUDIT.

groupId string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.

Format should match the following pattern: ^([a-f0-9]{24})$.

id string Required

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

isGlobalAdmin boolean

Flag that indicates whether a MongoDB employee triggered the specified event.

links array[object]

List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

Web Linking Specification (RFC 5988)

Hide links attributes Show links attributes object

href string

Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

rel string

Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

publicKey string

Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.

External documentation

raw object

Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.

Hide raw attributes Show raw attributes object

_t string

Unique identifier of event type.

alertConfigId string

Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

cid string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred.

Format should match the following pattern: ^([a-f0-9]{24})$.

cre string(date-time)

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

description string

Description of the event.

gn string

Human-readable label that identifies the project.

Minimum length is 1, maximum length is 64.

id string

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgName string

Human-readable label that identifies the organization that contains the project.

Minimum length is 1, maximum length is 64.

severity string

Severity of the event.

Values are INFO, WARNING, ERROR, or CRITICAL.

remoteAddress string

IPv4 or IPv6 address from which the user triggered this event.

Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.

userId string

Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

username string(email)

Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
Alert config audit indicates any activities around alert settings.

Hide attributes Show attributes

alertConfigId string

Unique 24-hexadecimal digit string that identifies the alert configuration associated with the alertId.

Format should match the following pattern: ^([a-f0-9]{24})$.

apiKeyId string

Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

Create Programmatic API Key

created string(date-time) Required

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

eventTypeName string Required

Unique identifier of event type.

Values are ALERT_CONFIG_DISABLED_AUDIT, ALERT_CONFIG_ENABLED_AUDIT, ALERT_CONFIG_ADDED_AUDIT, ALERT_CONFIG_DELETED_AUDIT, or ALERT_CONFIG_CHANGED_AUDIT.

groupId string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.

Format should match the following pattern: ^([a-f0-9]{24})$.

id string Required

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

isGlobalAdmin boolean

Flag that indicates whether a MongoDB employee triggered the specified event.

links array[object]

List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

Web Linking Specification (RFC 5988)

Hide links attributes Show links attributes object

href string

Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

rel string

Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

publicKey string

Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.

External documentation

raw object

Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.

Hide raw attributes Show raw attributes object

_t string

Unique identifier of event type.

alertConfigId string

Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

cid string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred.

Format should match the following pattern: ^([a-f0-9]{24})$.

cre string(date-time)

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

description string

Description of the event.

gn string

Human-readable label that identifies the project.

Minimum length is 1, maximum length is 64.

id string

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgName string

Human-readable label that identifies the organization that contains the project.

Minimum length is 1, maximum length is 64.

severity string

Severity of the event.

Values are INFO, WARNING, ERROR, or CRITICAL.

remoteAddress string

IPv4 or IPv6 address from which the user triggered this event.

Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.

userId string

Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

username string(email)

Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
API User event identifies different activities around user api keys.

Hide attributes Show attributes

apiKeyId string

Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

Create Programmatic API Key

created string(date-time) Required

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

eventTypeName string Required

Unique identifier of event type.

Values are API_KEY_CREATED, API_KEY_DELETED, API_KEY_ACCESS_LIST_ENTRY_ADDED, API_KEY_ACCESS_LIST_ENTRY_DELETED, API_KEY_ROLES_CHANGED, API_KEY_DESCRIPTION_CHANGED, API_KEY_ADDED_TO_GROUP, API_KEY_REMOVED_FROM_GROUP, API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.

groupId string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.

Format should match the following pattern: ^([a-f0-9]{24})$.

id string Required

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

isGlobalAdmin boolean

Flag that indicates whether a MongoDB employee triggered the specified event.

links array[object]

List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

Web Linking Specification (RFC 5988)

Hide links attributes Show links attributes object

href string

Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

rel string

Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

publicKey string

Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.

External documentation

raw object

Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.

Hide raw attributes Show raw attributes object

_t string

Unique identifier of event type.

alertConfigId string

Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

cid string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred.

Format should match the following pattern: ^([a-f0-9]{24})$.

cre string(date-time)

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

description string

Description of the event.

gn string

Human-readable label that identifies the project.

Minimum length is 1, maximum length is 64.

id string

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgName string

Human-readable label that identifies the organization that contains the project.

Minimum length is 1, maximum length is 64.

severity string

Severity of the event.

Values are INFO, WARNING, ERROR, or CRITICAL.

remoteAddress string

IPv4 or IPv6 address from which the user triggered this event.

Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.

userId string

Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

username string(email)

Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
Service Account event identifies different activities around user api keys.

Hide attributes Show attributes

apiKeyId string

Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

Create Programmatic API Key

created string(date-time) Required

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

eventTypeName string Required

Unique identifier of event type.

Values are SERVICE_ACCOUNT_CREATED, SERVICE_ACCOUNT_DELETED, SERVICE_ACCOUNT_ROLES_CHANGED, SERVICE_ACCOUNT_DETAILS_CHANGED, SERVICE_ACCOUNT_ADDED_TO_GROUP, SERVICE_ACCOUNT_REMOVED_FROM_GROUP, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_ADDED, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_DELETED, SERVICE_ACCOUNT_SECRET_ADDED, SERVICE_ACCOUNT_SECRET_DELETED, SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.

groupId string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.

Format should match the following pattern: ^([a-f0-9]{24})$.

id string Required

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

isGlobalAdmin boolean

Flag that indicates whether a MongoDB employee triggered the specified event.

links array[object]

List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

Web Linking Specification (RFC 5988)

Hide links attributes Show links attributes object

href string

Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

rel string

Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

publicKey string

Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.

External documentation

raw object

Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.

Hide raw attributes Show raw attributes object

_t string

Unique identifier of event type.

alertConfigId string

Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

cid string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred.

Format should match the following pattern: ^([a-f0-9]{24})$.

cre string(date-time)

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

description string

Description of the event.

gn string

Human-readable label that identifies the project.

Minimum length is 1, maximum length is 64.

id string

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgName string

Human-readable label that identifies the organization that contains the project.

Minimum length is 1, maximum length is 64.

severity string

Severity of the event.

Values are INFO, WARNING, ERROR, or CRITICAL.

remoteAddress string

IPv4 or IPv6 address from which the user triggered this event.

Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.

userId string

Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

username string(email)

Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
Billing event identifies different activities related to billing, payment or financial status change of an organization.

Hide attributes Show attributes

apiKeyId string

Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

Create Programmatic API Key

created string(date-time) Required

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

eventTypeName string Required

Unique identifier of event type.

Values are CHARGE_SUCCEEDED, CHARGE_FAILED, CHARGE_PROCESSING, CHARGE_PENDING_REVERSAL, BRAINTREE_CHARGE_FAILED, INVOICE_CLOSED, CHECK_PAYMENT_RECEIVED, WIRE_TRANSFER_PAYMENT_RECEIVED, DISCOUNT_APPLIED, CREDIT_ISSUED, CREDIT_PULLED_FWD, CREDIT_END_DATE_MODIFIED, PROMO_CODE_APPLIED, PAYMENT_FORGIVEN, REFUND_ISSUED, ACCOUNT_DOWNGRADED, ACCOUNT_UPGRADED, ACCOUNT_MODIFIED, SUPPORT_PLAN_ACTIVATED, SUPPORT_PLAN_CANCELLED, SUPPORT_PLAN_CANCELLATION_SCHEDULED, INITIATE_SALESFORCE_SERVICE_CLOUD_SYNC, INVOICE_ADDRESS_CHANGED, INVOICE_ADDRESS_ADDED, PREPAID_PLAN_ACTIVATED, ELASTIC_INVOICING_MODE_ACTIVATED, ELASTIC_INVOICING_MODE_DEACTIVATED, TERMINATE_PAID_SERVICES, BILLING_EMAIL_ADDRESS_ADDED, BILLING_EMAIL_ADDRESS_CHANGED, BILLING_EMAIL_ADDRESS_REMOVED, AWS_BILLING_ACCOUNT_CREDIT_ISSUED, GCP_BILLING_ACCOUNT_CREDIT_ISSUED, CREDIT_SFOLID_MODIFIED, PREPAID_PLAN_MODIFIED, AWS_USAGE_REPORTED, AZURE_USAGE_REPORTED, GCP_USAGE_REPORTED, BECAME_PAYING_ORG, NEW_LINKED_ORG, UNLINKED_ORG, ORG_LINKED_TO_PAYING_ORG, ORG_UNLINKED_FROM_PAYING_ORG, ORG_UNLINK_REQUESTED, ORG_UNLINK_CANCELLED, PAYMENT_UPDATED_THROUGH_API, AZURE_BILLING_ACCOUNT_CREDIT_ISSUED, CREDIT_START_DATE_MODIFIED, CREDIT_ELASTIC_INVOICING_MODIFIED, CREDIT_TYPE_MODIFIED, CREDIT_AMOUNT_CENTS_MODIFIED, CREDIT_AMOUNT_REMAINING_CENTS_MODIFIED, CREDIT_TOTAL_BILLED_CENTS_MODIFIED, CREDIT_AWS_CUSTOMER_ID_MODIFIED, CREDIT_AWS_PRODUCT_CODE_MODIFIED, CREDIT_GCP_MARKETPLACE_ENTITLEMENT_ID_MODIFIED, CREDIT_AZURE_SUBSCRIPTION_ID_MODIFIED, CREDIT_AZURE_PRIVATE_PLAN_ID_MODIFIED, TARGETED_REBILL_EXECUTED, LEGACY_REBILL_EXECUTED, EVERGREEN_DEAL_CANCELLED, GRACE_PERIOD_ACTIVATED, GRACE_PERIOD_NO_LONGER_IN_EFFECT, PENDING_DEAL_ACTIVATION_ADDED, PENDING_DEAL_ACTIVATION_CANCELED, PENDING_DEAL_APPLIED, PENDING_DEAL_ACTIVATION_FAILED, or EVERGREEN_PRIORITY_MODIFIED.

groupId string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.

Format should match the following pattern: ^([a-f0-9]{24})$.

id string Required

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

invoiceId string

Unique 24-hexadecimal digit string that identifies of the invoice associated with the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

isGlobalAdmin boolean

Flag that indicates whether a MongoDB employee triggered the specified event.

links array[object]

List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

Web Linking Specification (RFC 5988)

Hide links attributes Show links attributes object

href string

Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

rel string

Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

paymentId string

Unique 24-hexadecimal digit string that identifies the invoice payment associated with this event.

Format should match the following pattern: ^([a-f0-9]{24})$.

publicKey string

Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.

External documentation

raw object

Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.

Hide raw attributes Show raw attributes object

_t string

Unique identifier of event type.

alertConfigId string

Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

cid string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred.

Format should match the following pattern: ^([a-f0-9]{24})$.

cre string(date-time)

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

description string

Description of the event.

gn string

Human-readable label that identifies the project.

Minimum length is 1, maximum length is 64.

id string

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgName string

Human-readable label that identifies the organization that contains the project.

Minimum length is 1, maximum length is 64.

severity string

Severity of the event.

Values are INFO, WARNING, ERROR, or CRITICAL.

remoteAddress string

IPv4 or IPv6 address from which the user triggered this event.

Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.

userId string

Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

username string(email)

Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
NDS audit saving information about atlas cloud provider and other atlas related details.

Hide attributes Show attributes

apiKeyId string

Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

Create Programmatic API Key

created string(date-time) Required

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

dbUserUsername string

The username of the MongoDB User that was created, deleted, or edited.

eventTypeName string Required

Unique identifier of event type.

Value is ORG_LIMIT_UPDATED.

groupId string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.

Format should match the following pattern: ^([a-f0-9]{24})$.

id string Required

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

isGlobalAdmin boolean

Flag that indicates whether a MongoDB employee triggered the specified event.

links array[object]

List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

Web Linking Specification (RFC 5988)

Hide links attributes Show links attributes object

href string

Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

rel string

Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

publicKey string

Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.

External documentation

raw object

Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.

Hide raw attributes Show raw attributes object

_t string

Unique identifier of event type.

alertConfigId string

Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

cid string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred.

Format should match the following pattern: ^([a-f0-9]{24})$.

cre string(date-time)

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

description string

Description of the event.

gn string

Human-readable label that identifies the project.

Minimum length is 1, maximum length is 64.

id string

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgName string

Human-readable label that identifies the organization that contains the project.

Minimum length is 1, maximum length is 64.

severity string

Severity of the event.

Values are INFO, WARNING, ERROR, or CRITICAL.

remoteAddress string

IPv4 or IPv6 address from which the user triggered this event.

Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.

userId string

Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

username string(email)

Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.

whitelistEntry string

Entry in the list of source host addresses that the API key accepts and this event targets.
Org event identifies different activities and changes in an organization settings.

Hide attributes Show attributes

apiKeyId string

Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

Create Programmatic API Key

created string(date-time) Required

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

eventTypeName string Required

Unique identifier of event type.

Values are ORG_CREATED, CUSTOM_SESSION_TIMEOUT_MODIFIED, SECURITY_CONTACT_MODIFIED, ORG_CREDIT_CARD_ADDED, ORG_CREDIT_CARD_UPDATED, ORG_CREDIT_CARD_CURRENT, ORG_CREDIT_CARD_ABOUT_TO_EXPIRE, ORG_PAYPAL_LINKED, ORG_PAYPAL_UPDATED, ORG_PAYPAL_CANCELLED, ORG_OVERRIDE_PAYMENT_METHOD_ADDED, ORG_ACTIVATED, ORG_TEMPORARILY_ACTIVATED, ORG_SUSPENSION_DATE_CHANGED, ORG_SUSPENDED, ORG_ADMIN_SUSPENDED, ORG_ADMIN_LOCKED, ORG_CLUSTERS_DELETED, ORG_CLUSTERS_PAUSED, ORG_LOCKED, ORG_UNDER_FINANCIAL_PROTECTION, ORG_NO_FINANCIAL_PROTECTION, ORG_RENAMED, ALL_ORG_USERS_HAVE_MFA, ORG_USERS_WITHOUT_MFA, ORG_INVOICE_UNDER_THRESHOLD, ORG_INVOICE_OVER_THRESHOLD, ORG_DAILY_BILL_UNDER_THRESHOLD, ORG_DAILY_BILL_OVER_THRESHOLD, ORG_GROUP_CHARGES_UNDER_THRESHOLD, ORG_GROUP_CHARGES_OVER_THRESHOLD, ORG_TWO_FACTOR_AUTH_REQUIRED, ORG_TWO_FACTOR_AUTH_OPTIONAL, ORG_PUBLIC_API_ACCESS_LIST_REQUIRED, ORG_PUBLIC_API_ACCESS_LIST_NOT_REQUIRED, ORG_EMPLOYEE_ACCESS_RESTRICTED, ORG_EMPLOYEE_ACCESS_UNRESTRICTED, ORG_SFDC_ACCOUNT_ID_CHANGED, ORG_CONNECTED_TO_MLAB, ORG_DISCONNECTED_FROM_MLAB, ORG_IDP_CERTIFICATE_CURRENT, ORG_IDP_CERTIFICATE_ABOUT_TO_EXPIRE, ORG_CONNECTED_TO_VERCEL, ORG_DISCONNECTED_TO_VERCEL, ORG_CONNECTION_UNINSTALLED_FROM_VERCEL, ORG_UI_IP_ACCESS_LIST_ENABLED, ORG_UI_IP_ACCESS_LIST_DISABLED, ORG_EDITED_UI_IP_ACCESS_LIST_ENTRIES, ORG_SERVICE_ACCOUNT_MAX_SECRET_VALIDITY_EDITED, ORG_SERVICE_ACCOUNT_SECRETS_EXPIRED, ORG_SERVICE_ACCOUNT_SECRETS_NO_LONGER_EXPIRED, ORG_SERVICE_ACCOUNT_SECRETS_EXPIRING, ORG_SERVICE_ACCOUNT_SECRETS_NO_LONGER_EXPIRING, ORG_MONGODB_VERSION_EOL_EXTENSION_ACCEPTED, ORG_MONGODB_VERSION_EOL_EXTENSION_PENDING, ORG_MONGODB_VERSION_EOL_EXTENSION_CANCELLED, GROUP_MOVED_FROM_ORG, SANDBOX_ENABLED_FOR_ORG, or SANDBOX_DISABLED_FOR_ORG.

groupId string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.

Format should match the following pattern: ^([a-f0-9]{24})$.

id string Required

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

invoiceId string

Unique 24-hexadecimal digit string that identifies of the invoice associated with the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

isGlobalAdmin boolean

Flag that indicates whether a MongoDB employee triggered the specified event.

links array[object]

List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

Web Linking Specification (RFC 5988)

Hide links attributes Show links attributes object

href string

Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

rel string

Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

publicKey string

Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.

External documentation

raw object

Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.

Hide raw attributes Show raw attributes object

_t string

Unique identifier of event type.

alertConfigId string

Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

cid string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred.

Format should match the following pattern: ^([a-f0-9]{24})$.

cre string(date-time)

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

description string

Description of the event.

gn string

Human-readable label that identifies the project.

Minimum length is 1, maximum length is 64.

id string

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgName string

Human-readable label that identifies the organization that contains the project.

Minimum length is 1, maximum length is 64.

severity string

Severity of the event.

Values are INFO, WARNING, ERROR, or CRITICAL.

remoteAddress string

IPv4 or IPv6 address from which the user triggered this event.

Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.

userId string

Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

username string(email)

Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
Team event identifies different activities around organization teams.

Hide attributes Show attributes

apiKeyId string

Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

Create Programmatic API Key

created string(date-time) Required

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

eventTypeName string Required

Unique identifier of event type.

Values are TEAM_CREATED, TEAM_DELETED, TEAM_UPDATED, TEAM_NAME_CHANGED, TEAM_ADDED_TO_GROUP, TEAM_REMOVED_FROM_GROUP, or TEAM_ROLES_MODIFIED.

groupId string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.

Format should match the following pattern: ^([a-f0-9]{24})$.

id string Required

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

isGlobalAdmin boolean

Flag that indicates whether a MongoDB employee triggered the specified event.

links array[object]

List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

Web Linking Specification (RFC 5988)

Hide links attributes Show links attributes object

href string

Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

rel string

Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

publicKey string

Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.

External documentation

raw object

Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.

Hide raw attributes Show raw attributes object

_t string

Unique identifier of event type.

alertConfigId string

Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

cid string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred.

Format should match the following pattern: ^([a-f0-9]{24})$.

cre string(date-time)

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

description string

Description of the event.

gn string

Human-readable label that identifies the project.

Minimum length is 1, maximum length is 64.

id string

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgName string

Human-readable label that identifies the organization that contains the project.

Minimum length is 1, maximum length is 64.

severity string

Severity of the event.

Values are INFO, WARNING, ERROR, or CRITICAL.

remoteAddress string

IPv4 or IPv6 address from which the user triggered this event.

Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.

teamId string

Unique 24-hexadecimal digit string that identifies the organization team associated with this event.

Format should match the following pattern: ^([a-f0-9]{24})$.

userId string

Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

username string(email)

Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
User event reflects different activities about the atlas user.

Hide attributes Show attributes

apiKeyId string

Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

Create Programmatic API Key

created string(date-time) Required

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

eventTypeName string Required

Unique identifier of event type.

Values are JOINED_ORG, JOINED_TEAM, INVITED_TO_ORG, ORG_INVITATION_DELETED, REMOVED_FROM_ORG, REMOVED_FROM_TEAM, USER_ROLES_CHANGED_AUDIT, ORG_FLEX_CONSULTING_PURCHASED, ORG_FLEX_CONSULTING_PURCHASE_FAILED, or INVITED_TO_TEAM.

groupId string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.

Format should match the following pattern: ^([a-f0-9]{24})$.

id string Required

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

isGlobalAdmin boolean

Flag that indicates whether a MongoDB employee triggered the specified event.

links array[object]

List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

Web Linking Specification (RFC 5988)

Hide links attributes Show links attributes object

href string

Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

rel string

Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

publicKey string

Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.

External documentation

raw object

Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.

Hide raw attributes Show raw attributes object

_t string

Unique identifier of event type.

alertConfigId string

Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

cid string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred.

Format should match the following pattern: ^([a-f0-9]{24})$.

cre string(date-time)

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

description string

Description of the event.

gn string

Human-readable label that identifies the project.

Minimum length is 1, maximum length is 64.

id string

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgName string

Human-readable label that identifies the organization that contains the project.

Minimum length is 1, maximum length is 64.

severity string

Severity of the event.

Values are INFO, WARNING, ERROR, or CRITICAL.

remoteAddress string

IPv4 or IPv6 address from which the user triggered this event.

Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.

targetUsername string(email)

Email address for the console user that this event targets. The resource returns this parameter when "eventTypeName" : "USER".

userId string

Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

username string(email)

Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
Resource event reflects different activities about resources.

Hide attributes Show attributes

apiKeyId string

Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

Create Programmatic API Key

created string(date-time) Required

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

eventTypeName string Required

Unique identifier of event type.

Values are TAGS_MODIFIED or GROUP_TAGS_MODIFIED.

groupId string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.

Format should match the following pattern: ^([a-f0-9]{24})$.

id string Required

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

isGlobalAdmin boolean

Flag that indicates whether a MongoDB employee triggered the specified event.

links array[object]

List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

Web Linking Specification (RFC 5988)

Hide links attributes Show links attributes object

href string

Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

rel string

Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

publicKey string

Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.

External documentation

raw object

Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.

Hide raw attributes Show raw attributes object

_t string

Unique identifier of event type.

alertConfigId string

Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

cid string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred.

Format should match the following pattern: ^([a-f0-9]{24})$.

cre string(date-time)

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

description string

Description of the event.

gn string

Human-readable label that identifies the project.

Minimum length is 1, maximum length is 64.

id string

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgName string

Human-readable label that identifies the organization that contains the project.

Minimum length is 1, maximum length is 64.

severity string

Severity of the event.

Values are INFO, WARNING, ERROR, or CRITICAL.

remoteAddress string

IPv4 or IPv6 address from which the user triggered this event.

Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.

resourceId string

Unique 24-hexadecimal digit string that identifies the resource associated with the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

resourceType string Required

Unique identifier of resource type.

userId string

Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

username string(email)

Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
Atlas resource policy audits indicate org level changes to resource policies

Hide attributes Show attributes

apiKeyId string

Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

Create Programmatic API Key

created string(date-time) Required

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

eventTypeName string Required

Unique identifier of event type.

Values are RESOURCE_POLICY_CREATED, RESOURCE_POLICY_MODIFIED, RESOURCE_POLICY_DELETED, or RESOURCE_POLICY_VIOLATED.

groupId string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.

Format should match the following pattern: ^([a-f0-9]{24})$.

id string Required

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

isGlobalAdmin boolean

Flag that indicates whether a MongoDB employee triggered the specified event.

links array[object]

List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

Web Linking Specification (RFC 5988)

Hide links attributes Show links attributes object

href string

Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

rel string

Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

publicKey string

Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.

External documentation

raw object

Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.

Hide raw attributes Show raw attributes object

_t string

Unique identifier of event type.

alertConfigId string

Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

cid string

Unique 24-hexadecimal digit string that identifies the project in which the event occurred.

Format should match the following pattern: ^([a-f0-9]{24})$.

cre string(date-time)

Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.

ISO 8601

description string

Description of the event.

gn string

Human-readable label that identifies the project.

Minimum length is 1, maximum length is 64.

id string

Unique 24-hexadecimal digit string that identifies the event.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgId string

Unique 24-hexadecimal digit string that identifies the organization to which these events apply.

Format should match the following pattern: ^([a-f0-9]{24})$.

orgName string

Human-readable label that identifies the organization that contains the project.

Minimum length is 1, maximum length is 64.

severity string

Severity of the event.

Values are INFO, WARNING, ERROR, or CRITICAL.

remoteAddress string

IPv4 or IPv6 address from which the user triggered this event.

Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.

resourcePolicyId string

Unique 24-hexadecimal character string that identifies the resource policy.

Format should match the following pattern: ^([a-f0-9]{24})$.

userId string

Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.

Format should match the following pattern: ^([a-f0-9]{24})$.

username string(email)

Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
401 application/json

Unauthorized.
Hide response attributes Show response attributes object
- badRequestDetail object
  
  Bad request detail.
  
  Hide badRequestDetail attribute Show badRequestDetail attribute object
  
  fields array[object]
  
  Describes all violations in a client request.
  
  Hide fields attributes Show fields attributes object
  
  description string Required
  
  A description of why the request element is bad.
  
  field string Required
  
  A path that leads to a field in the request body.
- detail string
  
  Describes the specific conditions or reasons that cause each type of error.
- error integer(int32) Required
  
  HTTP status code returned with this error.
  
  External documentation
- errorCode string Required
  
  Application error code returned with this error.
- parameters array[object]
  
  Parameters used to give more information about the error.
- reason string
  
  Application error message returned with this error.
403 application/json

Forbidden.
Hide response attributes Show response attributes object
- badRequestDetail object
  
  Bad request detail.
  
  Hide badRequestDetail attribute Show badRequestDetail attribute object
  
  fields array[object]
  
  Describes all violations in a client request.
  
  Hide fields attributes Show fields attributes object
  
  description string Required
  
  A description of why the request element is bad.
  
  field string Required
  
  A path that leads to a field in the request body.
- detail string
  
  Describes the specific conditions or reasons that cause each type of error.
- error integer(int32) Required
  
  HTTP status code returned with this error.
  
  External documentation
- errorCode string Required
  
  Application error code returned with this error.
- parameters array[object]
  
  Parameters used to give more information about the error.
- reason string
  
  Application error message returned with this error.
404 application/json

Not Found.
Hide response attributes Show response attributes object
- badRequestDetail object
  
  Bad request detail.
  
  Hide badRequestDetail attribute Show badRequestDetail attribute object
  
  fields array[object]
  
  Describes all violations in a client request.
  
  Hide fields attributes Show fields attributes object
  
  description string Required
  
  A description of why the request element is bad.
  
  field string Required
  
  A path that leads to a field in the request body.
- detail string
  
  Describes the specific conditions or reasons that cause each type of error.
- error integer(int32) Required
  
  HTTP status code returned with this error.
  
  External documentation
- errorCode string Required
  
  Application error code returned with this error.
- parameters array[object]
  
  Parameters used to give more information about the error.
- reason string
  
  Application error message returned with this error.
500 application/json

Internal Server Error.
Hide response attributes Show response attributes object
- badRequestDetail object
  
  Bad request detail.
  
  Hide badRequestDetail attribute Show badRequestDetail attribute object
  
  fields array[object]
  
  Describes all violations in a client request.
  
  Hide fields attributes Show fields attributes object
  
  description string Required
  
  A description of why the request element is bad.
  
  field string Required
  
  A path that leads to a field in the request body.
- detail string
  
  Describes the specific conditions or reasons that cause each type of error.
- error integer(int32) Required
  
  HTTP status code returned with this error.
  
  External documentation
- errorCode string Required
  
  Application error code returned with this error.
- parameters array[object]
  
  Parameters used to give more information about the error.
- reason string
  
  Application error message returned with this error.

GET /api/atlas/v2/orgs/{orgId}/events/{eventId}

atlas api getOrganizationEvent --help

import (
	"os"
	"context"
	"log"
	sdk "go.mongodb.org/atlas-sdk/v20250312001/admin"
)

func main() {
	ctx := context.Background()
	clientID := os.Getenv("MONGODB_ATLAS_CLIENT_ID")
	clientSecret := os.Getenv("MONGODB_ATLAS_CLIENT_SECRET")

	client, err := sdk.NewClient(
		sdk.UseOAuthAuth(clientID, clientSecret),
		sdk.UseBaseURL(url))

	if err != nil {
		log.Fatalf("Error: %v", err)
	}

	params = &sdk.GetOrganizationEventApiParams{}
	sdkResp, httpResp, err := client.EventsApi.
		GetOrganizationEventWithParams(ctx, params).
		Execute()
}

curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
  --header "Accept: application/vnd.atlas.2025-03-12+json" \
  -X GET "https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/events/{eventId}?pretty=true"

curl --user "${PUBLIC_KEY}:${PRIVATE_KEY}" \
  --digest \
  --header "Accept: application/vnd.atlas.2025-03-12+json" \
  -X GET "https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/events/{eventId}?pretty=true"

Response examples (200)

{
  "apiKeyId": "32b6e34b3d91647abb20e7b8",
  "created": "2025-05-04T09:42:00Z",
  "eventTypeName": "FEDERATION_SETTINGS_CREATED",
  "groupId": "32b6e34b3d91647abb20e7b8",
  "id": "32b6e34b3d91647abb20e7b8",
  "isGlobalAdmin": true,
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "orgId": "32b6e34b3d91647abb20e7b8",
  "publicKey": "string",
  "raw": {
    "_t": "ALERT_AUDIT",
    "alertConfigId": "32b6e34b3d91647abb20e7b8",
    "cid": "32b6e34b3d91647abb20e7b8",
    "cre": "2025-05-04T09:42:00Z",
    "description": "Alert Acknowledged",
    "gn": "Test Project",
    "id": "32b6e34b3d91647abb20e7b8",
    "orgId": "32b6e34b3d91647abb20e7b8",
    "orgName": "Test Organization",
    "severity": "INFO"
  },
  "remoteAddress": "216.172.40.186",
  "userId": "32b6e34b3d91647abb20e7b8",
  "username": "hello@example.com"
}

{
  "alertId": "32b6e34b3d91647abb20e7b8",
  "apiKeyId": "32b6e34b3d91647abb20e7b8",
  "created": "2025-05-04T09:42:00Z",
  "eventTypeName": "ALERT_ACKNOWLEDGED_AUDIT",
  "groupId": "32b6e34b3d91647abb20e7b8",
  "id": "32b6e34b3d91647abb20e7b8",
  "isGlobalAdmin": true,
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "orgId": "32b6e34b3d91647abb20e7b8",
  "publicKey": "string",
  "raw": {
    "_t": "ALERT_AUDIT",
    "alertConfigId": "32b6e34b3d91647abb20e7b8",
    "cid": "32b6e34b3d91647abb20e7b8",
    "cre": "2025-05-04T09:42:00Z",
    "description": "Alert Acknowledged",
    "gn": "Test Project",
    "id": "32b6e34b3d91647abb20e7b8",
    "orgId": "32b6e34b3d91647abb20e7b8",
    "orgName": "Test Organization",
    "severity": "INFO"
  },
  "remoteAddress": "216.172.40.186",
  "userId": "32b6e34b3d91647abb20e7b8",
  "username": "hello@example.com"
}

{
  "alertConfigId": "32b6e34b3d91647abb20e7b8",
  "apiKeyId": "32b6e34b3d91647abb20e7b8",
  "created": "2025-05-04T09:42:00Z",
  "eventTypeName": "ALERT_CONFIG_ADDED_AUDIT",
  "groupId": "32b6e34b3d91647abb20e7b8",
  "id": "32b6e34b3d91647abb20e7b8",
  "isGlobalAdmin": true,
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "orgId": "32b6e34b3d91647abb20e7b8",
  "publicKey": "string",
  "raw": {
    "_t": "ALERT_AUDIT",
    "alertConfigId": "32b6e34b3d91647abb20e7b8",
    "cid": "32b6e34b3d91647abb20e7b8",
    "cre": "2025-05-04T09:42:00Z",
    "description": "Alert Acknowledged",
    "gn": "Test Project",
    "id": "32b6e34b3d91647abb20e7b8",
    "orgId": "32b6e34b3d91647abb20e7b8",
    "orgName": "Test Organization",
    "severity": "INFO"
  },
  "remoteAddress": "216.172.40.186",
  "userId": "32b6e34b3d91647abb20e7b8",
  "username": "hello@example.com"
}

{
  "apiKeyId": "32b6e34b3d91647abb20e7b8",
  "created": "2025-05-04T09:42:00Z",
  "eventTypeName": "API_KEY_CREATED",
  "groupId": "32b6e34b3d91647abb20e7b8",
  "id": "32b6e34b3d91647abb20e7b8",
  "isGlobalAdmin": true,
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "orgId": "32b6e34b3d91647abb20e7b8",
  "publicKey": "string",
  "raw": {
    "_t": "ALERT_AUDIT",
    "alertConfigId": "32b6e34b3d91647abb20e7b8",
    "cid": "32b6e34b3d91647abb20e7b8",
    "cre": "2025-05-04T09:42:00Z",
    "description": "Alert Acknowledged",
    "gn": "Test Project",
    "id": "32b6e34b3d91647abb20e7b8",
    "orgId": "32b6e34b3d91647abb20e7b8",
    "orgName": "Test Organization",
    "severity": "INFO"
  },
  "remoteAddress": "216.172.40.186",
  "userId": "32b6e34b3d91647abb20e7b8",
  "username": "hello@example.com"
}

{
  "apiKeyId": "32b6e34b3d91647abb20e7b8",
  "created": "2025-05-04T09:42:00Z",
  "eventTypeName": "SERVICE_ACCOUNT_CREATED",
  "groupId": "32b6e34b3d91647abb20e7b8",
  "id": "32b6e34b3d91647abb20e7b8",
  "isGlobalAdmin": true,
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "orgId": "32b6e34b3d91647abb20e7b8",
  "publicKey": "string",
  "raw": {
    "_t": "ALERT_AUDIT",
    "alertConfigId": "32b6e34b3d91647abb20e7b8",
    "cid": "32b6e34b3d91647abb20e7b8",
    "cre": "2025-05-04T09:42:00Z",
    "description": "Alert Acknowledged",
    "gn": "Test Project",
    "id": "32b6e34b3d91647abb20e7b8",
    "orgId": "32b6e34b3d91647abb20e7b8",
    "orgName": "Test Organization",
    "severity": "INFO"
  },
  "remoteAddress": "216.172.40.186",
  "userId": "32b6e34b3d91647abb20e7b8",
  "username": "hello@example.com"
}

{
  "apiKeyId": "32b6e34b3d91647abb20e7b8",
  "created": "2025-05-04T09:42:00Z",
  "eventTypeName": "CHARGE_SUCCEEDED",
  "groupId": "32b6e34b3d91647abb20e7b8",
  "id": "32b6e34b3d91647abb20e7b8",
  "invoiceId": "32b6e34b3d91647abb20e7b8",
  "isGlobalAdmin": true,
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "orgId": "32b6e34b3d91647abb20e7b8",
  "paymentId": "32b6e34b3d91647abb20e7b8",
  "publicKey": "string",
  "raw": {
    "_t": "ALERT_AUDIT",
    "alertConfigId": "32b6e34b3d91647abb20e7b8",
    "cid": "32b6e34b3d91647abb20e7b8",
    "cre": "2025-05-04T09:42:00Z",
    "description": "Alert Acknowledged",
    "gn": "Test Project",
    "id": "32b6e34b3d91647abb20e7b8",
    "orgId": "32b6e34b3d91647abb20e7b8",
    "orgName": "Test Organization",
    "severity": "INFO"
  },
  "remoteAddress": "216.172.40.186",
  "userId": "32b6e34b3d91647abb20e7b8",
  "username": "hello@example.com"
}

{
  "apiKeyId": "32b6e34b3d91647abb20e7b8",
  "created": "2025-05-04T09:42:00Z",
  "dbUserUsername": "user1",
  "eventTypeName": "ORG_LIMIT_UPDATED",
  "groupId": "32b6e34b3d91647abb20e7b8",
  "id": "32b6e34b3d91647abb20e7b8",
  "isGlobalAdmin": true,
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "orgId": "32b6e34b3d91647abb20e7b8",
  "publicKey": "string",
  "raw": {
    "_t": "ALERT_AUDIT",
    "alertConfigId": "32b6e34b3d91647abb20e7b8",
    "cid": "32b6e34b3d91647abb20e7b8",
    "cre": "2025-05-04T09:42:00Z",
    "description": "Alert Acknowledged",
    "gn": "Test Project",
    "id": "32b6e34b3d91647abb20e7b8",
    "orgId": "32b6e34b3d91647abb20e7b8",
    "orgName": "Test Organization",
    "severity": "INFO"
  },
  "remoteAddress": "216.172.40.186",
  "userId": "32b6e34b3d91647abb20e7b8",
  "username": "hello@example.com",
  "whitelistEntry": "0.0.0.0"
}

{
  "apiKeyId": "32b6e34b3d91647abb20e7b8",
  "created": "2025-05-04T09:42:00Z",
  "eventTypeName": "ORG_CREATED",
  "groupId": "32b6e34b3d91647abb20e7b8",
  "id": "32b6e34b3d91647abb20e7b8",
  "invoiceId": "32b6e34b3d91647abb20e7b8",
  "isGlobalAdmin": true,
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "orgId": "32b6e34b3d91647abb20e7b8",
  "publicKey": "string",
  "raw": {
    "_t": "ALERT_AUDIT",
    "alertConfigId": "32b6e34b3d91647abb20e7b8",
    "cid": "32b6e34b3d91647abb20e7b8",
    "cre": "2025-05-04T09:42:00Z",
    "description": "Alert Acknowledged",
    "gn": "Test Project",
    "id": "32b6e34b3d91647abb20e7b8",
    "orgId": "32b6e34b3d91647abb20e7b8",
    "orgName": "Test Organization",
    "severity": "INFO"
  },
  "remoteAddress": "216.172.40.186",
  "userId": "32b6e34b3d91647abb20e7b8",
  "username": "hello@example.com"
}

{
  "apiKeyId": "32b6e34b3d91647abb20e7b8",
  "created": "2025-05-04T09:42:00Z",
  "eventTypeName": "TEAM_ADDED_TO_GROUP",
  "groupId": "32b6e34b3d91647abb20e7b8",
  "id": "32b6e34b3d91647abb20e7b8",
  "isGlobalAdmin": true,
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "orgId": "32b6e34b3d91647abb20e7b8",
  "publicKey": "string",
  "raw": {
    "_t": "ALERT_AUDIT",
    "alertConfigId": "32b6e34b3d91647abb20e7b8",
    "cid": "32b6e34b3d91647abb20e7b8",
    "cre": "2025-05-04T09:42:00Z",
    "description": "Alert Acknowledged",
    "gn": "Test Project",
    "id": "32b6e34b3d91647abb20e7b8",
    "orgId": "32b6e34b3d91647abb20e7b8",
    "orgName": "Test Organization",
    "severity": "INFO"
  },
  "remoteAddress": "216.172.40.186",
  "teamId": "32b6e34b3d91647abb20e7b8",
  "userId": "32b6e34b3d91647abb20e7b8",
  "username": "hello@example.com"
}

{
  "apiKeyId": "32b6e34b3d91647abb20e7b8",
  "created": "2025-05-04T09:42:00Z",
  "eventTypeName": "JOINED_ORG",
  "groupId": "32b6e34b3d91647abb20e7b8",
  "id": "32b6e34b3d91647abb20e7b8",
  "isGlobalAdmin": true,
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "orgId": "32b6e34b3d91647abb20e7b8",
  "publicKey": "string",
  "raw": {
    "_t": "ALERT_AUDIT",
    "alertConfigId": "32b6e34b3d91647abb20e7b8",
    "cid": "32b6e34b3d91647abb20e7b8",
    "cre": "2025-05-04T09:42:00Z",
    "description": "Alert Acknowledged",
    "gn": "Test Project",
    "id": "32b6e34b3d91647abb20e7b8",
    "orgId": "32b6e34b3d91647abb20e7b8",
    "orgName": "Test Organization",
    "severity": "INFO"
  },
  "remoteAddress": "216.172.40.186",
  "targetUsername": "test.user@mongodb.com",
  "userId": "32b6e34b3d91647abb20e7b8",
  "username": "hello@example.com"
}

{
  "apiKeyId": "32b6e34b3d91647abb20e7b8",
  "created": "2025-05-04T09:42:00Z",
  "eventTypeName": "GROUP_TAGS_MODIFIED",
  "groupId": "32b6e34b3d91647abb20e7b8",
  "id": "32b6e34b3d91647abb20e7b8",
  "isGlobalAdmin": true,
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "orgId": "32b6e34b3d91647abb20e7b8",
  "publicKey": "string",
  "raw": {
    "_t": "ALERT_AUDIT",
    "alertConfigId": "32b6e34b3d91647abb20e7b8",
    "cid": "32b6e34b3d91647abb20e7b8",
    "cre": "2025-05-04T09:42:00Z",
    "description": "Alert Acknowledged",
    "gn": "Test Project",
    "id": "32b6e34b3d91647abb20e7b8",
    "orgId": "32b6e34b3d91647abb20e7b8",
    "orgName": "Test Organization",
    "severity": "INFO"
  },
  "remoteAddress": "216.172.40.186",
  "resourceId": "32b6e34b3d91647abb20e7b8",
  "resourceType": "cluster",
  "userId": "32b6e34b3d91647abb20e7b8",
  "username": "hello@example.com"
}

{
  "apiKeyId": "32b6e34b3d91647abb20e7b8",
  "created": "2025-05-04T09:42:00Z",
  "eventTypeName": "RESOURCE_POLICY_CREATED",
  "groupId": "32b6e34b3d91647abb20e7b8",
  "id": "32b6e34b3d91647abb20e7b8",
  "isGlobalAdmin": true,
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "orgId": "32b6e34b3d91647abb20e7b8",
  "publicKey": "string",
  "raw": {
    "_t": "ALERT_AUDIT",
    "alertConfigId": "32b6e34b3d91647abb20e7b8",
    "cid": "32b6e34b3d91647abb20e7b8",
    "cre": "2025-05-04T09:42:00Z",
    "description": "Alert Acknowledged",
    "gn": "Test Project",
    "id": "32b6e34b3d91647abb20e7b8",
    "orgId": "32b6e34b3d91647abb20e7b8",
    "orgName": "Test Organization",
    "severity": "INFO"
  },
  "remoteAddress": "216.172.40.186",
  "resourcePolicyId": "32b6e34b3d91647abb20e7b8",
  "userId": "32b6e34b3d91647abb20e7b8",
  "username": "hello@example.com"
}

Response examples (401)

{
  "error": 401,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Unauthorized",
  "errorCode": "NOT_ORG_GROUP_CREATOR"
}

Response examples (403)

{
  "error": 403,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Forbidden",
  "errorCode": "CANNOT_CHANGE_GROUP_NAME"
}

Response examples (404)

{
  "error": 404,
  "detail": "(This is just an example, the exception may not be related to this endpoint) Cannot find resource AWS",
  "reason": "Not Found",
  "errorCode": "RESOURCE_NOT_FOUND"
}

Response examples (500)

{
  "error": 500,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Internal Server Error",
  "errorCode": "UNEXPECTED_ERROR"
}