Return Events from One Organization

GET /api/atlas/v2/orgs/{orgId}/events

Returns events for the specified organization. Events identify significant database, billing, or security activities or status changes. To use this resource, the requesting Service Account or API Key must have the Organization Member role.

This resource remains under revision and may change.

Path parameters

orgId string Required

Unique 24-hexadecimal digit string that identifies the organization that contains your projects. Use the /orgs endpoint to retrieve all organizations to which the authenticated user has access.

Format should match the following pattern: ^([a-f0-9]{24})$.

Query parameters

envelope boolean

Flag that indicates whether Application wraps the response in an envelope JSON object. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. Endpoints that return a list of results use the results object as an envelope. Application adds the status parameter to the response body.

Default value is false.
includeCount boolean

Flag that indicates whether the response returns the total number of items (totalCount) in the response.

Default value is true.
itemsPerPage integer

Number of items that the response returns per page.

Minimum value is 1, maximum value is 500. Default value is 100.
pageNum integer

Number of the page that displays the current set of the total objects that the response returns.

Minimum value is 1. Default value is 1.
pretty boolean

Flag that indicates whether the response body should be in the prettyprint format.

Default value is false.

Prettyprint
eventType array[object | string]

Category of incident recorded at this moment in time.

IMPORTANT: The complete list of event type values changes frequently.

One of:
EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string EventTypeForOrg string

Values are ALERT_ACKNOWLEDGED_AUDIT or ALERT_UNACKNOWLEDGED_AUDIT.

Values are SERVICE_ACCOUNT_CREATED, SERVICE_ACCOUNT_DELETED, SERVICE_ACCOUNT_ROLES_CHANGED, SERVICE_ACCOUNT_DETAILS_CHANGED, SERVICE_ACCOUNT_ADDED_TO_GROUP, SERVICE_ACCOUNT_REMOVED_FROM_GROUP, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_ADDED, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_DELETED, SERVICE_ACCOUNT_SECRET_ADDED, SERVICE_ACCOUNT_SECRET_DELETED, SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.

Values are CHARGE_SUCCEEDED, CHARGE_FAILED, CHARGE_PROCESSING, CHARGE_PENDING_REVERSAL, BRAINTREE_CHARGE_FAILED, INVOICE_CLOSED, CHECK_PAYMENT_RECEIVED, WIRE_TRANSFER_PAYMENT_RECEIVED, DISCOUNT_APPLIED, CREDIT_ISSUED, CREDIT_PULLED_FWD, CREDIT_END_DATE_MODIFIED, PROMO_CODE_APPLIED, PAYMENT_FORGIVEN, REFUND_ISSUED, ACCOUNT_DOWNGRADED, ACCOUNT_UPGRADED, ACCOUNT_MODIFIED, SUPPORT_PLAN_ACTIVATED, SUPPORT_PLAN_CANCELLED, SUPPORT_PLAN_CANCELLATION_SCHEDULED, INITIATE_SALESFORCE_SERVICE_CLOUD_SYNC, INVOICE_ADDRESS_CHANGED, INVOICE_ADDRESS_ADDED, PREPAID_PLAN_ACTIVATED, ELASTIC_INVOICING_MODE_ACTIVATED, ELASTIC_INVOICING_MODE_DEACTIVATED, TERMINATE_PAID_SERVICES, BILLING_EMAIL_ADDRESS_ADDED, BILLING_EMAIL_ADDRESS_CHANGED, BILLING_EMAIL_ADDRESS_REMOVED, AWS_BILLING_ACCOUNT_CREDIT_ISSUED, GCP_BILLING_ACCOUNT_CREDIT_ISSUED, CREDIT_SFOLID_MODIFIED, PREPAID_PLAN_MODIFIED, AWS_USAGE_REPORTED, AZURE_USAGE_REPORTED, GCP_USAGE_REPORTED, BECAME_PAYING_ORG, NEW_LINKED_ORG, UNLINKED_ORG, ORG_LINKED_TO_PAYING_ORG, ORG_UNLINKED_FROM_PAYING_ORG, ORG_UNLINK_REQUESTED, ORG_UNLINK_CANCELLED, PAYMENT_UPDATED_THROUGH_API, AZURE_BILLING_ACCOUNT_CREDIT_ISSUED, CREDIT_START_DATE_MODIFIED, CREDIT_ELASTIC_INVOICING_MODIFIED, CREDIT_TYPE_MODIFIED, CREDIT_AMOUNT_CENTS_MODIFIED, CREDIT_AMOUNT_REMAINING_CENTS_MODIFIED, CREDIT_TOTAL_BILLED_CENTS_MODIFIED, CREDIT_AWS_CUSTOMER_ID_MODIFIED, CREDIT_AWS_PRODUCT_CODE_MODIFIED, CREDIT_GCP_MARKETPLACE_ENTITLEMENT_ID_MODIFIED, CREDIT_AZURE_SUBSCRIPTION_ID_MODIFIED, CREDIT_AZURE_PRIVATE_PLAN_ID_MODIFIED, TARGETED_REBILL_EXECUTED, LEGACY_REBILL_EXECUTED, EVERGREEN_DEAL_CANCELLED, GRACE_PERIOD_ACTIVATED, GRACE_PERIOD_NO_LONGER_IN_EFFECT, PENDING_DEAL_ACTIVATION_ADDED, PENDING_DEAL_ACTIVATION_CANCELED, PENDING_DEAL_APPLIED, PENDING_DEAL_ACTIVATION_FAILED, or EVERGREEN_PRIORITY_MODIFIED.

Values are FEDERATION_SETTINGS_CREATED, FEDERATION_SETTINGS_DELETED, FEDERATION_SETTINGS_UPDATED, IDENTITY_PROVIDER_CREATED, IDENTITY_PROVIDER_UPDATED, IDENTITY_PROVIDER_DELETED, IDENTITY_PROVIDER_ACTIVATED, OIDC_IDENTITY_PROVIDER_UPDATED, IDENTITY_PROVIDER_DEACTIVATED, IDENTITY_PROVIDER_JWKS_REVOKED, OIDC_IDENTITY_PROVIDER_ENABLED, OIDC_IDENTITY_PROVIDER_DISABLED, DOMAINS_ASSOCIATED, DOMAIN_CREATED, DOMAIN_DELETED, DOMAIN_VERIFIED, ORG_SETTINGS_CONFIGURED, ORG_SETTINGS_UPDATED, ORG_SETTINGS_DELETED, RESTRICT_ORG_MEMBERSHIP_ENABLED, RESTRICT_ORG_MEMBERSHIP_DISABLED, ROLE_MAPPING_CREATED, ROLE_MAPPING_UPDATED, or ROLE_MAPPING_DELETED.

Values are MLAB_MIGRATION_COMPLETED, MLAB_MIGRATION_TARGET_CLUSTER_CREATED, MLAB_MIGRATION_DATABASE_USERS_IMPORTED, MLAB_MIGRATION_IP_WHITELIST_IMPORTED, MLAB_MIGRATION_TARGET_CLUSTER_SET, MLAB_MIGRATION_DATABASE_RENAMED, MLAB_MIGRATION_LIVE_IMPORT_STARTED, MLAB_MIGRATION_LIVE_IMPORT_READY_FOR_CUTOVER, MLAB_MIGRATION_LIVE_IMPORT_CUTOVER_COMPLETE, MLAB_MIGRATION_LIVE_IMPORT_ERROR, MLAB_MIGRATION_LIVE_IMPORT_CANCELLED, MLAB_MIGRATION_DUMP_AND_RESTORE_TEST_STARTED, MLAB_MIGRATION_DUMP_AND_RESTORE_TEST_SKIPPED, MLAB_MIGRATION_DUMP_AND_RESTORE_STARTED, MLAB_MIGRATION_SUPPORT_PLAN_SELECTED, or MLAB_MIGRATION_SUPPORT_PLAN_OPTED_OUT.

Values are ORG_CREATED, CUSTOM_SESSION_TIMEOUT_MODIFIED, SECURITY_CONTACT_MODIFIED, ORG_CREDIT_CARD_ADDED, ORG_CREDIT_CARD_UPDATED, ORG_CREDIT_CARD_CURRENT, ORG_CREDIT_CARD_ABOUT_TO_EXPIRE, ORG_PAYPAL_LINKED, ORG_PAYPAL_UPDATED, ORG_PAYPAL_CANCELLED, ORG_OVERRIDE_PAYMENT_METHOD_ADDED, ORG_ACTIVATED, ORG_TEMPORARILY_ACTIVATED, ORG_SUSPENSION_DATE_CHANGED, ORG_SUSPENDED, ORG_ADMIN_SUSPENDED, ORG_ADMIN_LOCKED, ORG_CLUSTERS_DELETED, ORG_CLUSTERS_PAUSED, ORG_LOCKED, ORG_UNDER_FINANCIAL_PROTECTION, ORG_NO_FINANCIAL_PROTECTION, ORG_RENAMED, ALL_ORG_USERS_HAVE_MFA, ORG_USERS_WITHOUT_MFA, ORG_INVOICE_UNDER_THRESHOLD, ORG_INVOICE_OVER_THRESHOLD, ORG_DAILY_BILL_UNDER_THRESHOLD, ORG_DAILY_BILL_OVER_THRESHOLD, ORG_GROUP_CHARGES_UNDER_THRESHOLD, ORG_GROUP_CHARGES_OVER_THRESHOLD, ORG_TWO_FACTOR_AUTH_REQUIRED, ORG_TWO_FACTOR_AUTH_OPTIONAL, ORG_PUBLIC_API_ACCESS_LIST_REQUIRED, ORG_PUBLIC_API_ACCESS_LIST_NOT_REQUIRED, ORG_EMPLOYEE_ACCESS_RESTRICTED, ORG_EMPLOYEE_ACCESS_UNRESTRICTED, ORG_SFDC_ACCOUNT_ID_CHANGED, ORG_CONNECTED_TO_MLAB, ORG_DISCONNECTED_FROM_MLAB, ORG_IDP_CERTIFICATE_CURRENT, ORG_IDP_CERTIFICATE_ABOUT_TO_EXPIRE, ORG_CONNECTED_TO_VERCEL, ORG_DISCONNECTED_TO_VERCEL, ORG_CONNECTION_UNINSTALLED_FROM_VERCEL, ORG_UI_IP_ACCESS_LIST_ENABLED, ORG_UI_IP_ACCESS_LIST_DISABLED, ORG_EDITED_UI_IP_ACCESS_LIST_ENTRIES, ORG_SERVICE_ACCOUNT_MAX_SECRET_VALIDITY_EDITED, ORG_SERVICE_ACCOUNT_SECRETS_EXPIRED, ORG_SERVICE_ACCOUNT_SECRETS_NO_LONGER_EXPIRED, ORG_SERVICE_ACCOUNT_SECRETS_EXPIRING, ORG_SERVICE_ACCOUNT_SECRETS_NO_LONGER_EXPIRING, ORG_MONGODB_VERSION_EOL_EXTENSION_ACCEPTED, ORG_MONGODB_VERSION_EOL_EXTENSION_PENDING, ORG_MONGODB_VERSION_EOL_EXTENSION_CANCELLED, GROUP_MOVED_FROM_ORG, SANDBOX_ENABLED_FOR_ORG, or SANDBOX_DISABLED_FOR_ORG.

Values are AWS_SELF_SERVE_ACCOUNT_LINKED, AWS_SELF_SERVE_ACCOUNT_LINK_PENDING, AWS_SELF_SERVE_ACCOUNT_CANCELLED, AWS_SELF_SERVE_ACCOUNT_LINK_FAILED, GCP_SELF_SERVE_ACCOUNT_LINK_PENDING, GCP_SELF_SERVE_ACCOUNT_LINK_FAILED, AZURE_SELF_SERVE_ACCOUNT_LINKED, AZURE_SELF_SERVE_ACCOUNT_LINK_PENDING, AZURE_SELF_SERVE_ACCOUNT_CANCELLED, AZURE_SELF_SERVE_ACCOUNT_LINK_FAILED, GCP_SELF_SERVE_ACCOUNT_LINKED, GCP_SELF_SERVE_ACCOUNT_CANCELLED, VERCEL_SELF_SERVE_ACCOUNT_LINKED, VERCEL_SELF_SERVE_ACCOUNT_LINK_PENDING, VERCEL_SELF_SERVE_ACCOUNT_CANCELLED, VERCEL_SELF_SERVE_ACCOUNT_LINK_FAILED, VERCEL_INVOICE_CREATED, VERCEL_INVOICE_NOT_PAID, VERCEL_INVOICE_PAID, or VERCEL_INVOICE_REFUNDED.
includeRaw boolean

Flag that indicates whether to include the raw document in the output. The raw document contains additional meta information about the event.

Default value is false.
maxDate string(date-time)

Date and time from when MongoDB Cloud stops returning events. This parameter uses the ISO 8601 timestamp format in UTC.

ISO 8601
minDate string(date-time)

Date and time from when MongoDB Cloud starts returning events. This parameter uses the ISO 8601 timestamp format in UTC.

ISO 8601

Responses

200 application/vnd.atlas.2023-01-01+json

OK
Hide response attributes Show response attributes object
- links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
- results array[object]
  
  List of returned documents that MongoDB Cloud provides when completing this request.
  
  One of:
  DefaultEventViewForOrg object AlertAudit object AlertConfigAudit object ApiUserEventViewForOrg object ServiceAccountOrgEvents object BillingEventViewForOrg object NDSAuditViewForOrg object OrgEventViewForOrg object TeamEvent object UserEventViewForOrg object ResourceEventViewForOrg object AtlasResourcePolicyAuditForOrg object
  
  Other events which don't have extra details beside of basic one.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  Create Programmatic API Key
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  One of:
  Federation Settings Event Types string Group Audit Types string Mlab Migration Audit Types string Partner Event Types string Support Event Types string
  
  Values are FEDERATION_SETTINGS_CREATED, FEDERATION_SETTINGS_DELETED, FEDERATION_SETTINGS_UPDATED, IDENTITY_PROVIDER_CREATED, IDENTITY_PROVIDER_UPDATED, IDENTITY_PROVIDER_DELETED, IDENTITY_PROVIDER_ACTIVATED, OIDC_IDENTITY_PROVIDER_UPDATED, IDENTITY_PROVIDER_DEACTIVATED, IDENTITY_PROVIDER_JWKS_REVOKED, OIDC_IDENTITY_PROVIDER_ENABLED, OIDC_IDENTITY_PROVIDER_DISABLED, DOMAINS_ASSOCIATED, DOMAIN_CREATED, DOMAIN_DELETED, DOMAIN_VERIFIED, ORG_SETTINGS_CONFIGURED, ORG_SETTINGS_UPDATED, ORG_SETTINGS_DELETED, RESTRICT_ORG_MEMBERSHIP_ENABLED, RESTRICT_ORG_MEMBERSHIP_DISABLED, ROLE_MAPPING_CREATED, ROLE_MAPPING_UPDATED, or ROLE_MAPPING_DELETED.
  
  Values are MLAB_MIGRATION_COMPLETED, MLAB_MIGRATION_TARGET_CLUSTER_CREATED, MLAB_MIGRATION_DATABASE_USERS_IMPORTED, MLAB_MIGRATION_IP_WHITELIST_IMPORTED, MLAB_MIGRATION_TARGET_CLUSTER_SET, MLAB_MIGRATION_DATABASE_RENAMED, MLAB_MIGRATION_LIVE_IMPORT_STARTED, MLAB_MIGRATION_LIVE_IMPORT_READY_FOR_CUTOVER, MLAB_MIGRATION_LIVE_IMPORT_CUTOVER_COMPLETE, MLAB_MIGRATION_LIVE_IMPORT_ERROR, MLAB_MIGRATION_LIVE_IMPORT_CANCELLED, MLAB_MIGRATION_DUMP_AND_RESTORE_TEST_STARTED, MLAB_MIGRATION_DUMP_AND_RESTORE_TEST_SKIPPED, MLAB_MIGRATION_DUMP_AND_RESTORE_STARTED, MLAB_MIGRATION_SUPPORT_PLAN_SELECTED, or MLAB_MIGRATION_SUPPORT_PLAN_OPTED_OUT.
  
  Values are AWS_SELF_SERVE_ACCOUNT_LINKED, AWS_SELF_SERVE_ACCOUNT_LINK_PENDING, AWS_SELF_SERVE_ACCOUNT_CANCELLED, AWS_SELF_SERVE_ACCOUNT_LINK_FAILED, GCP_SELF_SERVE_ACCOUNT_LINK_PENDING, GCP_SELF_SERVE_ACCOUNT_LINK_FAILED, AZURE_SELF_SERVE_ACCOUNT_LINKED, AZURE_SELF_SERVE_ACCOUNT_LINK_PENDING, AZURE_SELF_SERVE_ACCOUNT_CANCELLED, AZURE_SELF_SERVE_ACCOUNT_LINK_FAILED, GCP_SELF_SERVE_ACCOUNT_LINKED, GCP_SELF_SERVE_ACCOUNT_CANCELLED, VERCEL_SELF_SERVE_ACCOUNT_LINKED, VERCEL_SELF_SERVE_ACCOUNT_LINK_PENDING, VERCEL_SELF_SERVE_ACCOUNT_CANCELLED, VERCEL_SELF_SERVE_ACCOUNT_LINK_FAILED, VERCEL_INVOICE_CREATED, VERCEL_INVOICE_NOT_PAID, VERCEL_INVOICE_PAID, or VERCEL_INVOICE_REFUNDED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string
  
  Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  External documentation
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  Alert audit indicates acknowledgement status of an alert.
  
  Hide attributes Show attributes
  
  alertId string
  
  Unique 24-hexadecimal digit string that identifies the alert associated with the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  Create Programmatic API Key
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are ALERT_ACKNOWLEDGED_AUDIT or ALERT_UNACKNOWLEDGED_AUDIT.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string
  
  Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  External documentation
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  Alert config audit indicates any activities around alert settings.
  
  Hide attributes Show attributes
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration associated with the alertId.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  Create Programmatic API Key
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are ALERT_CONFIG_DISABLED_AUDIT, ALERT_CONFIG_ENABLED_AUDIT, ALERT_CONFIG_ADDED_AUDIT, ALERT_CONFIG_DELETED_AUDIT, or ALERT_CONFIG_CHANGED_AUDIT.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string
  
  Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  External documentation
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  API User event identifies different activities around user api keys.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  Create Programmatic API Key
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are API_KEY_CREATED, API_KEY_DELETED, API_KEY_ACCESS_LIST_ENTRY_ADDED, API_KEY_ACCESS_LIST_ENTRY_DELETED, API_KEY_ROLES_CHANGED, API_KEY_DESCRIPTION_CHANGED, API_KEY_ADDED_TO_GROUP, API_KEY_REMOVED_FROM_GROUP, API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string
  
  Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  External documentation
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  Service Account event identifies different activities around user api keys.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  Create Programmatic API Key
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are SERVICE_ACCOUNT_CREATED, SERVICE_ACCOUNT_DELETED, SERVICE_ACCOUNT_ROLES_CHANGED, SERVICE_ACCOUNT_DETAILS_CHANGED, SERVICE_ACCOUNT_ADDED_TO_GROUP, SERVICE_ACCOUNT_REMOVED_FROM_GROUP, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_ADDED, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_DELETED, SERVICE_ACCOUNT_SECRET_ADDED, SERVICE_ACCOUNT_SECRET_DELETED, SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string
  
  Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  External documentation
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  Billing event identifies different activities related to billing, payment or financial status change of an organization.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  Create Programmatic API Key
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are CHARGE_SUCCEEDED, CHARGE_FAILED, CHARGE_PROCESSING, CHARGE_PENDING_REVERSAL, BRAINTREE_CHARGE_FAILED, INVOICE_CLOSED, CHECK_PAYMENT_RECEIVED, WIRE_TRANSFER_PAYMENT_RECEIVED, DISCOUNT_APPLIED, CREDIT_ISSUED, CREDIT_PULLED_FWD, CREDIT_END_DATE_MODIFIED, PROMO_CODE_APPLIED, PAYMENT_FORGIVEN, REFUND_ISSUED, ACCOUNT_DOWNGRADED, ACCOUNT_UPGRADED, ACCOUNT_MODIFIED, SUPPORT_PLAN_ACTIVATED, SUPPORT_PLAN_CANCELLED, SUPPORT_PLAN_CANCELLATION_SCHEDULED, INITIATE_SALESFORCE_SERVICE_CLOUD_SYNC, INVOICE_ADDRESS_CHANGED, INVOICE_ADDRESS_ADDED, PREPAID_PLAN_ACTIVATED, ELASTIC_INVOICING_MODE_ACTIVATED, ELASTIC_INVOICING_MODE_DEACTIVATED, TERMINATE_PAID_SERVICES, BILLING_EMAIL_ADDRESS_ADDED, BILLING_EMAIL_ADDRESS_CHANGED, BILLING_EMAIL_ADDRESS_REMOVED, AWS_BILLING_ACCOUNT_CREDIT_ISSUED, GCP_BILLING_ACCOUNT_CREDIT_ISSUED, CREDIT_SFOLID_MODIFIED, PREPAID_PLAN_MODIFIED, AWS_USAGE_REPORTED, AZURE_USAGE_REPORTED, GCP_USAGE_REPORTED, BECAME_PAYING_ORG, NEW_LINKED_ORG, UNLINKED_ORG, ORG_LINKED_TO_PAYING_ORG, ORG_UNLINKED_FROM_PAYING_ORG, ORG_UNLINK_REQUESTED, ORG_UNLINK_CANCELLED, PAYMENT_UPDATED_THROUGH_API, AZURE_BILLING_ACCOUNT_CREDIT_ISSUED, CREDIT_START_DATE_MODIFIED, CREDIT_ELASTIC_INVOICING_MODIFIED, CREDIT_TYPE_MODIFIED, CREDIT_AMOUNT_CENTS_MODIFIED, CREDIT_AMOUNT_REMAINING_CENTS_MODIFIED, CREDIT_TOTAL_BILLED_CENTS_MODIFIED, CREDIT_AWS_CUSTOMER_ID_MODIFIED, CREDIT_AWS_PRODUCT_CODE_MODIFIED, CREDIT_GCP_MARKETPLACE_ENTITLEMENT_ID_MODIFIED, CREDIT_AZURE_SUBSCRIPTION_ID_MODIFIED, CREDIT_AZURE_PRIVATE_PLAN_ID_MODIFIED, TARGETED_REBILL_EXECUTED, LEGACY_REBILL_EXECUTED, EVERGREEN_DEAL_CANCELLED, GRACE_PERIOD_ACTIVATED, GRACE_PERIOD_NO_LONGER_IN_EFFECT, PENDING_DEAL_ACTIVATION_ADDED, PENDING_DEAL_ACTIVATION_CANCELED, PENDING_DEAL_APPLIED, PENDING_DEAL_ACTIVATION_FAILED, or EVERGREEN_PRIORITY_MODIFIED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  invoiceId string
  
  Unique 24-hexadecimal digit string that identifies of the invoice associated with the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  paymentId string
  
  Unique 24-hexadecimal digit string that identifies the invoice payment associated with this event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string
  
  Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  External documentation
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  NDS audit saving information about atlas cloud provider and other atlas related details.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  Create Programmatic API Key
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  dbUserUsername string
  
  The username of the MongoDB User that was created, deleted, or edited.
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Value is ORG_LIMIT_UPDATED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string
  
  Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  External documentation
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  whitelistEntry string
  
  Entry in the list of source host addresses that the API key accepts and this event targets.
  
  Org event identifies different activities and changes in an organization settings.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  Create Programmatic API Key
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are ORG_CREATED, CUSTOM_SESSION_TIMEOUT_MODIFIED, SECURITY_CONTACT_MODIFIED, ORG_CREDIT_CARD_ADDED, ORG_CREDIT_CARD_UPDATED, ORG_CREDIT_CARD_CURRENT, ORG_CREDIT_CARD_ABOUT_TO_EXPIRE, ORG_PAYPAL_LINKED, ORG_PAYPAL_UPDATED, ORG_PAYPAL_CANCELLED, ORG_OVERRIDE_PAYMENT_METHOD_ADDED, ORG_ACTIVATED, ORG_TEMPORARILY_ACTIVATED, ORG_SUSPENSION_DATE_CHANGED, ORG_SUSPENDED, ORG_ADMIN_SUSPENDED, ORG_ADMIN_LOCKED, ORG_CLUSTERS_DELETED, ORG_CLUSTERS_PAUSED, ORG_LOCKED, ORG_UNDER_FINANCIAL_PROTECTION, ORG_NO_FINANCIAL_PROTECTION, ORG_RENAMED, ALL_ORG_USERS_HAVE_MFA, ORG_USERS_WITHOUT_MFA, ORG_INVOICE_UNDER_THRESHOLD, ORG_INVOICE_OVER_THRESHOLD, ORG_DAILY_BILL_UNDER_THRESHOLD, ORG_DAILY_BILL_OVER_THRESHOLD, ORG_GROUP_CHARGES_UNDER_THRESHOLD, ORG_GROUP_CHARGES_OVER_THRESHOLD, ORG_TWO_FACTOR_AUTH_REQUIRED, ORG_TWO_FACTOR_AUTH_OPTIONAL, ORG_PUBLIC_API_ACCESS_LIST_REQUIRED, ORG_PUBLIC_API_ACCESS_LIST_NOT_REQUIRED, ORG_EMPLOYEE_ACCESS_RESTRICTED, ORG_EMPLOYEE_ACCESS_UNRESTRICTED, ORG_SFDC_ACCOUNT_ID_CHANGED, ORG_CONNECTED_TO_MLAB, ORG_DISCONNECTED_FROM_MLAB, ORG_IDP_CERTIFICATE_CURRENT, ORG_IDP_CERTIFICATE_ABOUT_TO_EXPIRE, ORG_CONNECTED_TO_VERCEL, ORG_DISCONNECTED_TO_VERCEL, ORG_CONNECTION_UNINSTALLED_FROM_VERCEL, ORG_UI_IP_ACCESS_LIST_ENABLED, ORG_UI_IP_ACCESS_LIST_DISABLED, ORG_EDITED_UI_IP_ACCESS_LIST_ENTRIES, ORG_SERVICE_ACCOUNT_MAX_SECRET_VALIDITY_EDITED, ORG_SERVICE_ACCOUNT_SECRETS_EXPIRED, ORG_SERVICE_ACCOUNT_SECRETS_NO_LONGER_EXPIRED, ORG_SERVICE_ACCOUNT_SECRETS_EXPIRING, ORG_SERVICE_ACCOUNT_SECRETS_NO_LONGER_EXPIRING, ORG_MONGODB_VERSION_EOL_EXTENSION_ACCEPTED, ORG_MONGODB_VERSION_EOL_EXTENSION_PENDING, ORG_MONGODB_VERSION_EOL_EXTENSION_CANCELLED, GROUP_MOVED_FROM_ORG, SANDBOX_ENABLED_FOR_ORG, or SANDBOX_DISABLED_FOR_ORG.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  invoiceId string
  
  Unique 24-hexadecimal digit string that identifies of the invoice associated with the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string
  
  Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  External documentation
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  Team event identifies different activities around organization teams.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  Create Programmatic API Key
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are TEAM_CREATED, TEAM_DELETED, TEAM_UPDATED, TEAM_NAME_CHANGED, TEAM_ADDED_TO_GROUP, TEAM_REMOVED_FROM_GROUP, or TEAM_ROLES_MODIFIED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string
  
  Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  External documentation
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  teamId string
  
  Unique 24-hexadecimal digit string that identifies the organization team associated with this event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  User event reflects different activities about the atlas user.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  Create Programmatic API Key
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are JOINED_ORG, JOINED_TEAM, INVITED_TO_ORG, ORG_INVITATION_DELETED, REMOVED_FROM_ORG, REMOVED_FROM_TEAM, USER_ROLES_CHANGED_AUDIT, ORG_FLEX_CONSULTING_PURCHASED, ORG_FLEX_CONSULTING_PURCHASE_FAILED, or INVITED_TO_TEAM.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string
  
  Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  External documentation
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  targetUsername string(email)
  
  Email address for the console user that this event targets. The resource returns this parameter when "eventTypeName" : "USER".
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  Resource event reflects different activities about resources.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  Create Programmatic API Key
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are TAGS_MODIFIED or GROUP_TAGS_MODIFIED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string
  
  Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  External documentation
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  resourceId string
  
  Unique 24-hexadecimal digit string that identifies the resource associated with the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  resourceType string Required
  
  Unique identifier of resource type.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  Atlas resource policy audits indicate org level changes to resource policies
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  Create Programmatic API Key
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are RESOURCE_POLICY_CREATED, RESOURCE_POLICY_MODIFIED, RESOURCE_POLICY_DELETED, or RESOURCE_POLICY_VIOLATED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string
  
  Public part of the API key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  External documentation
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  ISO 8601
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  resourcePolicyId string
  
  Unique 24-hexadecimal character string that identifies the resource policy.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
- totalCount integer(int32)
  
  Total number of documents available. MongoDB Cloud omits this value if includeCount is set to false. The total number is an estimate and may not be exact.
  
  Minimum value is 0.
400 application/json

Bad Request.
Hide response attributes Show response attributes object
- badRequestDetail object
  
  Bad request detail.
  
  Hide badRequestDetail attribute Show badRequestDetail attribute object
  
  fields array[object]
  
  Describes all violations in a client request.
  
  Hide fields attributes Show fields attributes object
  
  description string Required
  
  A description of why the request element is bad.
  
  field string Required
  
  A path that leads to a field in the request body.
- detail string
  
  Describes the specific conditions or reasons that cause each type of error.
- error integer(int32) Required
  
  HTTP status code returned with this error.
  
  External documentation
- errorCode string Required
  
  Application error code returned with this error.
- parameters array[object]
  
  Parameters used to give more information about the error.
- reason string
  
  Application error message returned with this error.
401 application/json

Unauthorized.
Hide response attributes Show response attributes object
- badRequestDetail object
  
  Bad request detail.
  
  Hide badRequestDetail attribute Show badRequestDetail attribute object
  
  fields array[object]
  
  Describes all violations in a client request.
  
  Hide fields attributes Show fields attributes object
  
  description string Required
  
  A description of why the request element is bad.
  
  field string Required
  
  A path that leads to a field in the request body.
- detail string
  
  Describes the specific conditions or reasons that cause each type of error.
- error integer(int32) Required
  
  HTTP status code returned with this error.
  
  External documentation
- errorCode string Required
  
  Application error code returned with this error.
- parameters array[object]
  
  Parameters used to give more information about the error.
- reason string
  
  Application error message returned with this error.
403 application/json

Forbidden.
Hide response attributes Show response attributes object
- badRequestDetail object
  
  Bad request detail.
  
  Hide badRequestDetail attribute Show badRequestDetail attribute object
  
  fields array[object]
  
  Describes all violations in a client request.
  
  Hide fields attributes Show fields attributes object
  
  description string Required
  
  A description of why the request element is bad.
  
  field string Required
  
  A path that leads to a field in the request body.
- detail string
  
  Describes the specific conditions or reasons that cause each type of error.
- error integer(int32) Required
  
  HTTP status code returned with this error.
  
  External documentation
- errorCode string Required
  
  Application error code returned with this error.
- parameters array[object]
  
  Parameters used to give more information about the error.
- reason string
  
  Application error message returned with this error.
404 application/json

Not Found.
Hide response attributes Show response attributes object
- badRequestDetail object
  
  Bad request detail.
  
  Hide badRequestDetail attribute Show badRequestDetail attribute object
  
  fields array[object]
  
  Describes all violations in a client request.
  
  Hide fields attributes Show fields attributes object
  
  description string Required
  
  A description of why the request element is bad.
  
  field string Required
  
  A path that leads to a field in the request body.
- detail string
  
  Describes the specific conditions or reasons that cause each type of error.
- error integer(int32) Required
  
  HTTP status code returned with this error.
  
  External documentation
- errorCode string Required
  
  Application error code returned with this error.
- parameters array[object]
  
  Parameters used to give more information about the error.
- reason string
  
  Application error message returned with this error.
500 application/json

Internal Server Error.
Hide response attributes Show response attributes object
- badRequestDetail object
  
  Bad request detail.
  
  Hide badRequestDetail attribute Show badRequestDetail attribute object
  
  fields array[object]
  
  Describes all violations in a client request.
  
  Hide fields attributes Show fields attributes object
  
  description string Required
  
  A description of why the request element is bad.
  
  field string Required
  
  A path that leads to a field in the request body.
- detail string
  
  Describes the specific conditions or reasons that cause each type of error.
- error integer(int32) Required
  
  HTTP status code returned with this error.
  
  External documentation
- errorCode string Required
  
  Application error code returned with this error.
- parameters array[object]
  
  Parameters used to give more information about the error.
- reason string
  
  Application error message returned with this error.

GET /api/atlas/v2/orgs/{orgId}/events

atlas api listOrganizationEvents --help

import (
	"os"
	"context"
	"log"
	sdk "go.mongodb.org/atlas-sdk/v20250312001/admin"
)

func main() {
	ctx := context.Background()
	clientID := os.Getenv("MONGODB_ATLAS_CLIENT_ID")
	clientSecret := os.Getenv("MONGODB_ATLAS_CLIENT_SECRET")

	client, err := sdk.NewClient(
		sdk.UseOAuthAuth(clientID, clientSecret),
		sdk.UseBaseURL(url))

	if err != nil {
		log.Fatalf("Error: %v", err)
	}

	params = &sdk.ListOrganizationEventsApiParams{}
	sdkResp, httpResp, err := client.EventsApi.
		ListOrganizationEventsWithParams(ctx, params).
		Execute()
}

curl --header "Authorization: Bearer ${ACCESS_TOKEN}" \
  --header "Accept: application/vnd.atlas.2025-03-12+json" \
  -X GET "https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/events?pretty=true"

curl --user "${PUBLIC_KEY}:${PRIVATE_KEY}" \
  --digest \
  --header "Accept: application/vnd.atlas.2025-03-12+json" \
  -X GET "https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/events?pretty=true"

Response examples (200)

{
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "results": [
    {
      "apiKeyId": "32b6e34b3d91647abb20e7b8",
      "created": "2025-05-04T09:42:00Z",
      "eventTypeName": "FEDERATION_SETTINGS_CREATED",
      "groupId": "32b6e34b3d91647abb20e7b8",
      "id": "32b6e34b3d91647abb20e7b8",
      "isGlobalAdmin": true,
      "links": [
        {
          "href": "https://cloud.mongodb.com/api/atlas",
          "rel": "self"
        }
      ],
      "orgId": "32b6e34b3d91647abb20e7b8",
      "publicKey": "string",
      "raw": {
        "_t": "ALERT_AUDIT",
        "alertConfigId": "32b6e34b3d91647abb20e7b8",
        "cid": "32b6e34b3d91647abb20e7b8",
        "cre": "2025-05-04T09:42:00Z",
        "description": "Alert Acknowledged",
        "gn": "Test Project",
        "id": "32b6e34b3d91647abb20e7b8",
        "orgId": "32b6e34b3d91647abb20e7b8",
        "orgName": "Test Organization",
        "severity": "INFO"
      },
      "remoteAddress": "216.172.40.186",
      "userId": "32b6e34b3d91647abb20e7b8",
      "username": "hello@example.com"
    }
  ],
  "totalCount": 42
}

Response examples (400)

{
  "error": 400,
  "detail": "(This is just an example, the exception may not be related to this endpoint) No provider AWS exists.",
  "reason": "Bad Request",
  "errorCode": "VALIDATION_ERROR"
}

Response examples (401)

{
  "error": 401,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Unauthorized",
  "errorCode": "NOT_ORG_GROUP_CREATOR"
}

Response examples (403)

{
  "error": 403,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Forbidden",
  "errorCode": "CANNOT_CHANGE_GROUP_NAME"
}

Response examples (404)

{
  "error": 404,
  "detail": "(This is just an example, the exception may not be related to this endpoint) Cannot find resource AWS",
  "reason": "Not Found",
  "errorCode": "RESOURCE_NOT_FOUND"
}

Response examples (500)

{
  "error": 500,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Internal Server Error",
  "errorCode": "UNEXPECTED_ERROR"
}