Return All Events from One Organization

GET /api/atlas/v2/orgs/{orgId}/events

Returns all events for the specified organization. Events identify significant database, billing, or security activities or status changes. To use this resource, the requesting API Key must have the Organization Member role.

This resource remains under revision and may change.

Path parameters

orgId string Required

Unique 24-hexadecimal digit string that identifies the organization that contains your projects. Use the /orgs endpoint to retrieve all organizations to which the authenticated user has access.

Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.

Query parameters

envelope boolean

Flag that indicates whether Application wraps the response in an envelope JSON object. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. Endpoints that return a list of results use the results object as an envelope. Application adds the status parameter to the response body.

Default value is false.
includeCount boolean

Flag that indicates whether the response returns the total number of items (totalCount) in the response.

Default value is true.
itemsPerPage integer

Number of items that the response returns per page.

Minimum value is 1, maximum value is 500. Default value is 100.
pageNum integer

Number of the page that displays the current set of the total objects that the response returns.

Minimum value is 1. Default value is 1.
pretty boolean

Flag that indicates whether the response body should be in the prettyprint format.

Default value is false.
eventType array[object | string]

Category of incident recorded at this moment in time.

IMPORTANT: The complete list of event type values changes frequently.

One of:
Alert Audit Types string Alert Audit Types string API User Event Types string Service Account Event Types string Billing Event Types string Federation Settings Event Types string Group Audit Types string Mlab Migration Audit Types string NDS Audit Types string Org Event Types string Partner Event Types string Support Event Types string Team Event Types string User Event Types string Resource Event Types string

Values are ALERT_ACKNOWLEDGED_AUDIT or ALERT_UNACKNOWLEDGED_AUDIT.

Values are ALERT_CONFIG_DISABLED_AUDIT, ALERT_CONFIG_ENABLED_AUDIT, ALERT_CONFIG_ADDED_AUDIT, ALERT_CONFIG_DELETED_AUDIT, or ALERT_CONFIG_CHANGED_AUDIT.

Values are API_KEY_CREATED, API_KEY_DELETED, API_KEY_ACCESS_LIST_ENTRY_ADDED, API_KEY_ACCESS_LIST_ENTRY_DELETED, API_KEY_ROLES_CHANGED, API_KEY_DESCRIPTION_CHANGED, API_KEY_ADDED_TO_GROUP, API_KEY_REMOVED_FROM_GROUP, API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.

Values are SERVICE_ACCOUNT_CREATED, SERVICE_ACCOUNT_DELETED, SERVICE_ACCOUNT_ROLES_CHANGED, SERVICE_ACCOUNT_DETAILS_CHANGED, SERVICE_ACCOUNT_ADDED_TO_GROUP, SERVICE_ACCOUNT_REMOVED_FROM_GROUP, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_ADDED, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_DELETED, SERVICE_ACCOUNT_SECRET_ADDED, SERVICE_ACCOUNT_SECRET_DELETED, SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.

Values are CHARGE_SUCCEEDED, CHARGE_FAILED, CHARGE_PROCESSING, CHARGE_PENDING_REVERSAL, BRAINTREE_CHARGE_FAILED, INVOICE_CLOSED, CHECK_PAYMENT_RECEIVED, WIRE_TRANSFER_PAYMENT_RECEIVED, DISCOUNT_APPLIED, CREDIT_ISSUED, CREDIT_PULLED_FWD, CREDIT_END_DATE_MODIFIED, PROMO_CODE_APPLIED, PAYMENT_FORGIVEN, REFUND_ISSUED, ACCOUNT_DOWNGRADED, ACCOUNT_UPGRADED, ACCOUNT_MODIFIED, SUPPORT_PLAN_ACTIVATED, SUPPORT_PLAN_CANCELLED, SUPPORT_PLAN_CANCELLATION_SCHEDULED, INITIATE_SALESFORCE_SERVICE_CLOUD_SYNC, INVOICE_ADDRESS_CHANGED, INVOICE_ADDRESS_ADDED, PREPAID_PLAN_ACTIVATED, ELASTIC_INVOICING_MODE_ACTIVATED, ELASTIC_INVOICING_MODE_DEACTIVATED, TERMINATE_PAID_SERVICES, BILLING_EMAIL_ADDRESS_ADDED, BILLING_EMAIL_ADDRESS_CHANGED, BILLING_EMAIL_ADDRESS_REMOVED, AWS_BILLING_ACCOUNT_CREDIT_ISSUED, GCP_BILLING_ACCOUNT_CREDIT_ISSUED, CREDIT_SFOLID_MODIFIED, PREPAID_PLAN_MODIFIED, AWS_USAGE_REPORTED, AZURE_USAGE_REPORTED, GCP_USAGE_REPORTED, BECAME_PAYING_ORG, NEW_LINKED_ORG, UNLINKED_ORG, ORG_LINKED_TO_PAYING_ORG, ORG_UNLINKED_FROM_PAYING_ORG, ORG_UNLINK_REQUESTED, ORG_UNLINK_CANCELLED, PAYMENT_UPDATED_THROUGH_API, AZURE_BILLING_ACCOUNT_CREDIT_ISSUED, CREDIT_START_DATE_MODIFIED, CREDIT_ELASTIC_INVOICING_MODIFIED, CREDIT_TYPE_MODIFIED, CREDIT_AMOUNT_CENTS_MODIFIED, CREDIT_AMOUNT_REMAINING_CENTS_MODIFIED, CREDIT_TOTAL_BILLED_CENTS_MODIFIED, CREDIT_AWS_CUSTOMER_ID_MODIFIED, CREDIT_AWS_PRODUCT_CODE_MODIFIED, CREDIT_GCP_MARKETPLACE_ENTITLEMENT_ID_MODIFIED, CREDIT_AZURE_SUBSCRIPTION_ID_MODIFIED, CREDIT_AZURE_PRIVATE_PLAN_ID_MODIFIED, TARGETED_REBILL_EXECUTED, LEGACY_REBILL_EXECUTED, EVERGREEN_DEAL_CANCELLED, GRACE_PERIOD_ACTIVATED, GRACE_PERIOD_NO_LONGER_IN_EFFECT, PENDING_DEAL_ACTIVATION_ADDED, PENDING_DEAL_ACTIVATION_CANCELED, PENDING_DEAL_APPLIED, PENDING_DEAL_ACTIVATION_FAILED, or EVERGREEN_PRIORITY_MODIFIED.

Values are FEDERATION_SETTINGS_CREATED, FEDERATION_SETTINGS_DELETED, FEDERATION_SETTINGS_UPDATED, IDENTITY_PROVIDER_CREATED, IDENTITY_PROVIDER_UPDATED, IDENTITY_PROVIDER_DELETED, IDENTITY_PROVIDER_ACTIVATED, OIDC_IDENTITY_PROVIDER_UPDATED, IDENTITY_PROVIDER_DEACTIVATED, IDENTITY_PROVIDER_JWKS_REVOKED, OIDC_IDENTITY_PROVIDER_ENABLED, OIDC_IDENTITY_PROVIDER_DISABLED, DOMAINS_ASSOCIATED, DOMAIN_CREATED, DOMAIN_DELETED, DOMAIN_VERIFIED, ORG_SETTINGS_CONFIGURED, ORG_SETTINGS_UPDATED, ORG_SETTINGS_DELETED, RESTRICT_ORG_MEMBERSHIP_ENABLED, RESTRICT_ORG_MEMBERSHIP_DISABLED, ROLE_MAPPING_CREATED, ROLE_MAPPING_UPDATED, or ROLE_MAPPING_DELETED.

Values are GROUP_DELETED, GROUP_CREATED, or GROUP_MOVED.

Values are MLAB_MIGRATION_COMPLETED, MLAB_MIGRATION_TARGET_CLUSTER_CREATED, MLAB_MIGRATION_DATABASE_USERS_IMPORTED, MLAB_MIGRATION_IP_WHITELIST_IMPORTED, MLAB_MIGRATION_TARGET_CLUSTER_SET, MLAB_MIGRATION_DATABASE_RENAMED, MLAB_MIGRATION_LIVE_IMPORT_STARTED, MLAB_MIGRATION_LIVE_IMPORT_READY_FOR_CUTOVER, MLAB_MIGRATION_LIVE_IMPORT_CUTOVER_COMPLETE, MLAB_MIGRATION_LIVE_IMPORT_ERROR, MLAB_MIGRATION_LIVE_IMPORT_CANCELLED, MLAB_MIGRATION_DUMP_AND_RESTORE_TEST_STARTED, MLAB_MIGRATION_DUMP_AND_RESTORE_TEST_SKIPPED, MLAB_MIGRATION_DUMP_AND_RESTORE_STARTED, MLAB_MIGRATION_SUPPORT_PLAN_SELECTED, or MLAB_MIGRATION_SUPPORT_PLAN_OPTED_OUT.

Value is ORG_LIMIT_UPDATED.

Values are ORG_CREATED, SECURITY_CONTACT_MODIFIED, ORG_CREDIT_CARD_ADDED, ORG_CREDIT_CARD_UPDATED, ORG_CREDIT_CARD_CURRENT, ORG_CREDIT_CARD_ABOUT_TO_EXPIRE, ORG_PAYPAL_LINKED, ORG_PAYPAL_UPDATED, ORG_PAYPAL_CANCELLED, ORG_OVERRIDE_PAYMENT_METHOD_ADDED, ORG_ACTIVATED, ORG_TEMPORARILY_ACTIVATED, ORG_SUSPENSION_DATE_CHANGED, ORG_SUSPENDED, ORG_ADMIN_SUSPENDED, ORG_ADMIN_LOCKED, ORG_CLUSTERS_DELETED, ORG_CLUSTERS_PAUSED, ORG_LOCKED, ORG_UNDER_FINANCIAL_PROTECTION, ORG_NO_FINANCIAL_PROTECTION, ORG_RENAMED, ALL_ORG_USERS_HAVE_MFA, ORG_USERS_WITHOUT_MFA, ORG_INVOICE_UNDER_THRESHOLD, ORG_INVOICE_OVER_THRESHOLD, ORG_DAILY_BILL_UNDER_THRESHOLD, ORG_DAILY_BILL_OVER_THRESHOLD, ORG_GROUP_CHARGES_UNDER_THRESHOLD, ORG_GROUP_CHARGES_OVER_THRESHOLD, ORG_TWO_FACTOR_AUTH_REQUIRED, ORG_TWO_FACTOR_AUTH_OPTIONAL, ORG_PUBLIC_API_ACCESS_LIST_REQUIRED, ORG_PUBLIC_API_ACCESS_LIST_NOT_REQUIRED, ORG_EMPLOYEE_ACCESS_RESTRICTED, ORG_EMPLOYEE_ACCESS_UNRESTRICTED, ORG_SFDC_ACCOUNT_ID_CHANGED, ORG_CONNECTED_TO_MLAB, ORG_DISCONNECTED_FROM_MLAB, ORG_IDP_CERTIFICATE_CURRENT, ORG_IDP_CERTIFICATE_ABOUT_TO_EXPIRE, ORG_CONNECTED_TO_VERCEL, ORG_DISCONNECTED_TO_VERCEL, ORG_CONNECTION_UNINSTALLED_FROM_VERCEL, ORG_UI_IP_ACCESS_LIST_ENABLED, ORG_UI_IP_ACCESS_LIST_DISABLED, ORG_EDITED_UI_IP_ACCESS_LIST_ENTRIES, or ORG_SERVICE_ACCOUNT_MAX_SECRET_VALIDITY_EDITED.

Values are AWS_SELF_SERVE_ACCOUNT_LINKED, AWS_SELF_SERVE_ACCOUNT_LINK_PENDING, AWS_SELF_SERVE_ACCOUNT_CANCELLED, AWS_SELF_SERVE_ACCOUNT_LINK_FAILED, GCP_SELF_SERVE_ACCOUNT_LINK_PENDING, GCP_SELF_SERVE_ACCOUNT_LINK_FAILED, AZURE_SELF_SERVE_ACCOUNT_LINKED, AZURE_SELF_SERVE_ACCOUNT_LINK_PENDING, AZURE_SELF_SERVE_ACCOUNT_CANCELLED, AZURE_SELF_SERVE_ACCOUNT_LINK_FAILED, GCP_SELF_SERVE_ACCOUNT_LINKED, or GCP_SELF_SERVE_ACCOUNT_CANCELLED.

Values are SUPPORT_EMAILS_SENT_SUCCESSFULLY or SUPPORT_EMAILS_SENT_FAILURE.

Values are TEAM_CREATED, TEAM_DELETED, TEAM_UPDATED, TEAM_NAME_CHANGED, TEAM_ADDED_TO_GROUP, TEAM_REMOVED_FROM_GROUP, or TEAM_ROLES_MODIFIED.

Values are JOINED_ORG, JOINED_TEAM, INVITED_TO_ORG, ORG_INVITATION_DELETED, REMOVED_FROM_ORG, REMOVED_FROM_TEAM, USER_ROLES_CHANGED_AUDIT, ORG_FLEX_CONSULTING_PURCHASED, ORG_FLEX_CONSULTING_PURCHASE_FAILED, or INVITED_TO_TEAM.

Value is GROUP_TAGS_MODIFIED.
includeRaw boolean

Flag that indicates whether to include the raw document in the output. The raw document contains additional meta information about the event.

Default value is false.
maxDate string(date-time)

Date and time from when MongoDB Cloud stops returning events. This parameter uses the ISO 8601 timestamp format in UTC.
minDate string(date-time)

Date and time from when MongoDB Cloud starts returning events. This parameter uses the ISO 8601 timestamp format in UTC.

Responses

200 application/vnd.atlas.2023-01-01+json

OK
Hide response attributes Show response attributes object
- links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
- results array[object]
  
  List of returned documents that MongoDB Cloud providers when completing this request.
  
  One of:
  DefaultEventViewForOrg object AlertAudit object AlertConfigAudit object ApiUserEventViewForOrg object ServiceAccountOrgEvents object BillingEventViewForOrg object NDSAuditViewForOrg object OrgEventViewForOrg object TeamEvent object UserEventViewForOrg object ResourceEventViewForOrg object
  
  Other events which don't have extra details beside of basic one.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  One of:
  Federation Settings Event Types string Group Audit Types string Mlab Migration Audit Types string Partner Event Types string Support Event Types string
  
  Values are FEDERATION_SETTINGS_CREATED, FEDERATION_SETTINGS_DELETED, FEDERATION_SETTINGS_UPDATED, IDENTITY_PROVIDER_CREATED, IDENTITY_PROVIDER_UPDATED, IDENTITY_PROVIDER_DELETED, IDENTITY_PROVIDER_ACTIVATED, OIDC_IDENTITY_PROVIDER_UPDATED, IDENTITY_PROVIDER_DEACTIVATED, IDENTITY_PROVIDER_JWKS_REVOKED, OIDC_IDENTITY_PROVIDER_ENABLED, OIDC_IDENTITY_PROVIDER_DISABLED, DOMAINS_ASSOCIATED, DOMAIN_CREATED, DOMAIN_DELETED, DOMAIN_VERIFIED, ORG_SETTINGS_CONFIGURED, ORG_SETTINGS_UPDATED, ORG_SETTINGS_DELETED, RESTRICT_ORG_MEMBERSHIP_ENABLED, RESTRICT_ORG_MEMBERSHIP_DISABLED, ROLE_MAPPING_CREATED, ROLE_MAPPING_UPDATED, or ROLE_MAPPING_DELETED.
  
  Values are GROUP_DELETED, GROUP_CREATED, or GROUP_MOVED.
  
  Values are MLAB_MIGRATION_COMPLETED, MLAB_MIGRATION_TARGET_CLUSTER_CREATED, MLAB_MIGRATION_DATABASE_USERS_IMPORTED, MLAB_MIGRATION_IP_WHITELIST_IMPORTED, MLAB_MIGRATION_TARGET_CLUSTER_SET, MLAB_MIGRATION_DATABASE_RENAMED, MLAB_MIGRATION_LIVE_IMPORT_STARTED, MLAB_MIGRATION_LIVE_IMPORT_READY_FOR_CUTOVER, MLAB_MIGRATION_LIVE_IMPORT_CUTOVER_COMPLETE, MLAB_MIGRATION_LIVE_IMPORT_ERROR, MLAB_MIGRATION_LIVE_IMPORT_CANCELLED, MLAB_MIGRATION_DUMP_AND_RESTORE_TEST_STARTED, MLAB_MIGRATION_DUMP_AND_RESTORE_TEST_SKIPPED, MLAB_MIGRATION_DUMP_AND_RESTORE_STARTED, MLAB_MIGRATION_SUPPORT_PLAN_SELECTED, or MLAB_MIGRATION_SUPPORT_PLAN_OPTED_OUT.
  
  Values are AWS_SELF_SERVE_ACCOUNT_LINKED, AWS_SELF_SERVE_ACCOUNT_LINK_PENDING, AWS_SELF_SERVE_ACCOUNT_CANCELLED, AWS_SELF_SERVE_ACCOUNT_LINK_FAILED, GCP_SELF_SERVE_ACCOUNT_LINK_PENDING, GCP_SELF_SERVE_ACCOUNT_LINK_FAILED, AZURE_SELF_SERVE_ACCOUNT_LINKED, AZURE_SELF_SERVE_ACCOUNT_LINK_PENDING, AZURE_SELF_SERVE_ACCOUNT_CANCELLED, AZURE_SELF_SERVE_ACCOUNT_LINK_FAILED, GCP_SELF_SERVE_ACCOUNT_LINKED, or GCP_SELF_SERVE_ACCOUNT_CANCELLED.
  
  Values are SUPPORT_EMAILS_SENT_SUCCESSFULLY or SUPPORT_EMAILS_SENT_FAILURE.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  Default value is false.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string(email)
  
  Public part of the API Key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  Alert audit indicates acknowledgement status of an alert.
  
  Hide attributes Show attributes
  
  alertId string
  
  Unique 24-hexadecimal digit string that identifies the alert associated with the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are ALERT_ACKNOWLEDGED_AUDIT or ALERT_UNACKNOWLEDGED_AUDIT.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  Default value is false.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string(email)
  
  Public part of the API Key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  Alert config audit indicates any activities around alert settings.
  
  Hide attributes Show attributes
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration associated with the alertId.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are ALERT_CONFIG_DISABLED_AUDIT, ALERT_CONFIG_ENABLED_AUDIT, ALERT_CONFIG_ADDED_AUDIT, ALERT_CONFIG_DELETED_AUDIT, or ALERT_CONFIG_CHANGED_AUDIT.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  Default value is false.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string(email)
  
  Public part of the API Key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  API User event identifies different activities around user api keys.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are API_KEY_CREATED, API_KEY_DELETED, API_KEY_ACCESS_LIST_ENTRY_ADDED, API_KEY_ACCESS_LIST_ENTRY_DELETED, API_KEY_ROLES_CHANGED, API_KEY_DESCRIPTION_CHANGED, API_KEY_ADDED_TO_GROUP, API_KEY_REMOVED_FROM_GROUP, API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  Default value is false.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string(email)
  
  Public part of the API Key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  Service Account event identifies different activities around user api keys.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are SERVICE_ACCOUNT_CREATED, SERVICE_ACCOUNT_DELETED, SERVICE_ACCOUNT_ROLES_CHANGED, SERVICE_ACCOUNT_DETAILS_CHANGED, SERVICE_ACCOUNT_ADDED_TO_GROUP, SERVICE_ACCOUNT_REMOVED_FROM_GROUP, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_ADDED, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_DELETED, SERVICE_ACCOUNT_SECRET_ADDED, SERVICE_ACCOUNT_SECRET_DELETED, SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  Default value is false.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string(email)
  
  Public part of the API Key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  Billing event identifies different activities related to billing, payment or financial status change of an organization.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are CHARGE_SUCCEEDED, CHARGE_FAILED, CHARGE_PROCESSING, CHARGE_PENDING_REVERSAL, BRAINTREE_CHARGE_FAILED, INVOICE_CLOSED, CHECK_PAYMENT_RECEIVED, WIRE_TRANSFER_PAYMENT_RECEIVED, DISCOUNT_APPLIED, CREDIT_ISSUED, CREDIT_PULLED_FWD, CREDIT_END_DATE_MODIFIED, PROMO_CODE_APPLIED, PAYMENT_FORGIVEN, REFUND_ISSUED, ACCOUNT_DOWNGRADED, ACCOUNT_UPGRADED, ACCOUNT_MODIFIED, SUPPORT_PLAN_ACTIVATED, SUPPORT_PLAN_CANCELLED, SUPPORT_PLAN_CANCELLATION_SCHEDULED, INITIATE_SALESFORCE_SERVICE_CLOUD_SYNC, INVOICE_ADDRESS_CHANGED, INVOICE_ADDRESS_ADDED, PREPAID_PLAN_ACTIVATED, ELASTIC_INVOICING_MODE_ACTIVATED, ELASTIC_INVOICING_MODE_DEACTIVATED, TERMINATE_PAID_SERVICES, BILLING_EMAIL_ADDRESS_ADDED, BILLING_EMAIL_ADDRESS_CHANGED, BILLING_EMAIL_ADDRESS_REMOVED, AWS_BILLING_ACCOUNT_CREDIT_ISSUED, GCP_BILLING_ACCOUNT_CREDIT_ISSUED, CREDIT_SFOLID_MODIFIED, PREPAID_PLAN_MODIFIED, AWS_USAGE_REPORTED, AZURE_USAGE_REPORTED, GCP_USAGE_REPORTED, BECAME_PAYING_ORG, NEW_LINKED_ORG, UNLINKED_ORG, ORG_LINKED_TO_PAYING_ORG, ORG_UNLINKED_FROM_PAYING_ORG, ORG_UNLINK_REQUESTED, ORG_UNLINK_CANCELLED, PAYMENT_UPDATED_THROUGH_API, AZURE_BILLING_ACCOUNT_CREDIT_ISSUED, CREDIT_START_DATE_MODIFIED, CREDIT_ELASTIC_INVOICING_MODIFIED, CREDIT_TYPE_MODIFIED, CREDIT_AMOUNT_CENTS_MODIFIED, CREDIT_AMOUNT_REMAINING_CENTS_MODIFIED, CREDIT_TOTAL_BILLED_CENTS_MODIFIED, CREDIT_AWS_CUSTOMER_ID_MODIFIED, CREDIT_AWS_PRODUCT_CODE_MODIFIED, CREDIT_GCP_MARKETPLACE_ENTITLEMENT_ID_MODIFIED, CREDIT_AZURE_SUBSCRIPTION_ID_MODIFIED, CREDIT_AZURE_PRIVATE_PLAN_ID_MODIFIED, TARGETED_REBILL_EXECUTED, LEGACY_REBILL_EXECUTED, EVERGREEN_DEAL_CANCELLED, GRACE_PERIOD_ACTIVATED, GRACE_PERIOD_NO_LONGER_IN_EFFECT, PENDING_DEAL_ACTIVATION_ADDED, PENDING_DEAL_ACTIVATION_CANCELED, PENDING_DEAL_APPLIED, PENDING_DEAL_ACTIVATION_FAILED, or EVERGREEN_PRIORITY_MODIFIED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  invoiceId string
  
  Unique 24-hexadecimal digit string that identifies of the invoice associated with the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  Default value is false.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  paymentId string
  
  Unique 24-hexadecimal digit string that identifies the invoice payment associated with this event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string(email)
  
  Public part of the API Key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  NDS audit saving information about atlas cloud provider and other atlas related details.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  dbUserUsername string
  
  The username of the MongoDB User that was created, deleted, or edited.
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Value is ORG_LIMIT_UPDATED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  Default value is false.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string(email)
  
  Public part of the API Key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  whitelistEntry string
  
  Entry in the list of source host addresses that the API key accepts and this event targets.
  
  Org event identifies different activities and changes in an organization settings.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are ORG_CREATED, SECURITY_CONTACT_MODIFIED, ORG_CREDIT_CARD_ADDED, ORG_CREDIT_CARD_UPDATED, ORG_CREDIT_CARD_CURRENT, ORG_CREDIT_CARD_ABOUT_TO_EXPIRE, ORG_PAYPAL_LINKED, ORG_PAYPAL_UPDATED, ORG_PAYPAL_CANCELLED, ORG_OVERRIDE_PAYMENT_METHOD_ADDED, ORG_ACTIVATED, ORG_TEMPORARILY_ACTIVATED, ORG_SUSPENSION_DATE_CHANGED, ORG_SUSPENDED, ORG_ADMIN_SUSPENDED, ORG_ADMIN_LOCKED, ORG_CLUSTERS_DELETED, ORG_CLUSTERS_PAUSED, ORG_LOCKED, ORG_UNDER_FINANCIAL_PROTECTION, ORG_NO_FINANCIAL_PROTECTION, ORG_RENAMED, ALL_ORG_USERS_HAVE_MFA, ORG_USERS_WITHOUT_MFA, ORG_INVOICE_UNDER_THRESHOLD, ORG_INVOICE_OVER_THRESHOLD, ORG_DAILY_BILL_UNDER_THRESHOLD, ORG_DAILY_BILL_OVER_THRESHOLD, ORG_GROUP_CHARGES_UNDER_THRESHOLD, ORG_GROUP_CHARGES_OVER_THRESHOLD, ORG_TWO_FACTOR_AUTH_REQUIRED, ORG_TWO_FACTOR_AUTH_OPTIONAL, ORG_PUBLIC_API_ACCESS_LIST_REQUIRED, ORG_PUBLIC_API_ACCESS_LIST_NOT_REQUIRED, ORG_EMPLOYEE_ACCESS_RESTRICTED, ORG_EMPLOYEE_ACCESS_UNRESTRICTED, ORG_SFDC_ACCOUNT_ID_CHANGED, ORG_CONNECTED_TO_MLAB, ORG_DISCONNECTED_FROM_MLAB, ORG_IDP_CERTIFICATE_CURRENT, ORG_IDP_CERTIFICATE_ABOUT_TO_EXPIRE, ORG_CONNECTED_TO_VERCEL, ORG_DISCONNECTED_TO_VERCEL, ORG_CONNECTION_UNINSTALLED_FROM_VERCEL, ORG_UI_IP_ACCESS_LIST_ENABLED, ORG_UI_IP_ACCESS_LIST_DISABLED, ORG_EDITED_UI_IP_ACCESS_LIST_ENTRIES, or ORG_SERVICE_ACCOUNT_MAX_SECRET_VALIDITY_EDITED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  invoiceId string
  
  Unique 24-hexadecimal digit string that identifies of the invoice associated with the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  Default value is false.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string(email)
  
  Public part of the API Key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  Team event identifies different activities around organization teams.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are TEAM_CREATED, TEAM_DELETED, TEAM_UPDATED, TEAM_NAME_CHANGED, TEAM_ADDED_TO_GROUP, TEAM_REMOVED_FROM_GROUP, or TEAM_ROLES_MODIFIED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  Default value is false.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string(email)
  
  Public part of the API Key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  teamId string
  
  Unique 24-hexadecimal digit string that identifies the organization team associated with this event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  User event reflects different activities about the atlas user.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Values are JOINED_ORG, JOINED_TEAM, INVITED_TO_ORG, ORG_INVITATION_DELETED, REMOVED_FROM_ORG, REMOVED_FROM_TEAM, USER_ROLES_CHANGED_AUDIT, ORG_FLEX_CONSULTING_PURCHASED, ORG_FLEX_CONSULTING_PURCHASE_FAILED, or INVITED_TO_TEAM.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  Default value is false.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string(email)
  
  Public part of the API Key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  targetUsername string(email)
  
  Email address for the console user that this event targets. The resource returns this parameter when "eventTypeName" : "USER".
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
  
  Resource event reflects different activities about resources.
  
  Hide attributes Show attributes
  
  apiKeyId string
  
  Unique 24-hexadecimal digit string that identifies the API Key that triggered the event. If this resource returns this parameter, it doesn't return the userId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  created string(date-time) Required
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  eventTypeName string Required
  
  Unique identifier of event type.
  
  Value is GROUP_TAGS_MODIFIED.
  
  groupId string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred. The eventId identifies the specific event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  id string Required
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  isGlobalAdmin boolean
  
  Flag that indicates whether a MongoDB employee triggered the specified event.
  
  Default value is false.
  
  links array[object]
  
  List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.
  
  Web Linking Specification (RFC 5988)
  
  Hide links attributes Show links attributes object
  
  href string
  
  Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  rel string
  
  Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  publicKey string(email)
  
  Public part of the API Key that triggered the event. If this resource returns this parameter, it doesn't return the username parameter.
  
  raw object
  
  Additional meta information captured about this event. The response returns this parameter as a JSON object when the query parameter includeRaw=true. The list of fields in the raw document may change. Don't rely on raw values for formal monitoring.
  
  Hide raw attributes Show raw attributes object
  
  _t string
  
  Unique identifier of event type.
  
  alertConfigId string
  
  Unique 24-hexadecimal digit string that identifies the alert configuration related to the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cid string
  
  Unique 24-hexadecimal digit string that identifies the project in which the event occurred.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  cre string(date-time)
  
  Date and time when this event occurred. This parameter expresses its value in the ISO 8601 timestamp format in UTC.
  
  description string
  
  Description of the event.
  
  gn string
  
  Human-readable label that identifies the project.
  
  Minimum length is 1, maximum length is 64.
  
  id string
  
  Unique 24-hexadecimal digit string that identifies the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgId string
  
  Unique 24-hexadecimal digit string that identifies the organization to which these events apply.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  orgName string
  
  Human-readable label that identifies the organization that contains the project.
  
  Minimum length is 1, maximum length is 64.
  
  severity string
  
  Severity of the event.
  
  Values are INFO, WARNING, ERROR, or CRITICAL.
  
  remoteAddress string
  
  IPv4 or IPv6 address from which the user triggered this event.
  
  Format should match the following pattern: ^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)(\.(?!$)|$)){4}|([0-9a-f]{1,4}:){7}[0-9a-f]{1,4}$.
  
  resourceId string
  
  Unique 24-hexadecimal digit string that identifies the resource associated with the event.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  resourceType string Required
  
  Unique identifier of resource type.
  
  userId string
  
  Unique 24-hexadecimal digit string that identifies the console user who triggered the event. If this resource returns this parameter, it doesn't return the apiKeyId parameter.
  
  Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.
  
  username string(email)
  
  Email address for the user who triggered this event. If this resource returns this parameter, it doesn't return the publicApiKey parameter.
- totalCount integer(int32)
  
  Total number of documents available. MongoDB Cloud omits this value if includeCount is set to false.
  
  Minimum value is 0.
400 application/json

Bad Request.
Hide response attributes Show response attributes object
- detail string
  
  Describes the specific conditions or reasons that cause each type of error.
- error integer(int32)
  
  HTTP status code returned with this error.
  
  External documentation
- errorCode string
  
  Application error code returned with this error.
- parameters array[object]
  
  Parameters used to give more information about the error.
- reason string
  
  Application error message returned with this error.
500 application/json

Internal Server Error.
Hide response attributes Show response attributes object
- detail string
  
  Describes the specific conditions or reasons that cause each type of error.
- error integer(int32)
  
  HTTP status code returned with this error.
  
  External documentation
- errorCode string
  
  Application error code returned with this error.
- parameters array[object]
  
  Parameters used to give more information about the error.
- reason string
  
  Application error message returned with this error.

GET /api/atlas/v2/orgs/{orgId}/events

atlas api events listOrganizationEvents --help

import (
	"os"
	"context"
	"log"
	sdk "go.mongodb.org/atlas-sdk/v20230101001/admin"
)

func main() {
	ctx := context.Background()
	clientID := os.Getenv("MONGODB_ATLAS_CLIENT_ID")
	clientSecret := os.Getenv("MONGODB_ATLAS_CLIENT_SECRET")

	// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth
	client, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))

	if err != nil {
		log.Fatalf("Error: %v", err)
	}

	params = &sdk.ListOrganizationEventsApiParams{}
	sdkResp, httpResp, err := client.EventsApi.
		ListOrganizationEventsWithParams(ctx, params).
		Execute()
}

curl --include --header "Authorization: Bearer ${ACCESS_TOKEN}" \
  --header "Accept: application/vnd.atlas.2023-01-01+json" \
  -X GET "https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/events?pretty=true"

curl --user "${PUBLIC_KEY}:${PRIVATE_KEY}" \
  --digest --include \
  --header "Accept: application/vnd.atlas.2023-01-01+json" \
  -X GET "https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/events?pretty=true"

Response examples (200)

{
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "results": [
    {
      "apiKeyId": "32b6e34b3d91647abb20e7b8",
      "created": "2025-05-04T09:42:00Z",
      "eventTypeName": "FEDERATION_SETTINGS_CREATED",
      "groupId": "32b6e34b3d91647abb20e7b8",
      "id": "32b6e34b3d91647abb20e7b8",
      "isGlobalAdmin": false,
      "links": [
        {
          "href": "https://cloud.mongodb.com/api/atlas",
          "rel": "self"
        }
      ],
      "orgId": "32b6e34b3d91647abb20e7b8",
      "publicKey": "test.user@mongodb.com",
      "raw": {
        "_t": "ALERT_AUDIT",
        "alertConfigId": "32b6e34b3d91647abb20e7b8",
        "cid": "32b6e34b3d91647abb20e7b8",
        "cre": "2025-05-04T09:42:00Z",
        "description": "Alert Acknowledged",
        "gn": "Test Project",
        "id": "32b6e34b3d91647abb20e7b8",
        "orgId": "32b6e34b3d91647abb20e7b8",
        "orgName": "Test Organization",
        "severity": "INFO"
      },
      "remoteAddress": "216.172.40.186",
      "userId": "32b6e34b3d91647abb20e7b8",
      "username": "test.user@mongodb.com"
    }
  ],
  "totalCount": 42
}

Response examples (400)

{
  "error": 400,
  "detail": "(This is just an example, the exception may not be related to this endpoint) No provider AWS exists.",
  "reason": "Bad Request",
  "errorCode": "VALIDATION_ERROR"
}

Response examples (500)

{
  "error": 500,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Internal Server Error",
  "errorCode": "UNEXPECTED_ERROR"
}