Andrea Test

Return All Events from One Project

GET /api/atlas/v2/groups/{groupId}/events
Digest auth

Returns one event for the specified project. Events identify significant database, billing, or security activities or status changes. To use this resource, the requesting API Key must have the Project Read Only role.

This resource remains under revision and may change.

Path parameters

  • groupId string Required

    Unique 24-hexadecimal digit string that identifies your project. Use the /groups endpoint to retrieve all projects to which the authenticated user has access.

    NOTE: Groups and projects are synonymous terms. Your group id is the same as your project id. For existing groups, your group/project id remains the same. The resource and corresponding endpoints use the term groups.

    Minimum length is 24, maximum length is 24. Format should match the following pattern: ^([a-f0-9]{24})$.

Query parameters

  • envelope boolean

    Flag that indicates whether Application wraps the response in an envelope JSON object. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. Endpoints that return a list of results use the results object as an envelope. Application adds the status parameter to the response body.

    Default value is false.

  • includeCount boolean

    Flag that indicates whether the response returns the total number of items (totalCount) in the response.

    Default value is true.

  • itemsPerPage integer

    Number of items that the response returns per page.

    Minimum value is 1, maximum value is 500. Default value is 100.

  • pageNum integer

    Number of the page that displays the current set of the total objects that the response returns.

    Minimum value is 1. Default value is 1.

  • pretty boolean

    Flag that indicates whether the response body should be in the prettyprint format.

    Default value is false.

  • clusterNames array[string]

    Human-readable label that identifies the cluster.

    Minimum length of each is 1, maximum length of each is 64. Format of each should match the following pattern: ^[a-zA-Z0-9][a-zA-Z0-9-]*$.

  • eventType array[object | string]

    Category of incident recorded at this moment in time.

    IMPORTANT: The complete list of event type values changes frequently.

    One of:
    Alert Audit Types string Alert Audit Types string API User Event Types string Service Account Event Types string App Services Event Types string Auto Indexing Event Types string Automation Config Event Types string AWS Peer Vpc Audit Types string Azure Peer Network Audit Types string Billing Event Types string Cluster Connection Audit Types string Cluster Event Types string Cps Backup Event Types string Data Explorer Accessed Event Types string CPS Backup Compliance Policy Event Types string Disk Backup Event Types string Encryption Event Types string Export Bucket Audit Types string FTS Index Audit Types string GCP Peer Vpc Audit Types string Group Audit Types string Group Event Types string Group Integration Event Types string Host Event Types string Host Metric Event Types string Index Build Audit Types string NDS Audit Types string NDS DB Check Audit Types string NDS Data Validation Audit Types string NDS Auto Scaling Audit Types string NDS Maintenance Window Audit Types string NDS Serverless Auto Scaling Audit Types string NDS Serverless Instance Audit Types string NDS Auto Scaling Audit Types string NDS Tenant Endpoint Service Deployment Audit Types string NDS x509 User Auth Event Types string Online Archive Event Types string Private Link Audit Types string Proactive Operation Event Types string ReplicaSet Event Types string Search Deployment Audit Types string Serverless Deployment Audit Types string Serverless Event Types string Setup Serverless Audit Types string Streams Event Types string Stream Processor Event Types string Support Case Event Types string Support Event Types string Team Event Types string Tenant Backup Event Types string User Event Types string Version Audit Types string Resource Event Types string

    Values are ALERT_ACKNOWLEDGED_AUDIT or ALERT_UNACKNOWLEDGED_AUDIT.

    Values are ALERT_CONFIG_DISABLED_AUDIT, ALERT_CONFIG_ENABLED_AUDIT, ALERT_CONFIG_ADDED_AUDIT, ALERT_CONFIG_DELETED_AUDIT, or ALERT_CONFIG_CHANGED_AUDIT.

    Values are API_KEY_CREATED, API_KEY_DELETED, API_KEY_ACCESS_LIST_ENTRY_ADDED, API_KEY_ACCESS_LIST_ENTRY_DELETED, API_KEY_ROLES_CHANGED, API_KEY_DESCRIPTION_CHANGED, API_KEY_ADDED_TO_GROUP, API_KEY_REMOVED_FROM_GROUP, API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.

    Values are SERVICE_ACCOUNT_CREATED, SERVICE_ACCOUNT_DELETED, SERVICE_ACCOUNT_ROLES_CHANGED, SERVICE_ACCOUNT_DETAILS_CHANGED, SERVICE_ACCOUNT_ADDED_TO_GROUP, SERVICE_ACCOUNT_REMOVED_FROM_GROUP, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_ADDED, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_DELETED, SERVICE_ACCOUNT_SECRET_ADDED, SERVICE_ACCOUNT_SECRET_DELETED, SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.

    Values are URL_CONFIRMATION, SUCCESSFUL_DEPLOY, DEPLOYMENT_FAILURE, DEPLOYMENT_MODEL_CHANGE_SUCCESS, DEPLOYMENT_MODEL_CHANGE_FAILURE, REQUEST_RATE_LIMIT, LOG_FORWARDER_FAILURE, INSIDE_REALM_METRIC_THRESHOLD, OUTSIDE_REALM_METRIC_THRESHOLD, SYNC_FAILURE, TRIGGER_FAILURE, or TRIGGER_AUTO_RESUMED.

    Values are AUTO_INDEXING_ENABLED, AUTO_INDEXING_DISABLED, AUTO_INDEXING_INDEX_BUILD_SUBMITTED, AUTO_INDEXING_SLOW_INDEX_BUILD, AUTO_INDEXING_STALLED_INDEX_BUILD, AUTO_INDEXING_FAILED_INDEX_BUILD, AUTO_INDEXING_COMPLETED_INDEX_BUILD, or AUTO_INDEXING_STARTED_INDEX_BUILD.

    Value is AUTOMATION_CONFIG_PUBLISHED_AUDIT.

    Values are PEER_CREATED, PEER_DELETED, or PEER_UPDATED.

    Values are AZURE_PEER_CREATED, AZURE_PEER_UPDATED, AZURE_PEER_ACTIVE, or AZURE_PEER_DELETED.

    Values are CREDIT_CARD_CURRENT, CREDIT_CARD_ABOUT_TO_EXPIRE, PENDING_INVOICE_UNDER_THRESHOLD, PENDING_INVOICE_OVER_THRESHOLD, DAILY_BILL_UNDER_THRESHOLD, or DAILY_BILL_OVER_THRESHOLD.

    Values are CLUSTER_CONNECTION_GET_DATABASES, CLUSTER_CONNECTION_GET_DATABASE_COLLECTIONS, CLUSTER_CONNECTION_GET_DATABASE_NAMESPACES, CLUSTER_CONNECTION_GET_NAMESPACES_WITH_UUID, CLUSTER_CONNECTION_AGGREGATE, CLUSTER_CONNECTION_CREATE_COLLECTION, or CLUSTER_CONNECTION_SAMPLE_COLLECTION_FIELD_NAMES.

    Values are CLUSTER_MONGOS_IS_PRESENT or CLUSTER_MONGOS_IS_MISSING.

    Values are CPS_SNAPSHOT_STARTED, CPS_SNAPSHOT_SUCCESSFUL, CPS_SNAPSHOT_FAILED, CPS_CONCURRENT_SNAPSHOT_FAILED_WILL_RETRY, CPS_SNAPSHOT_FALLBACK_SUCCESSFUL, CPS_SNAPSHOT_BEHIND, CPS_COPY_SNAPSHOT_STARTED, CPS_COPY_SNAPSHOT_FAILED, CPS_COPY_SNAPSHOT_SUCCESSFUL, CPS_PREV_SNAPSHOT_OLD, CPS_SNAPSHOT_FALLBACK_FAILED, CPS_RESTORE_SUCCESSFUL, CPS_EXPORT_SUCCESSFUL, CPS_RESTORE_FAILED, CPS_EXPORT_FAILED, CPS_AUTO_EXPORT_FAILED, CPS_SNAPSHOT_DOWNLOAD_REQUEST_FAILED, CPS_OPLOG_BEHIND, or CPS_OPLOG_CAUGHT_UP.

    Values are DATA_EXPLORER, DATA_EXPLORER_CRUD_ATTEMPT, DATA_EXPLORER_CRUD_ERROR, or DATA_EXPLORER_CRUD.

    Values are CPS_DATA_PROTECTION_ENABLE_REQUESTED, CPS_DATA_PROTECTION_ENABLED, CPS_DATA_PROTECTION_UPDATE_REQUESTED, CPS_DATA_PROTECTION_UPDATED, CPS_DATA_PROTECTION_DISABLE_REQUESTED, or CPS_DATA_PROTECTION_DISABLED.

    Values are CPS_RESTORE_REQUESTED_AUDIT, CPS_SNAPSHOT_SCHEDULE_UPDATED_AUDIT, CPS_SNAPSHOT_FASTER_RESTORES_START_AUDIT, CPS_SNAPSHOT_FASTER_RESTORES_SUCCESS_AUDIT, CPS_SNAPSHOT_FASTER_RESTORES_FAILED_AUDIT, CPS_SNAPSHOT_DELETED_AUDIT, CPS_SNAPSHOT_RETENTION_MODIFIED_AUDIT, CPS_SNAPSHOT_IN_PROGRESS_AUDIT, CPS_SNAPSHOT_COMPLETED_AUDIT, CPS_ON_DEMAND_SNAPSHOT_REQUESTED, CPS_OPLOG_CAUGHT_UP_AUDIT, or CPS_OPLOG_BEHIND_AUDIT.

    Values are AWS_ENCRYPTION_KEY_ROTATED, AWS_ENCRYPTION_KEY_NEEDS_ROTATION, AZURE_ENCRYPTION_KEY_ROTATED, AZURE_ENCRYPTION_KEY_NEEDS_ROTATION, GCP_ENCRYPTION_KEY_ROTATED, GCP_ENCRYPTION_KEY_NEEDS_ROTATION, AWS_ENCRYPTION_KEY_VALID, AWS_ENCRYPTION_KEY_INVALID, AZURE_ENCRYPTION_KEY_VALID, AZURE_ENCRYPTION_KEY_INVALID, GCP_ENCRYPTION_KEY_VALID, or GCP_ENCRYPTION_KEY_INVALID.

    Values are BUCKET_CREATED_AUDIT or BUCKET_DELETED_AUDIT.

    Values are FTS_INDEX_DELETION_FAILED, FTS_INDEX_BUILD_COMPLETE, FTS_INDEX_BUILD_FAILED, FTS_INDEX_CREATED, FTS_INDEX_UPDATED, FTS_INDEX_DELETED, FTS_INDEX_CLEANED_UP, FTS_INDEXES_RESTORED, or FTS_INDEXES_RESTORE_FAILED.

    Values are GCP_PEER_CREATED, GCP_PEER_DELETED, GCP_PEER_UPDATED, GCP_PEER_ACTIVE, or GCP_PEER_INACTIVE.

    Values are DATA_EXPLORER_ENABLED, DATA_EXPLORER_DISABLED, CREDIT_CARD_ADDED, CREDIT_CARD_UPDATED, GROUP_DELETED, GROUP_CREATED, GROUP_MOVED, GROUP_TEMPORARILY_ACTIVATED, GROUP_ACTIVATED, GROUP_LOCKED, GROUP_SUSPENDED, GROUP_FLUSHED, GROUP_NAME_CHANGED, GROUP_CHARTS_ACTIVATION_REQUESTED, GROUP_CHARTS_ACTIVATED, GROUP_CHARTS_UPGRADED, or GROUP_CHARTS_RESET.

    Values are PAID_IN_FULL, DELINQUENT, ALL_USERS_HAVE_MULTI_FACTOR_AUTH, USERS_WITHOUT_MULTI_FACTOR_AUTH, ENCRYPTION_AT_REST_KMS_NETWORK_ACCESS_DENIED, or ENCRYPTION_AT_REST_KMS_NETWORK_ACCESS_RESTORED.

    Values are INTEGRATION_CONFIGURED or INTEGRATION_REMOVED.

    Values are AUTO_CREATED_INDEX_AUDIT, ATTEMPT_KILLOP_AUDIT, ATTEMPT_KILLSESSION_AUDIT, HOST_UP, HOST_DOWN, HOST_HAS_INDEX_SUGGESTIONS, HOST_MONGOT_RECOVERED_OOM, HOST_MONGOT_CRASHING_OOM, HOST_ENOUGH_DISK_SPACE, or HOST_NOT_ENOUGH_DISK_SPACE.

    Values are INSIDE_METRIC_THRESHOLD or OUTSIDE_METRIC_THRESHOLD.

    Values are ROLLING_INDEX_FAILED_INDEX_BUILD, ROLLING_INDEX_SUCCESS_INDEX_BUILD, INDEX_FAILED_INDEX_BUILD, or INDEX_SUCCESS_INDEX_BUILD.

    Values are CLUSTER_CREATED, CLUSTER_RESURRECTED, CLUSTER_READY, CLUSTER_UPDATE_SUBMITTED, CLUSTER_UPDATE_SUBMITTED_INTERNAL, CLUSTER_PROCESS_ARGS_UPDATE_SUBMITTED, CLUSTER_MONGOT_PROCESS_ARGS_UPDATE_SUBMITTED, CLUSTER_SERVER_PARAMETERS_UPDATE_SUBMITTED, CLUSTER_AUTOMATICALLY_PAUSED, CLUSTER_UPDATE_STARTED, CLUSTER_UPDATE_STARTED_INTERNAL, CLUSTER_UPDATE_COMPLETED, MATERIAL_CLUSTER_UPDATE_COMPLETED_INTERNAL, CLUSTER_DELETE_SUBMITTED, CLUSTER_DELETE_SUBMITTED_INTERNAL, CLUSTER_DELETED, CLUSTER_IMPORT_STARTED, CLUSTER_IMPORT_CANCELLED, CLUSTER_IMPORT_EXPIRED, CLUSTER_IMPORT_CUTOVER, CLUSTER_IMPORT_RESTART_REQUESTED, PROJECT_LIVE_IMPORT_OVERRIDES_ADDED, PROJECT_LIVE_IMPORT_OVERRIDES_UPDATED, PROJECT_LIVE_IMPORT_OVERRIDES_DELETED, CLUSTER_OPLOG_RESIZED, CLUSTER_INSTANCE_RESTARTED, CLUSTER_INSTANCE_STOP_START, CLUSTER_INSTANCE_RESYNC_REQUESTED, CLUSTER_INSTANCE_RESYNC_CLEARED, CLUSTER_INSTANCE_UPDATE_REQUESTED, CLUSTER_INSTANCE_REPLACED, CLUSTER_INSTANCE_REPLACE_CLEARED, CLUSTER_INSTANCE_CONFIG_UPDATED, CLUSTER_INSTANCE_SSL_ROTATED, CLUSTER_INSTANCE_SSL_ROTATED_PER_CLUSTER, CLUSTER_INSTANCE_SSL_REVOKED, RELOAD_SSL_ON_PROCESSES, CLUSTER_INSTANCE_ADMIN_BACKUP_SNAPSHOT_REQUESTED, UPDATE_BUMPER_FILES, DATA_LAKE_QUERY_LOGS_DOWNLOADED, FEDERATED_DATABASE_QUERY_LOGS_DOWNLOADED, ONLINE_ARCHIVE_QUERY_LOGS_DOWNLOADED, MONGODB_LOGS_DOWNLOADED, MONGOSQLD_LOGS_DOWNLOADED, MONGODB_USER_ADDED, MONGODB_USER_DELETED, MONGODB_USER_X509_CERT_CREATED, MONGODB_USER_X509_CERT_REVOKED, MONGODB_USER_UPDATED, MONGODB_ROLE_ADDED, MONGODB_ROLE_DELETED, MONGODB_ROLE_UPDATED, NETWORK_PERMISSION_ENTRY_ADDED, NETWORK_PERMISSION_ENTRY_REMOVED, NETWORK_PERMISSION_ENTRY_UPDATED, PRIVATE_NETWORK_ENDPOINT_ENTRY_ADDED, PRIVATE_NETWORK_ENDPOINT_ENTRY_REMOVED, PRIVATE_NETWORK_ENDPOINT_ENTRY_UPDATED, PLAN_STARTED, PLAN_COMPLETED, PLAN_ABANDONED, PLAN_FAILURE_COUNT_RESET, PLAN_ASAP_REQUESTED, INDEPENDENT_SHARD_SCALING_AVAILABLE, MOVE_SKIPPED, PROXY_RESTARTED, PROXY_PANICKED, ATLAS_MAINTENANCE_WINDOW_ADDED, ATLAS_MAINTENANCE_WINDOW_MODIFIED, ATLAS_MAINTENANCE_WINDOW_REMOVED, ATLAS_MAINTENANCE_START_ASAP, ATLAS_MAINTENANCE_SCHEDULED_FOR_NEXT_WINDOW, ATLAS_MAINTENANCE_DEFERRED, ATLAS_MAINTENANCE_AUTO_DEFER_ENABLED, ATLAS_MAINTENANCE_AUTO_DEFER_DISABLED, SCHEDULED_MAINTENANCE, PROJECT_SCHEDULED_MAINTENANCE, PROJECT_LIMIT_UPDATED, PROJECT_OPERATIONAL_LIMIT_UPDATED, PROJECT_ENABLE_EXTENDED_STORAGE_SIZES_UPDATED, OS_MAINTENANCE, OS_MAINTENANCE_RESTART, OS_MAINTENANCE_REPLACEMENT, FREE_UPGRADE_STARTED, TEST_FAILOVER_REQUESTED, USER_SECURITY_SETTINGS_UPDATED, AUDIT_LOG_CONFIGURATION_UPDATED, STREAMS_AUDIT_LOG_CONFIGURATION_UPDATED, ENCRYPTION_AT_REST_CONFIGURATION_UPDATED, ENCRYPTION_AT_REST_CONFIGURATION_VALIDATION_FAILED, NDS_SET_IMAGE_OVERRIDES, NDS_SET_CHEF_TARBALL_URI, RESTRICTED_EMPLOYEE_ACCESS_BYPASS, REVOKED_EMPLOYEE_ACCESS_BYPASS, DEVICE_SYNC_DEBUG_ACCESS_GRANTED, DEVICE_SYNC_DEBUG_ACCESS_REVOKED, DEVICE_SYNC_DEBUG_X509_CERT_CREATED, QUERY_ENGINE_TENANT_CREATED, QUERY_ENGINE_TENANT_UPDATED, QUERY_ENGINE_TENANT_REMOVED, FEDERATED_DATABASE_CREATED, FEDERATED_DATABASE_UPDATED, FEDERATED_DATABASE_REMOVED, TENANT_CLUSTER_UPGRADE_FROM_MTM, TENANT_SNAPSHOT_FAILED, TENANT_RESTORE_FAILED, SAMPLE_DATASET_LOAD_REQUESTED, CUSTOMER_X509_CRL_UPDATED, CONTAINER_SUBNETS_UPDATE_REQUESTED, CLEAR_UNPROVISIONED_TARGET_GROUPS_REQUESTED, ONLINE_ARCHIVE_CREATED, ONLINE_ARCHIVE_DELETED, ONLINE_ARCHIVE_UPDATED, ONLINE_ARCHIVE_PAUSE_REQUESTED, ONLINE_ARCHIVE_PAUSED, ONLINE_ARCHIVE_ACTIVE, ONLINE_ARCHIVE_ORPHANED, ONLINE_ARCHIVE_DATA_EXPIRATION_RULE_ENABLED, ONLINE_ARCHIVE_DATA_EXPIRATION_RULE_UPDATED, ONLINE_ARCHIVE_DATA_EXPIRATION_RULE_DISABLED, CLOUD_PROVIDER_ACCESS_AWS_IAM_ROLE_ADDED, CLOUD_PROVIDER_ACCESS_AWS_IAM_ROLE_DELETED, CLOUD_PROVIDER_ACCESS_AWS_IAM_ROLE_UPDATED, CLOUD_PROVIDER_ACCESS_AZURE_SERVICE_PRINCIPAL_ADDED, CLOUD_PROVIDER_ACCESS_AZURE_SERVICE_PRINCIPAL_DELETED, CLOUD_PROVIDER_ACCESS_AZURE_SERVICE_PRINCIPAL_UPDATED, PENDING_INDEXES_DELETED, PENDING_INDEXES_CANCELED, PROCESS_RESTART_REQUESTED, AUTO_HEALING_ACTION, EXTRA_MAINTENANCE_DEFERRAL_GRANTED, ADMIN_NOTE_UPDATED, GROUP_AUTOMATION_CONFIG_PUBLISHED, CLUSTER_AUTOMATION_CONFIG_PUBLISHED, SET_ENSURE_CLUSTER_CONNECTIVITY_AFTER_FOR_CLUSTER, CLUSTER_LINKED_TO_VERCEL, CLUSTER_UNLINKED_FROM_VERCEL, INGESTION_PIPELINE_DELETED, INGESTION_PIPELINE_DESTROYED, INGESTION_PIPELINE_CREATED, INGESTION_PIPELINE_UPDATED, OS_TUNE_FILE_OVERRIDES, CLUSTER_PREFERRED_CPU_ARCHITECTURE_MODIFIED, CLUSTER_FORCE_PLANNED, DATA_PROCESSING_REGION_UPDATED, CLUSTER_REGIONAL_OUTAGE_SIMULATION_STARTED, CLUSTER_REGIONAL_OUTAGE_SIMULATION_FAILED_TO_START, CLUSTER_REGIONAL_OUTAGE_SIMULATION_END_REQUESTED, CLUSTER_REGIONAL_OUTAGE_SIMULATION_COMPLETED, CLUSTER_REGIONAL_OUTAGE_SIMULATION_CANCELLED_CLUSTER_PAUSE, UIS_PANICKED, TENANT_UPGRADE_TO_SERVERLESS_SUCCESSFUL, TENANT_UPGRADE_TO_SERVERLESS_FAILED, CLUSTER_FORCE_RECONFIG_REQUESTED, PROJECT_BYPASSED_MAINTENANCE, DATA_FEDERATION_QUERY_LIMIT_CONFIGURED, DATA_FEDERATION_QUERY_LIMIT_DELETED, DATA_API_SETUP_FOR_VERCEL, ADMIN_CLUSTER_LOCK_UPDATED, CLUSTER_ROLLING_RESYNC_STARTED, CLUSTER_ROLLING_RESYNC_COMPLETED, CLUSTER_ROLLING_RESYNC_FAILED, NODE_ROLLING_RESYNC_SCHEDULED, CLUSTER_ROLLING_RESYNC_CANCELED, CLUSTER_OS_UPDATED, CLUSTER_INSTANCE_FAMILY_UPDATED, PUSH_BASED_LOG_EXPORT_ENABLED, PUSH_BASED_LOG_EXPORT_CONFIGURATION_UPDATED, PUSH_BASED_LOG_EXPORT_DISABLED, AZURE_CLUSTER_PREFERRED_STORAGE_TYPE_UPDATED, CONTAINER_DELETED, REGIONALIZED_PRIVATE_ENDPOINT_MODE_ENABLED, REGIONALIZED_PRIVATE_ENDPOINT_MODE_DISABLED, STREAM_TENANT_CREATED, STREAM_TENANT_UPDATED, STREAM_TENANT_DELETED, STREAM_TENANT_CONNECTIONS_LISTED, STREAM_TENANT_CONNECTION_UPDATED, STREAM_TENANT_CONNECTION_DELETED, STREAM_TENANT_CONNECTION_CREATED, STREAM_TENANT_CONNECTION_VIEWED, STREAM_TENANT_AUDIT_LOGS, STREAM_TENANT_AUDIT_LOGS_DELETED, QUEUED_ADMIN_ACTION_CREATED, ATLAS_SQL_SCHEDULED_UPDATE_CREATED, ATLAS_SQL_SCHEDULED_UPDATE_MODIFIED, or ATLAS_SQL_SCHEDULED_UPDATE_REMOVED.

    Values are DB_CHECK_SUBMITTED, DB_CHECK_UPDATED, CLUSTER_SAMPLED_FOR_DB_CHECK, DB_CHECK_SCHEDULED_FOR_CLUSTER, DB_CHECK_DEFERRED_FOR_CLUSTER, or CLUSTER_OPTED_OUT_OF_DB_CHECK.

    Values are CLUSTER_SAMPLED_FOR_DATA_VALIDATION, DATA_VALIDATION_SUBMITTED_FOR_CLUSTER, or CLUSTER_OPTED_OUT_OF_DATA_VALIDATION.

    Values are COMPUTE_AUTO_SCALE_INITIATED, DISK_AUTO_SCALE_INITIATED, COMPUTE_AUTO_SCALE_INITIATED_BASE, COMPUTE_AUTO_SCALE_INITIATED_ANALYTICS, COMPUTE_AUTO_SCALE_SCALE_DOWN_FAIL_BASE, COMPUTE_AUTO_SCALE_SCALE_DOWN_FAIL_ANALYTICS, COMPUTE_AUTO_SCALE_MAX_INSTANCE_SIZE_FAIL_BASE, COMPUTE_AUTO_SCALE_MAX_INSTANCE_SIZE_FAIL_ANALYTICS, COMPUTE_AUTO_SCALE_OPLOG_FAIL_BASE, COMPUTE_AUTO_SCALE_OPLOG_FAIL_ANALYTICS, DISK_AUTO_SCALE_MAX_DISK_SIZE_FAIL, or DISK_AUTO_SCALE_OPLOG_FAIL.

    Values are MAINTENANCE_IN_ADVANCED, MAINTENANCE_AUTO_DEFERRED, MAINTENANCE_STARTED, or MAINTENANCE_NO_LONGER_NEEDED.

    Values are SERVERLESS_AUTO_SCALING_INITIATED, SERVERLESS_VERTICAL_SCALING_INITIATED, SERVERLESS_HORIZONTAL_SCALING_INITIATED, SERVERLESS_MTM_DRAIN_REQUESTED, SERVERLESS_MTM_DRAIN_INITIATED, SERVERLESS_MTM_DRAIN_COMPLETED, or SERVERLESS_MTM_DRAIN_STOPPED.

    Values are SERVERLESS_INSTANCE_CREATED, SERVERLESS_INSTANCE_READY, SERVERLESS_INSTANCE_UPDATE_SUBMITTED, SERVERLESS_INSTANCE_UPDATE_STARTED, SERVERLESS_INSTANCE_UPDATE_COMPLETED, SERVERLESS_INSTANCE_DELETE_SUBMITTED, SERVERLESS_INSTANCE_DELETED, SERVERLESS_INSTANCE_BLOCKED, or SERVERLESS_INSTANCE_UNBLOCKED.

    Values are TENANT_ENDPOINT_CREATED, TENANT_ENDPOINT_RESERVED, TENANT_ENDPOINT_RESERVATION_FAILED, TENANT_ENDPOINT_UPDATED, TENANT_ENDPOINT_INITIATING, TENANT_ENDPOINT_AVAILABLE, TENANT_ENDPOINT_FAILED, TENANT_ENDPOINT_DELETING, TENANT_ENDPOINT_DELETED, or TENANT_ENDPOINT_EXPIRED.

    Values are TENANT_ENDPOINT_SERVICE_DEPLOYMENT_CREATED, TENANT_ENDPOINT_SERVICE_CREATED, TENANT_ENDPOINT_SERVICE_AVAILABLE, TENANT_ENDPOINT_SERVICE_DEPLOYMENT_DELETE_REQUESTED, TENANT_ENDPOINT_SERVICE_DELETED, TENANT_ENDPOINT_SERVICE_DEPLOYMENT_DELETED, or TENANT_ENDPOINT_SERVICE_DEPLOYMENT_NUM_DESIRED_ENDPOINT_SERVICES_INCREASED.

    Values are NDS_X509_USER_AUTHENTICATION_CUSTOMER_CA_EXPIRATION_RESOLVED, NDS_X509_USER_AUTHENTICATION_CUSTOMER_CA_EXPIRATION_CHECK, NDS_X509_USER_AUTHENTICATION_CUSTOMER_CRL_EXPIRATION_RESOLVED, NDS_X509_USER_AUTHENTICATION_CUSTOMER_CRL_EXPIRATION_CHECK, NDS_X509_USER_AUTHENTICATION_MANAGED_USER_CERTS_EXPIRATION_RESOLVED, or NDS_X509_USER_AUTHENTICATION_MANAGED_USER_CERTS_EXPIRATION_CHECK.

    Values are ONLINE_ARCHIVE_INSUFFICIENT_INDEXES_CHECK, ONLINE_ARCHIVE_INSUFFICIENT_INDEXES_RESOLVED, ONLINE_ARCHIVE_UP_TO_DATE, ONLINE_ARCHIVE_DATA_EXPIRATION_RESOLVED, or ONLINE_ARCHIVE_MAX_CONSECUTIVE_OFFLOAD_WINDOWS_CHECK.

    Value is PROACTIVE_OPERATION_EVENT_LOGGED.

    Values are PRIMARY_ELECTED, REPLICATION_OPLOG_WINDOW_HEALTHY, REPLICATION_OPLOG_WINDOW_RUNNING_OUT, ONE_PRIMARY, NO_PRIMARY, or TOO_MANY_ELECTIONS.

    Values are SEARCH_DEPLOYMENT_CREATED, SEARCH_DEPLOYMENT_UPDATED, or SEARCH_DEPLOYMENT_DELETED.

    Values are SERVERLESS_DEPLOYMENT_CREATED, SERVERLESS_DEPLOYMENT_DELETED, SERVERLESS_DEPLOYMENT_UPDATED, SERVERLESS_DEPLOYMENT_INSTANCE_REPLACED, SERVERLESS_DEPLOYMENT_INSTANCE_REBOOTED, SERVERLESS_DEPLOYMENT_ENDPOINT_SERVICE_LINKED, SERVERLESS_DEPLOYMENT_ENDPOINT_SERVICE_UNLINKED, or SERVERLESS_DEPLOYMENT_ENVOY_INSTANCE_UIS_KEYS_ROTATED.

    Values are INSIDE_SERVERLESS_METRIC_THRESHOLD or OUTSIDE_SERVERLESS_METRIC_THRESHOLD.

    Value is SETUP_SERVERLESS_INITIATED.

    Value is MAX_PROCESSOR_COUNT_REACHED.

    Value is STREAM_PROCESSOR_STATE_IS_FAILED.

    Value is CASE_CREATED.

    Values are SUPPORT_EMAILS_SENT_SUCCESSFULLY or SUPPORT_EMAILS_SENT_FAILURE.

    Values are TEAM_ADDED_TO_GROUP, TEAM_REMOVED_FROM_GROUP, or TEAM_ROLES_MODIFIED.

    Values are TENANT_SNAPSHOT_STARTED_AUDIT, TENANT_SNAPSHOT_COMPLETED_AUDIT, TENANT_SNAPSHOT_DELETED_AUDIT, TENANT_RESTORE_REQUESTED_AUDIT, TENANT_RESTORE_COMPLETED_AUDIT, or TENANT_SNAPSHOT_DOWNLOAD_REQUESTED_AUDIT.

    Values are JOINED_GROUP, REMOVED_FROM_GROUP, INVITED_TO_GROUP, REQUESTED_TO_JOIN_GROUP, GROUP_INVITATION_DELETED, USER_ROLES_CHANGED_AUDIT, JOIN_GROUP_REQUEST_DENIED_AUDIT, or JOIN_GROUP_REQUEST_APPROVED_AUDIT.

    Values are CLUSTER_VERSION_FIXED, CLUSTER_VERSION_UNFIXED, CLUSTER_FCV_FIXED, CLUSTER_FCV_UNFIXED, AGENT_VERSION_FIXED, AGENT_VERSION_UNFIXED, FIXED_VERSION_UPDATED, FIXED_AGENT_VERSION_UPDATED, or CLUSTER_FCV_DOWNGRADED.

    Values are TAGS_MODIFIED or GROUP_TAGS_MODIFIED.

  • excludedEventType array[object | string]

    Category of event that you would like to exclude from query results, such as CLUSTER_CREATED

    IMPORTANT: Event type names change frequently. Verify that you specify the event type correctly by checking the complete list of event types.

    One of:
    Alert Audit Types string Alert Audit Types string API User Event Types string Service Account Event Types string App Services Event Types string Auto Indexing Event Types string Automation Config Event Types string AWS Peer Vpc Audit Types string Azure Peer Network Audit Types string Billing Event Types string Cluster Connection Audit Types string Cluster Event Types string Cps Backup Event Types string Data Explorer Accessed Event Types string CPS Backup Compliance Policy Event Types string Disk Backup Event Types string Encryption Event Types string Export Bucket Audit Types string FTS Index Audit Types string GCP Peer Vpc Audit Types string Group Audit Types string Group Event Types string Group Integration Event Types string Host Event Types string Host Metric Event Types string Index Build Audit Types string NDS Audit Types string NDS DB Check Audit Types string NDS Data Validation Audit Types string NDS Auto Scaling Audit Types string NDS Maintenance Window Audit Types string NDS Serverless Auto Scaling Audit Types string NDS Serverless Instance Audit Types string NDS Auto Scaling Audit Types string NDS Tenant Endpoint Service Deployment Audit Types string NDS x509 User Auth Event Types string Online Archive Event Types string Private Link Audit Types string Proactive Operation Event Types string ReplicaSet Event Types string Search Deployment Audit Types string Serverless Deployment Audit Types string Serverless Event Types string Setup Serverless Audit Types string Streams Event Types string Stream Processor Event Types string Support Case Event Types string Support Event Types string Team Event Types string Tenant Backup Event Types string User Event Types string Version Audit Types string Resource Event Types string

    Values are ALERT_ACKNOWLEDGED_AUDIT or ALERT_UNACKNOWLEDGED_AUDIT.

    Values are ALERT_CONFIG_DISABLED_AUDIT, ALERT_CONFIG_ENABLED_AUDIT, ALERT_CONFIG_ADDED_AUDIT, ALERT_CONFIG_DELETED_AUDIT, or ALERT_CONFIG_CHANGED_AUDIT.

    Values are API_KEY_CREATED, API_KEY_DELETED, API_KEY_ACCESS_LIST_ENTRY_ADDED, API_KEY_ACCESS_LIST_ENTRY_DELETED, API_KEY_ROLES_CHANGED, API_KEY_DESCRIPTION_CHANGED, API_KEY_ADDED_TO_GROUP, API_KEY_REMOVED_FROM_GROUP, API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.

    Values are SERVICE_ACCOUNT_CREATED, SERVICE_ACCOUNT_DELETED, SERVICE_ACCOUNT_ROLES_CHANGED, SERVICE_ACCOUNT_DETAILS_CHANGED, SERVICE_ACCOUNT_ADDED_TO_GROUP, SERVICE_ACCOUNT_REMOVED_FROM_GROUP, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_ADDED, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_DELETED, SERVICE_ACCOUNT_SECRET_ADDED, SERVICE_ACCOUNT_SECRET_DELETED, SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.

    Values are URL_CONFIRMATION, SUCCESSFUL_DEPLOY, DEPLOYMENT_FAILURE, DEPLOYMENT_MODEL_CHANGE_SUCCESS, DEPLOYMENT_MODEL_CHANGE_FAILURE, REQUEST_RATE_LIMIT, LOG_FORWARDER_FAILURE, INSIDE_REALM_METRIC_THRESHOLD, OUTSIDE_REALM_METRIC_THRESHOLD, SYNC_FAILURE, TRIGGER_FAILURE, or TRIGGER_AUTO_RESUMED.

    Values are AUTO_INDEXING_ENABLED, AUTO_INDEXING_DISABLED, AUTO_INDEXING_INDEX_BUILD_SUBMITTED, AUTO_INDEXING_SLOW_INDEX_BUILD, AUTO_INDEXING_STALLED_INDEX_BUILD, AUTO_INDEXING_FAILED_INDEX_BUILD, AUTO_INDEXING_COMPLETED_INDEX_BUILD, or AUTO_INDEXING_STARTED_INDEX_BUILD.

    Value is AUTOMATION_CONFIG_PUBLISHED_AUDIT.

    Values are PEER_CREATED, PEER_DELETED, or PEER_UPDATED.

    Values are AZURE_PEER_CREATED, AZURE_PEER_UPDATED, AZURE_PEER_ACTIVE, or AZURE_PEER_DELETED.

    Values are CREDIT_CARD_CURRENT, CREDIT_CARD_ABOUT_TO_EXPIRE, PENDING_INVOICE_UNDER_THRESHOLD, PENDING_INVOICE_OVER_THRESHOLD, DAILY_BILL_UNDER_THRESHOLD, or DAILY_BILL_OVER_THRESHOLD.

    Values are CLUSTER_CONNECTION_GET_DATABASES, CLUSTER_CONNECTION_GET_DATABASE_COLLECTIONS, CLUSTER_CONNECTION_GET_DATABASE_NAMESPACES, CLUSTER_CONNECTION_GET_NAMESPACES_WITH_UUID, CLUSTER_CONNECTION_AGGREGATE, CLUSTER_CONNECTION_CREATE_COLLECTION, or CLUSTER_CONNECTION_SAMPLE_COLLECTION_FIELD_NAMES.

    Values are CLUSTER_MONGOS_IS_PRESENT or CLUSTER_MONGOS_IS_MISSING.

    Values are CPS_SNAPSHOT_STARTED, CPS_SNAPSHOT_SUCCESSFUL, CPS_SNAPSHOT_FAILED, CPS_CONCURRENT_SNAPSHOT_FAILED_WILL_RETRY, CPS_SNAPSHOT_FALLBACK_SUCCESSFUL, CPS_SNAPSHOT_BEHIND, CPS_COPY_SNAPSHOT_STARTED, CPS_COPY_SNAPSHOT_FAILED, CPS_COPY_SNAPSHOT_SUCCESSFUL, CPS_PREV_SNAPSHOT_OLD, CPS_SNAPSHOT_FALLBACK_FAILED, CPS_RESTORE_SUCCESSFUL, CPS_EXPORT_SUCCESSFUL, CPS_RESTORE_FAILED, CPS_EXPORT_FAILED, CPS_AUTO_EXPORT_FAILED, CPS_SNAPSHOT_DOWNLOAD_REQUEST_FAILED, CPS_OPLOG_BEHIND, or CPS_OPLOG_CAUGHT_UP.

    Values are DATA_EXPLORER, DATA_EXPLORER_CRUD_ATTEMPT, DATA_EXPLORER_CRUD_ERROR, or DATA_EXPLORER_CRUD.

    Values are CPS_DATA_PROTECTION_ENABLE_REQUESTED, CPS_DATA_PROTECTION_ENABLED, CPS_DATA_PROTECTION_UPDATE_REQUESTED, CPS_DATA_PROTECTION_UPDATED, CPS_DATA_PROTECTION_DISABLE_REQUESTED, or CPS_DATA_PROTECTION_DISABLED.

    Values are CPS_RESTORE_REQUESTED_AUDIT, CPS_SNAPSHOT_SCHEDULE_UPDATED_AUDIT, CPS_SNAPSHOT_FASTER_RESTORES_START_AUDIT, CPS_SNAPSHOT_FASTER_RESTORES_SUCCESS_AUDIT, CPS_SNAPSHOT_FASTER_RESTORES_FAILED_AUDIT, CPS_SNAPSHOT_DELETED_AUDIT, CPS_SNAPSHOT_RETENTION_MODIFIED_AUDIT, CPS_SNAPSHOT_IN_PROGRESS_AUDIT, CPS_SNAPSHOT_COMPLETED_AUDIT, CPS_ON_DEMAND_SNAPSHOT_REQUESTED, CPS_OPLOG_CAUGHT_UP_AUDIT, or CPS_OPLOG_BEHIND_AUDIT.

    Values are AWS_ENCRYPTION_KEY_ROTATED, AWS_ENCRYPTION_KEY_NEEDS_ROTATION, AZURE_ENCRYPTION_KEY_ROTATED, AZURE_ENCRYPTION_KEY_NEEDS_ROTATION, GCP_ENCRYPTION_KEY_ROTATED, GCP_ENCRYPTION_KEY_NEEDS_ROTATION, AWS_ENCRYPTION_KEY_VALID, AWS_ENCRYPTION_KEY_INVALID, AZURE_ENCRYPTION_KEY_VALID, AZURE_ENCRYPTION_KEY_INVALID, GCP_ENCRYPTION_KEY_VALID, or GCP_ENCRYPTION_KEY_INVALID.

    Values are BUCKET_CREATED_AUDIT or BUCKET_DELETED_AUDIT.

    Values are FTS_INDEX_DELETION_FAILED, FTS_INDEX_BUILD_COMPLETE, FTS_INDEX_BUILD_FAILED, FTS_INDEX_CREATED, FTS_INDEX_UPDATED, FTS_INDEX_DELETED, FTS_INDEX_CLEANED_UP, FTS_INDEXES_RESTORED, or FTS_INDEXES_RESTORE_FAILED.

    Values are GCP_PEER_CREATED, GCP_PEER_DELETED, GCP_PEER_UPDATED, GCP_PEER_ACTIVE, or GCP_PEER_INACTIVE.

    Values are DATA_EXPLORER_ENABLED, DATA_EXPLORER_DISABLED, CREDIT_CARD_ADDED, CREDIT_CARD_UPDATED, GROUP_DELETED, GROUP_CREATED, GROUP_MOVED, GROUP_TEMPORARILY_ACTIVATED, GROUP_ACTIVATED, GROUP_LOCKED, GROUP_SUSPENDED, GROUP_FLUSHED, GROUP_NAME_CHANGED, GROUP_CHARTS_ACTIVATION_REQUESTED, GROUP_CHARTS_ACTIVATED, GROUP_CHARTS_UPGRADED, or GROUP_CHARTS_RESET.

    Values are PAID_IN_FULL, DELINQUENT, ALL_USERS_HAVE_MULTI_FACTOR_AUTH, USERS_WITHOUT_MULTI_FACTOR_AUTH, ENCRYPTION_AT_REST_KMS_NETWORK_ACCESS_DENIED, or ENCRYPTION_AT_REST_KMS_NETWORK_ACCESS_RESTORED.

    Values are INTEGRATION_CONFIGURED or INTEGRATION_REMOVED.

    Values are AUTO_CREATED_INDEX_AUDIT, ATTEMPT_KILLOP_AUDIT, ATTEMPT_KILLSESSION_AUDIT, HOST_UP, HOST_DOWN, HOST_HAS_INDEX_SUGGESTIONS, HOST_MONGOT_RECOVERED_OOM, HOST_MONGOT_CRASHING_OOM, HOST_ENOUGH_DISK_SPACE, or HOST_NOT_ENOUGH_DISK_SPACE.

    Values are INSIDE_METRIC_THRESHOLD or OUTSIDE_METRIC_THRESHOLD.

    Values are ROLLING_INDEX_FAILED_INDEX_BUILD, ROLLING_INDEX_SUCCESS_INDEX_BUILD, INDEX_FAILED_INDEX_BUILD, or INDEX_SUCCESS_INDEX_BUILD.

    Values are CLUSTER_CREATED, CLUSTER_RESURRECTED, CLUSTER_READY, CLUSTER_UPDATE_SUBMITTED, CLUSTER_UPDATE_SUBMITTED_INTERNAL, CLUSTER_PROCESS_ARGS_UPDATE_SUBMITTED, CLUSTER_MONGOT_PROCESS_ARGS_UPDATE_SUBMITTED, CLUSTER_SERVER_PARAMETERS_UPDATE_SUBMITTED, CLUSTER_AUTOMATICALLY_PAUSED, CLUSTER_UPDATE_STARTED, CLUSTER_UPDATE_STARTED_INTERNAL, CLUSTER_UPDATE_COMPLETED, MATERIAL_CLUSTER_UPDATE_COMPLETED_INTERNAL, CLUSTER_DELETE_SUBMITTED, CLUSTER_DELETE_SUBMITTED_INTERNAL, CLUSTER_DELETED, CLUSTER_IMPORT_STARTED, CLUSTER_IMPORT_CANCELLED, CLUSTER_IMPORT_EXPIRED, CLUSTER_IMPORT_CUTOVER, CLUSTER_IMPORT_RESTART_REQUESTED, PROJECT_LIVE_IMPORT_OVERRIDES_ADDED, PROJECT_LIVE_IMPORT_OVERRIDES_UPDATED, PROJECT_LIVE_IMPORT_OVERRIDES_DELETED, CLUSTER_OPLOG_RESIZED, CLUSTER_INSTANCE_RESTARTED, CLUSTER_INSTANCE_STOP_START, CLUSTER_INSTANCE_RESYNC_REQUESTED, CLUSTER_INSTANCE_RESYNC_CLEARED, CLUSTER_INSTANCE_UPDATE_REQUESTED, CLUSTER_INSTANCE_REPLACED, CLUSTER_INSTANCE_REPLACE_CLEARED, CLUSTER_INSTANCE_CONFIG_UPDATED, CLUSTER_INSTANCE_SSL_ROTATED, CLUSTER_INSTANCE_SSL_ROTATED_PER_CLUSTER, CLUSTER_INSTANCE_SSL_REVOKED, RELOAD_SSL_ON_PROCESSES, CLUSTER_INSTANCE_ADMIN_BACKUP_SNAPSHOT_REQUESTED, UPDATE_BUMPER_FILES, DATA_LAKE_QUERY_LOGS_DOWNLOADED, FEDERATED_DATABASE_QUERY_LOGS_DOWNLOADED, ONLINE_ARCHIVE_QUERY_LOGS_DOWNLOADED, MONGODB_LOGS_DOWNLOADED, MONGOSQLD_LOGS_DOWNLOADED, MONGODB_USER_ADDED, MONGODB_USER_DELETED, MONGODB_USER_X509_CERT_CREATED, MONGODB_USER_X509_CERT_REVOKED, MONGODB_USER_UPDATED, MONGODB_ROLE_ADDED, MONGODB_ROLE_DELETED, MONGODB_ROLE_UPDATED, NETWORK_PERMISSION_ENTRY_ADDED, NETWORK_PERMISSION_ENTRY_REMOVED, NETWORK_PERMISSION_ENTRY_UPDATED, PRIVATE_NETWORK_ENDPOINT_ENTRY_ADDED, PRIVATE_NETWORK_ENDPOINT_ENTRY_REMOVED, PRIVATE_NETWORK_ENDPOINT_ENTRY_UPDATED, PLAN_STARTED, PLAN_COMPLETED, PLAN_ABANDONED, PLAN_FAILURE_COUNT_RESET, PLAN_ASAP_REQUESTED, INDEPENDENT_SHARD_SCALING_AVAILABLE, MOVE_SKIPPED, PROXY_RESTARTED, PROXY_PANICKED, ATLAS_MAINTENANCE_WINDOW_ADDED, ATLAS_MAINTENANCE_WINDOW_MODIFIED, ATLAS_MAINTENANCE_WINDOW_REMOVED, ATLAS_MAINTENANCE_START_ASAP, ATLAS_MAINTENANCE_SCHEDULED_FOR_NEXT_WINDOW, ATLAS_MAINTENANCE_DEFERRED, ATLAS_MAINTENANCE_AUTO_DEFER_ENABLED, ATLAS_MAINTENANCE_AUTO_DEFER_DISABLED, SCHEDULED_MAINTENANCE, PROJECT_SCHEDULED_MAINTENANCE, PROJECT_LIMIT_UPDATED, PROJECT_OPERATIONAL_LIMIT_UPDATED, PROJECT_ENABLE_EXTENDED_STORAGE_SIZES_UPDATED, OS_MAINTENANCE, OS_MAINTENANCE_RESTART, OS_MAINTENANCE_REPLACEMENT, FREE_UPGRADE_STARTED, TEST_FAILOVER_REQUESTED, USER_SECURITY_SETTINGS_UPDATED, AUDIT_LOG_CONFIGURATION_UPDATED, STREAMS_AUDIT_LOG_CONFIGURATION_UPDATED, ENCRYPTION_AT_REST_CONFIGURATION_UPDATED, ENCRYPTION_AT_REST_CONFIGURATION_VALIDATION_FAILED, NDS_SET_IMAGE_OVERRIDES, NDS_SET_CHEF_TARBALL_URI, RESTRICTED_EMPLOYEE_ACCESS_BYPASS, REVOKED_EMPLOYEE_ACCESS_BYPASS, DEVICE_SYNC_DEBUG_ACCESS_GRANTED, DEVICE_SYNC_DEBUG_ACCESS_REVOKED, DEVICE_SYNC_DEBUG_X509_CERT_CREATED, QUERY_ENGINE_TENANT_CREATED, QUERY_ENGINE_TENANT_UPDATED, QUERY_ENGINE_TENANT_REMOVED, FEDERATED_DATABASE_CREATED, FEDERATED_DATABASE_UPDATED, FEDERATED_DATABASE_REMOVED, TENANT_CLUSTER_UPGRADE_FROM_MTM, TENANT_SNAPSHOT_FAILED, TENANT_RESTORE_FAILED, SAMPLE_DATASET_LOAD_REQUESTED, CUSTOMER_X509_CRL_UPDATED, CONTAINER_SUBNETS_UPDATE_REQUESTED, CLEAR_UNPROVISIONED_TARGET_GROUPS_REQUESTED, ONLINE_ARCHIVE_CREATED, ONLINE_ARCHIVE_DELETED, ONLINE_ARCHIVE_UPDATED, ONLINE_ARCHIVE_PAUSE_REQUESTED, ONLINE_ARCHIVE_PAUSED, ONLINE_ARCHIVE_ACTIVE, ONLINE_ARCHIVE_ORPHANED, ONLINE_ARCHIVE_DATA_EXPIRATION_RULE_ENABLED, ONLINE_ARCHIVE_DATA_EXPIRATION_RULE_UPDATED, ONLINE_ARCHIVE_DATA_EXPIRATION_RULE_DISABLED, CLOUD_PROVIDER_ACCESS_AWS_IAM_ROLE_ADDED, CLOUD_PROVIDER_ACCESS_AWS_IAM_ROLE_DELETED, CLOUD_PROVIDER_ACCESS_AWS_IAM_ROLE_UPDATED, CLOUD_PROVIDER_ACCESS_AZURE_SERVICE_PRINCIPAL_ADDED, CLOUD_PROVIDER_ACCESS_AZURE_SERVICE_PRINCIPAL_DELETED, CLOUD_PROVIDER_ACCESS_AZURE_SERVICE_PRINCIPAL_UPDATED, PENDING_INDEXES_DELETED, PENDING_INDEXES_CANCELED, PROCESS_RESTART_REQUESTED, AUTO_HEALING_ACTION, EXTRA_MAINTENANCE_DEFERRAL_GRANTED, ADMIN_NOTE_UPDATED, GROUP_AUTOMATION_CONFIG_PUBLISHED, CLUSTER_AUTOMATION_CONFIG_PUBLISHED, SET_ENSURE_CLUSTER_CONNECTIVITY_AFTER_FOR_CLUSTER, CLUSTER_LINKED_TO_VERCEL, CLUSTER_UNLINKED_FROM_VERCEL, INGESTION_PIPELINE_DELETED, INGESTION_PIPELINE_DESTROYED, INGESTION_PIPELINE_CREATED, INGESTION_PIPELINE_UPDATED, OS_TUNE_FILE_OVERRIDES, CLUSTER_PREFERRED_CPU_ARCHITECTURE_MODIFIED, CLUSTER_FORCE_PLANNED, DATA_PROCESSING_REGION_UPDATED, CLUSTER_REGIONAL_OUTAGE_SIMULATION_STARTED, CLUSTER_REGIONAL_OUTAGE_SIMULATION_FAILED_TO_START, CLUSTER_REGIONAL_OUTAGE_SIMULATION_END_REQUESTED, CLUSTER_REGIONAL_OUTAGE_SIMULATION_COMPLETED, CLUSTER_REGIONAL_OUTAGE_SIMULATION_CANCELLED_CLUSTER_PAUSE, UIS_PANICKED, TENANT_UPGRADE_TO_SERVERLESS_SUCCESSFUL, TENANT_UPGRADE_TO_SERVERLESS_FAILED, CLUSTER_FORCE_RECONFIG_REQUESTED, PROJECT_BYPASSED_MAINTENANCE, DATA_FEDERATION_QUERY_LIMIT_CONFIGURED, DATA_FEDERATION_QUERY_LIMIT_DELETED, DATA_API_SETUP_FOR_VERCEL, ADMIN_CLUSTER_LOCK_UPDATED, CLUSTER_ROLLING_RESYNC_STARTED, CLUSTER_ROLLING_RESYNC_COMPLETED, CLUSTER_ROLLING_RESYNC_FAILED, NODE_ROLLING_RESYNC_SCHEDULED, CLUSTER_ROLLING_RESYNC_CANCELED, CLUSTER_OS_UPDATED, CLUSTER_INSTANCE_FAMILY_UPDATED, PUSH_BASED_LOG_EXPORT_ENABLED, PUSH_BASED_LOG_EXPORT_CONFIGURATION_UPDATED, PUSH_BASED_LOG_EXPORT_DISABLED, AZURE_CLUSTER_PREFERRED_STORAGE_TYPE_UPDATED, CONTAINER_DELETED, REGIONALIZED_PRIVATE_ENDPOINT_MODE_ENABLED, REGIONALIZED_PRIVATE_ENDPOINT_MODE_DISABLED, STREAM_TENANT_CREATED, STREAM_TENANT_UPDATED, STREAM_TENANT_DELETED, STREAM_TENANT_CONNECTIONS_LISTED, STREAM_TENANT_CONNECTION_UPDATED, STREAM_TENANT_CONNECTION_DELETED, STREAM_TENANT_CONNECTION_CREATED, STREAM_TENANT_CONNECTION_VIEWED, STREAM_TENANT_AUDIT_LOGS, STREAM_TENANT_AUDIT_LOGS_DELETED, QUEUED_ADMIN_ACTION_CREATED, ATLAS_SQL_SCHEDULED_UPDATE_CREATED, ATLAS_SQL_SCHEDULED_UPDATE_MODIFIED, or ATLAS_SQL_SCHEDULED_UPDATE_REMOVED.

    Values are DB_CHECK_SUBMITTED, DB_CHECK_UPDATED, CLUSTER_SAMPLED_FOR_DB_CHECK, DB_CHECK_SCHEDULED_FOR_CLUSTER, DB_CHECK_DEFERRED_FOR_CLUSTER, or CLUSTER_OPTED_OUT_OF_DB_CHECK.

    Values are CLUSTER_SAMPLED_FOR_DATA_VALIDATION, DATA_VALIDATION_SUBMITTED_FOR_CLUSTER, or CLUSTER_OPTED_OUT_OF_DATA_VALIDATION.

    Values are COMPUTE_AUTO_SCALE_INITIATED, DISK_AUTO_SCALE_INITIATED, COMPUTE_AUTO_SCALE_INITIATED_BASE, COMPUTE_AUTO_SCALE_INITIATED_ANALYTICS, COMPUTE_AUTO_SCALE_SCALE_DOWN_FAIL_BASE, COMPUTE_AUTO_SCALE_SCALE_DOWN_FAIL_ANALYTICS, COMPUTE_AUTO_SCALE_MAX_INSTANCE_SIZE_FAIL_BASE, COMPUTE_AUTO_SCALE_MAX_INSTANCE_SIZE_FAIL_ANALYTICS, COMPUTE_AUTO_SCALE_OPLOG_FAIL_BASE, COMPUTE_AUTO_SCALE_OPLOG_FAIL_ANALYTICS, DISK_AUTO_SCALE_MAX_DISK_SIZE_FAIL, or DISK_AUTO_SCALE_OPLOG_FAIL.

    Values are MAINTENANCE_IN_ADVANCED, MAINTENANCE_AUTO_DEFERRED, MAINTENANCE_STARTED, or MAINTENANCE_NO_LONGER_NEEDED.

    Values are SERVERLESS_AUTO_SCALING_INITIATED, SERVERLESS_VERTICAL_SCALING_INITIATED, SERVERLESS_HORIZONTAL_SCALING_INITIATED, SERVERLESS_MTM_DRAIN_REQUESTED, SERVERLESS_MTM_DRAIN_INITIATED, SERVERLESS_MTM_DRAIN_COMPLETED, or SERVERLESS_MTM_DRAIN_STOPPED.

    Values are SERVERLESS_INSTANCE_CREATED, SERVERLESS_INSTANCE_READY, SERVERLESS_INSTANCE_UPDATE_SUBMITTED, SERVERLESS_INSTANCE_UPDATE_STARTED, SERVERLESS_INSTANCE_UPDATE_COMPLETED, SERVERLESS_INSTANCE_DELETE_SUBMITTED, SERVERLESS_INSTANCE_DELETED, SERVERLESS_INSTANCE_BLOCKED, or SERVERLESS_INSTANCE_UNBLOCKED.

    Values are TENANT_ENDPOINT_CREATED, TENANT_ENDPOINT_RESERVED, TENANT_ENDPOINT_RESERVATION_FAILED, TENANT_ENDPOINT_UPDATED, TENANT_ENDPOINT_INITIATING, TENANT_ENDPOINT_AVAILABLE, TENANT_ENDPOINT_FAILED, TENANT_ENDPOINT_DELETING, TENANT_ENDPOINT_DELETED, or TENANT_ENDPOINT_EXPIRED.

    Values are TENANT_ENDPOINT_SERVICE_DEPLOYMENT_CREATED, TENANT_ENDPOINT_SERVICE_CREATED, TENANT_ENDPOINT_SERVICE_AVAILABLE, TENANT_ENDPOINT_SERVICE_DEPLOYMENT_DELETE_REQUESTED, TENANT_ENDPOINT_SERVICE_DELETED, TENANT_ENDPOINT_SERVICE_DEPLOYMENT_DELETED, or TENANT_ENDPOINT_SERVICE_DEPLOYMENT_NUM_DESIRED_ENDPOINT_SERVICES_INCREASED.

    Values are NDS_X509_USER_AUTHENTICATION_CUSTOMER_CA_EXPIRATION_RESOLVED, NDS_X509_USER_AUTHENTICATION_CUSTOMER_CA_EXPIRATION_CHECK, NDS_X509_USER_AUTHENTICATION_CUSTOMER_CRL_EXPIRATION_RESOLVED, NDS_X509_USER_AUTHENTICATION_CUSTOMER_CRL_EXPIRATION_CHECK, NDS_X509_USER_AUTHENTICATION_MANAGED_USER_CERTS_EXPIRATION_RESOLVED, or NDS_X509_USER_AUTHENTICATION_MANAGED_USER_CERTS_EXPIRATION_CHECK.

    Values are ONLINE_ARCHIVE_INSUFFICIENT_INDEXES_CHECK, ONLINE_ARCHIVE_INSUFFICIENT_INDEXES_RESOLVED, ONLINE_ARCHIVE_UP_TO_DATE, ONLINE_ARCHIVE_DATA_EXPIRATION_RESOLVED, or ONLINE_ARCHIVE_MAX_CONSECUTIVE_OFFLOAD_WINDOWS_CHECK.

    Value is PROACTIVE_OPERATION_EVENT_LOGGED.

    Values are PRIMARY_ELECTED, REPLICATION_OPLOG_WINDOW_HEALTHY, REPLICATION_OPLOG_WINDOW_RUNNING_OUT, ONE_PRIMARY, NO_PRIMARY, or TOO_MANY_ELECTIONS.

    Values are SEARCH_DEPLOYMENT_CREATED, SEARCH_DEPLOYMENT_UPDATED, or SEARCH_DEPLOYMENT_DELETED.

    Values are SERVERLESS_DEPLOYMENT_CREATED, SERVERLESS_DEPLOYMENT_DELETED, SERVERLESS_DEPLOYMENT_UPDATED, SERVERLESS_DEPLOYMENT_INSTANCE_REPLACED, SERVERLESS_DEPLOYMENT_INSTANCE_REBOOTED, SERVERLESS_DEPLOYMENT_ENDPOINT_SERVICE_LINKED, SERVERLESS_DEPLOYMENT_ENDPOINT_SERVICE_UNLINKED, or SERVERLESS_DEPLOYMENT_ENVOY_INSTANCE_UIS_KEYS_ROTATED.

    Values are INSIDE_SERVERLESS_METRIC_THRESHOLD or OUTSIDE_SERVERLESS_METRIC_THRESHOLD.

    Value is SETUP_SERVERLESS_INITIATED.

    Value is MAX_PROCESSOR_COUNT_REACHED.

    Value is STREAM_PROCESSOR_STATE_IS_FAILED.

    Value is CASE_CREATED.

    Values are SUPPORT_EMAILS_SENT_SUCCESSFULLY or SUPPORT_EMAILS_SENT_FAILURE.

    Values are TEAM_ADDED_TO_GROUP, TEAM_REMOVED_FROM_GROUP, or TEAM_ROLES_MODIFIED.

    Values are TENANT_SNAPSHOT_STARTED_AUDIT, TENANT_SNAPSHOT_COMPLETED_AUDIT, TENANT_SNAPSHOT_DELETED_AUDIT, TENANT_RESTORE_REQUESTED_AUDIT, TENANT_RESTORE_COMPLETED_AUDIT, or TENANT_SNAPSHOT_DOWNLOAD_REQUESTED_AUDIT.

    Values are JOINED_GROUP, REMOVED_FROM_GROUP, INVITED_TO_GROUP, REQUESTED_TO_JOIN_GROUP, GROUP_INVITATION_DELETED, USER_ROLES_CHANGED_AUDIT, JOIN_GROUP_REQUEST_DENIED_AUDIT, or JOIN_GROUP_REQUEST_APPROVED_AUDIT.

    Values are CLUSTER_VERSION_FIXED, CLUSTER_VERSION_UNFIXED, CLUSTER_FCV_FIXED, CLUSTER_FCV_UNFIXED, AGENT_VERSION_FIXED, AGENT_VERSION_UNFIXED, FIXED_VERSION_UPDATED, FIXED_AGENT_VERSION_UPDATED, or CLUSTER_FCV_DOWNGRADED.

    Values are TAGS_MODIFIED or GROUP_TAGS_MODIFIED.

  • includeRaw boolean

    Flag that indicates whether to include the raw document in the output. The raw document contains additional meta information about the event.

    Default value is false.

  • maxDate string(date-time)

    Date and time from when MongoDB Cloud stops returning events. This parameter uses the ISO 8601 timestamp format in UTC.

  • minDate string(date-time)

    Date and time from when MongoDB Cloud starts returning events. This parameter uses the ISO 8601 timestamp format in UTC.

Responses

  • 200 application/vnd.atlas.2023-01-01+json

    OK

    Hide response attributes Show response attributes object
    • links array[object]

      List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

      Web Linking Specification (RFC 5988)
      Hide links attributes Show links attributes object
      • href string

        Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

      • rel string

        Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

    • results array[object]

      List of returned documents that MongoDB Cloud providers when completing this request.

      One of:
      DefaultEventViewForNdsGroup object AlertAudit object AlertConfigAudit object ApiUserEventViewForNdsGroup object ServiceAccountGroupEvents object AutomationConfigEventView object AppServiceEventView object BillingEventViewForNdsGroup object ClusterEventViewForNdsGroup object DataExplorerAccessedEventView object FTSIndexAuditView object HostEventViewForNdsGroup object HostMetricEvent object NDSAuditViewForNdsGroup object NDSAutoScalingAuditViewForNdsGroup object NDSServerlessInstanceAuditView object NDSTenantEndpointAuditView object ForNdsGroup object SearchDeploymentAuditView object TeamEventViewForNdsGroup object UserEventViewForNdsGroup object ResourceEventViewForNdsGroup object StreamsEventViewForNdsGroup object StreamProcessorEventViewForNdsGroup object
    • totalCount integer(int32)

      Total number of documents available. MongoDB Cloud omits this value if includeCount is set to false.

      Minimum value is 0.
  • 400 application/json

    Bad Request.

    Hide response attributes Show response attributes object
    • detail string

      Describes the specific conditions or reasons that cause each type of error.

    • error integer(int32)

      HTTP status code returned with this error.

      External documentation
    • errorCode string

      Application error code returned with this error.

    • parameters array[object]

      Parameters used to give more information about the error.

    • reason string

      Application error message returned with this error.
  • 401 application/json

    Unauthorized.

    Hide response attributes Show response attributes object
    • detail string

      Describes the specific conditions or reasons that cause each type of error.

    • error integer(int32)

      HTTP status code returned with this error.

      External documentation
    • errorCode string

      Application error code returned with this error.

    • parameters array[object]

      Parameters used to give more information about the error.

    • reason string

      Application error message returned with this error.
  • 500 application/json

    Internal Server Error.

    Hide response attributes Show response attributes object
    • detail string

      Describes the specific conditions or reasons that cause each type of error.

    • error integer(int32)

      HTTP status code returned with this error.

      External documentation
    • errorCode string

      Application error code returned with this error.

    • parameters array[object]

      Parameters used to give more information about the error.

    • reason string

      Application error message returned with this error.
GET /api/atlas/v2/groups/{groupId}/events 
atlas api events listProjectEvents --help
import (
	"os"
	"context"
	"log"
	sdk "go.mongodb.org/atlas-sdk/v20230101001/admin"
)

func main() {
	ctx := context.Background()
	clientID := os.Getenv("MONGODB_ATLAS_CLIENT_ID")
	clientSecret := os.Getenv("MONGODB_ATLAS_CLIENT_SECRET")

	// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth
	client, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))

	if err != nil {
		log.Fatalf("Error: %v", err)
	}

	params = &sdk.ListProjectEventsApiParams{}
	sdkResp, httpResp, err := client.EventsApi.
		ListProjectEventsWithParams(ctx, params).
		Execute()
}

curl --include --header "Authorization: Bearer ${ACCESS_TOKEN}" \
  --header "Accept: application/vnd.atlas.2023-01-01+json" \
  -X GET "https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/events?pretty=true"
curl --user "${PUBLIC_KEY}:${PRIVATE_KEY}" \
  --digest --include \
  --header "Accept: application/vnd.atlas.2023-01-01+json" \
  -X GET "https://cloud.mongodb.com/api/atlas/v2/groups/{groupId}/events?pretty=true"
Response examples (200) 
{
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "results": [
    {
      "apiKeyId": "32b6e34b3d91647abb20e7b8",
      "created": "2025-05-04T09:42:00Z",
      "eventTypeName": "AUTO_INDEXING_ENABLED",
      "groupId": "32b6e34b3d91647abb20e7b8",
      "id": "32b6e34b3d91647abb20e7b8",
      "isGlobalAdmin": false,
      "links": [
        {
          "href": "https://cloud.mongodb.com/api/atlas",
          "rel": "self"
        }
      ],
      "orgId": "32b6e34b3d91647abb20e7b8",
      "publicKey": "test.user@mongodb.com",
      "raw": {
        "_t": "ALERT_AUDIT",
        "alertConfigId": "32b6e34b3d91647abb20e7b8",
        "cid": "32b6e34b3d91647abb20e7b8",
        "cre": "2025-05-04T09:42:00Z",
        "description": "Alert Acknowledged",
        "gn": "Test Project",
        "id": "32b6e34b3d91647abb20e7b8",
        "orgId": "32b6e34b3d91647abb20e7b8",
        "orgName": "Test Organization",
        "severity": "INFO"
      },
      "remoteAddress": "216.172.40.186",
      "userId": "32b6e34b3d91647abb20e7b8",
      "username": "test.user@mongodb.com"
    }
  ],
  "totalCount": 42
}
Response examples (400) 
{
  "error": 400,
  "detail": "(This is just an example, the exception may not be related to this endpoint) No provider AWS exists.",
  "reason": "Bad Request",
  "errorCode": "VALIDATION_ERROR"
}
Response examples (401) 
{
  "error": 401,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Unauthorized",
  "errorCode": "NOT_ORG_GROUP_CREATOR"
}
Response examples (500) 
{
  "error": 500,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Internal Server Error",
  "errorCode": "UNEXPECTED_ERROR"
}