# Query Auditing Events

`GET https://api.suger.cloud/org/{orgId}/auditingEvent/query`

Query auditing events with filtering, sorting, and pagination using CRUD query language. Supports complex filters, sorting by multiple fields, and pagination.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `orgId` | path | string | yes | Organization ID |
| `page_size` | query | integer | no | Number of items per page (default: 20, max: 1000) |
| `page_number` | query | integer | no | Page number (default: 1) |
| `q` | query | string | no | LISP-style filter expression (e.g., '(= event_type \ |
| `s` | query | string | no | Sort fields: 'field:asc,field2:desc' or '-field,field2' format (e.g., 'creation_time:desc,event_type:asc' or '-creation_time,event_type') |

## Responses

### 200 — Paginated list of auditing events

Content-Type: `application/json` · Schema: `ListBaseResponse-AuditingEvent`

**`ListBaseResponse-AuditingEvent`** fields:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `data` | array<AuditingEvent> | no |  |
| `page_number` | integer | no |  |
| `page_size` | integer | no |  |
| `total_count` | integer | no | TotalCount is the number of matching rows, counted up to ListCountCap. When TotalCountCapped is true it is that cap rather than the real total. |
| `total_count_capped` | boolean | no | TotalCountCapped reports that more rows match than TotalCount says: the count stopped at ListCountCap because an exact total costs a full scan of everything the filter matches. Clients should present TotalCount as a lower bound ("10,000+") when this is set. Omitted when false, so clients that predate the field are unaffected. |

**`AuditingEvent`** fields:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `aceEventBridgeEvent` | AceEventBridgeEvent | no |  |
| `alibabaMarketplaceEvent` | AlibabaMarketplaceEvent | no |  |
| `awsMarketplaceEvent` | AwsMarketplaceEvent | no |  |
| `awsMarketplaceEventBridgeEvent` | AwsMarketplaceEventBridgeEvent | no |  |
| `azureMarketplaceEvent` | AzureMarketplaceEvent | no |  |
| `creationTime` | string | no | When the event is received and audited. |
| `eventType` | string | no |  |
| `gcpMarketplaceEvent` | GcpMarketplaceEvent | no |  |
| `id` | string | no |  |
| `lastUpdateTime` | string | no | when the event is updated. |
| `organizationID` | string | no |  |
| `otherTypeEvent` | object | no | Nullable, applicable when eventType is other types. |
| `status` | string | no |  |

**`AceEventBridgeEvent`** fields:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `account` | string | no |  |
| `detail` | AceEventBridgeEventDetail | no |  |
| `detail-type` | string | no |  |
| `id` | string | no |  |
| `region` | string | no |  |
| `resources` | array<string> | no |  |
| `source` | string | no | "aws.partnercentral-selling" |
| `time` | string | no |  |
| `version` | string | no |  |

**`AlibabaMarketplaceEvent`** fields:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `action` | AlibabaMarketplaceAction | no |  |
| `aliUid` | string | no | The Alibaba UID of the buyer's Alibaba Account. |
| `expiredOn` | string | no |  |
| `instanceId` | string | no |  |
| `isRefund` | boolean | no |  |
| `orderBizId` | string | no | Used as the Instance ID, and as the external ID for the Fours Entitlement. |
| `orderId` | string | no |  |
| `productCode` | string | no |  |
| `skuId` | string | no |  |
| `sugerOrganizationId` | string | no | Fours organization ID of this event. Populated by Fours Service. |
| `template` | string | no |  |
| `timeStamp` | string | no | When the event was received by the Fours. |
| `token` | string | no | SPI security token. |
| `trial` | boolean | no | If true, the event is for a trial. |

**`AwsMarketplaceEvent`** fields:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `action` | string | no |  |
| `customer-identifier` | string | no |  |
| `id` | string | no |  |
| `isFreeTrialTermPresent` | string | no |  |
| `offer-identifier` | string | no |  |
| `product-code` | string | no |  |
| `sugerOrganizationId` | string | no | Populated by Fours Service. |

**`AwsMarketplaceEventBridgeEvent`** fields:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `account` | string | no | The seller/ISV AWS Account Id. |
| `detail` | AwsMarketplaceEventBridgeEventDetail | no |  |
| `detail-type` | string | no |  |
| `id` | string | no |  |
| `region` | string | no |  |
| `resources` | array<string> | no |  |
| `source` | string | no | "aws.marketplacecatalog" |
| `time` | string | no |  |
| `version` | string | no |  |

**`AzureMarketplaceEvent`** fields:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `action` | AzureMarketplaceEventAction | no |  |
| `activityId` | string | no |  |
| `id` | string | no | The Operation Id. |
| `offerId` | string | no |  |
| `operationRequestSource` | string | no |  |
| `planId` | string | no |  |
| `publisherId` | string | no |  |
| `purchaseToken` | string | no |  |
| `quantity` | integer | no |  |
| `status` | string | no |  |
| `subscription` | AzureMarketplaceSubscription | no |  |
| `subscriptionId` | string | no |  |
| `sugerOrganizationId` | string | no | Populated by Fours Service. |
| `timeStamp` | string | no |  |

**`GcpMarketplaceEvent`** fields:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `account` | GcpMarketplaceUserAccount | no |  |
| `entitlement` | GcpMarketplaceEntitlement | no |  |
| `eventId` | string | no |  |
| `eventType` | GcpMarketplacceEventType | no |  |
| `providerId` | string | no | GCP Partner ID of the SaaS Seller. |
| `publishTime` | string | no | The Publish Time of the event. |
| `sugerOrganizationId` | string | no | Populated by Fours Service. |

**`AceEventBridgeEventDetail`** fields:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `catalog` | string | no | "AWS" or "Sandbox" |
| `engagementInvitation` | AceEventEngagementInvitation | no |  |
| `opportunity` | AceEventOpportunity | no |  |
| `schemaVersion` | string | no |  |

**`AwsMarketplaceEventBridgeEventDetail`** fields:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `acceptor` | AwsMarketplaceEventBridgeEventAccount | no |  |
| `agreement` | AwsMarketplaceEventBridgeEventAgreement | no |  |
| `catalog` | string | no |  |
| `endTimeBehavior` | AwsMarketplaceEventBridgeEndTimeBehavior | no |  |
| `eventCategory` | string | no |  |
| `eventID` | string | no |  |
| `eventName` | string | no |  |
| `eventSource` | string | no |  |
| `eventType` | string | no |  |
| `eventVersion` | string | no |  |
| `license` | AwsMarketplaceEventBridgeEventLicense | no |  |
| `managementEvent` | boolean | no |  |
| `manufacturer` | AwsMarketplaceEventBridgeEventAccount | no |  |
| `offer` | AwsMarketplaceEventBridgeEventOffer | no |  |
| `product` | AwsMarketplaceEventBridgeEventProduct | no |  |
| `proposer` | AwsMarketplaceEventBridgeEventAccount | no |  |
| `renewalSummary` | AwsMarketplaceEventBridgeEventRenewalSummary | no |  |
| `requestID` | string | no |  |
| `requestParameters` | object | no |  |
| `resaleAuthorization` | AwsMarketplaceEventBridgeEventResaleAuthorization | no |  |
| `responseElements` | object | no |  |
| `sellerOfRecord` | AwsMarketplaceEventBridgeEventAccount | no |  |
| `targetedBuyerAccountIds` | array<string> | no |  |

**`AzureMarketplaceSubscription`** fields:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `allowedCustomerOperations` | array<string> | no |  |
| `autoRenew` | boolean | no |  |
| `beneficiary` | AzureADIdentifier | no |  |
| `created` | string | no |  |
| `fulfillmentId` | string | no |  |
| `id` | string | no |  |
| `isFreeTrial` | boolean | no |  |
| `isTest` | boolean | no |  |
| `lastModified` | string | no |  |
| `name` | string | no |  |
| `offerId` | string | no |  |
| `planId` | string | no |  |
| `publisherId` | string | no |  |
| `purchaser` | AzureADIdentifier | no |  |
| `quantity` | integer | no |  |
| `saasSubscriptionStatus` | AzureMarketplaceSubscriptionStatus | no |  |
| `sandboxType` | string | no |  |
| `sessionId` | string | no |  |
| `sessionMode` | string | no |  |
| `storeFront` | string | no |  |
| `term` | AzureTerm | no |  |

**`GcpMarketplaceUserAccount`** fields:

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `approvals` | array<GcpMarketplaceUserAccountApproval> | no | The approvals for this account, that are permitted or have been completed. |
| `billingAccountId` | string | no | The buyer's GCP billing account ID if it's a company account. |
| `createTime` | string | no | RFC3339 UTC timestamp |
| `id` | string | no | GCP Marketplace User Account ID. |
| `inputProperties` | array<integer> | no |  |
| `name` | string | no | The resource name of the account, in format of providers/{provider_id}/accounts/{account_id}. |
| `parentBillingAccountId` | string | no | The parent account ID of the BillingAccountId if the buyer is from a reseller in GCP Marketplace. It is the GCP billing account ID of the reseller in GCP Marketplace. |
| `provider` | string | no | The identifier of the service provider (SaaS Seller) that this account was created against. |
| `state` | GcpMarketplaceUserAccountState | no |  |
| `updateTime` | string | no | RFC3339 UTC timestamp |
| `userInfo` | GcpUserInfo | no |  |

### 400 — Bad request error

Content-Type: `application/json`

### 500 — Internal server error

Content-Type: `application/json`

## Example

_Generated from this operation's schema. Values are placeholders — substitute your own ids, and set `SUGER_TOKEN` to a bearer token from the [OAuth client-credentials exchange](https://doc.fours.com/settings/oauth-app/)._

### Request

```bash
curl -X GET 'https://api.suger.cloud/org/{orgId}/auditingEvent/query' \
  -H "Authorization: Bearer $SUGER_TOKEN"
```

### Response — 200

```json
{
  "data": [
    {
      "aceEventBridgeEvent": {
        "account": "string",
        "detail": {
          "catalog": "string",
          "engagementInvitation": {},
          "opportunity": {},
          "schemaVersion": "string"
        },
        "detail-type": "string",
        "id": "01H0000000000000000000",
        "region": "string",
        "resources": [
          "string"
        ],
        "source": "string",
        "time": "2026-01-31T12:00:00Z",
        "version": "string"
      },
      "alibabaMarketplaceEvent": {
        "action": "createInstance",
        "aliUid": "01H0000000000000000000",
        "expiredOn": "2026-01-31T12:00:00Z",
        "instanceId": "01H0000000000000000000",
        "isRefund": true,
        "orderBizId": "01H0000000000000000000",
        "orderId": "01H0000000000000000000",
        "productCode": "string",
        "skuId": "01H0000000000000000000",
        "sugerOrganizationId": "01H0000000000000000000",
        "template": "string",
        "timeStamp": "2026-01-31T12:00:00Z"
      },
      "awsMarketplaceEvent": {
        "action": "string",
        "customer-identifier": "string",
        "id": "01H0000000000000000000",
        "isFreeTrialTermPresent": "true",
        "offer-identifier": "string",
        "product-code": "string",
        "sugerOrganizationId": "01H0000000000000000000"
      },
      "awsMarketplaceEventBridgeEvent": {
        "account": "string",
        "detail": {
          "acceptor": {},
          "agreement": {},
          "catalog": "string",
          "endTimeBehavior": {},
          "eventCategory": "string",
          "eventID": "01H0000000000000000000",
          "eventName": "Acme Corp",
          "eventSource": "string",
          "eventType": "string",
          "eventVersion": "string",
          "license": {},
          "managementEvent": true
        },
        "detail-type": "string",
        "id": "01H0000000000000000000",
        "region": "string",
        "resources": [
          "string"
        ],
        "source": "string",
        "time": "2026-01-31T12:00:00Z",
        "version": "string"
      },
      "azureMarketplaceEvent": {
        "action": "ChangePlan",
        "activityId": "01H0000000000000000000",
        "id": "01H0000000000000000000",
        "offerId": "01H0000000000000000000",
        "operationRequestSource": "Azure",
        "planId": "01H0000000000000000000",
        "publisherId": "01H0000000000000000000",
        "purchaseToken": "string",
        "quantity": 1,
        "status": "Succeeded",
        "subscription": {
          "allowedCustomerOperations": [],
          "autoRenew": true,
          "beneficiary": {},
          "created": "2026-01-31T12:00:00Z",
          "fulfillmentId": "01H0000000000000000000",
          "id": "01H0000000000000000000",
          "isFreeTrial": true,
          "isTest": true,
          "lastModified": "string",
          "name": "Acme Corp",
          "offerId": "01H0000000000000000000",
          "planId": "01H0000000000000000000"
        },
        "subscriptionId": "01H0000000000000000000"
      },
      "creationTime": "2026-01-31T12:00:00Z",
      "eventType": "AWS_MARKETPLACE",
      "gcpMarketplaceEvent": {
        "account": {
          "approvals": [],
          "billingAccountId": "01H0000000000000000000",
          "createTime": "2026-01-31T12:00:00Z",
          "id": "01H0000000000000000000",
          "inputProperties": [],
          "name": "Acme Corp",
          "parentBillingAccountId": "01H0000000000000000000",
          "provider": "string",
          "state": "ACCOUNT_STATE_UNSPECIFIED",
          "updateTime": "2026-01-31T12:00:00Z",
          "userInfo": {}
        },
        "entitlement": {
          "account": "string",
          "consumers": [],
          "createTime": "2026-01-31T12:00:00Z",
          "id": "01H0000000000000000000",
          "inputProperties": [],
          "messageToUser": "string",
          "name": "Acme Corp",
          "newOfferDuration": "string",
          "newOfferEndTime": "2026-01-31T12:00:00Z",
          "newOfferStartTime": "2026-01-31T12:00:00Z",
          "newPendingOffer": "string",
          "newPendingOfferDuration": "string"
        },
        "eventId": "01H0000000000000000000",
        "eventType": "ACCOUNT_ACTIVE",
        "providerId": "01H0000000000000000000",
        "publishTime": "2026-01-31T12:00:00Z",
        "sugerOrganizationId": "01H0000000000000000000"
      },
      "id": "01H0000000000000000000",
      "lastUpdateTime": "2026-01-31T12:00:00Z",
      "organizationID": "01H0000000000000000000"
    }
  ],
  "page_number": 1,
  "page_size": 1,
  "total_count": 1,
  "total_count_capped": true
}
```

### Error — 400

```json
"string"
```

---

API reference: https://doc.fours.com/api/