user-audit-tool
Retrieves configuration audit trails for a specific user or target entity, showing who made changes and what was modified.
Instructions
This tool retrieves configuration audit trails for specific users or specific targets (devices, policies, etc.). Unlike the general audit feed, this focuses on a SINGLE user or a SINGLE target entity.
It has the following modes of operation, determined by the "requestType" parameter:
audit-by-user: Get all configuration changes made BY a specific user. Requires userUuid (use user-tool to find it). Answers: "What did this admin change recently?"
audit-by-target: Get all configuration changes made TO a specific entity (camera, door, policy, etc.). Requires targetUuid. Answers: "Who changed the settings on this camera?"
Both modes return audit events with action, display text, who did it, what was changed, and when.
Output filtering (all tools):
includeFields(string[]): Dot-notation paths to keep in the response (e.g."vehicleEvents.vehicleLicensePlate"). Omit to return all fields.filterBy(array): Predicates to filter array items. Each entry:{field, op, value}where op is one of= != > >= < <= contains. All conditions are ANDed. Example:[{field:"vehicleLicensePlate", op:"=", value:"ABC123"}]WARNING: some tool responses exceed 400k characters — use these params to request only the data you need.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| requestType | Yes | The type of audit request to make. | |
| userUuid | Yes | User UUID whose actions to audit. Required for 'audit-by-user'. Use user-tool to find this. | |
| targetUuid | Yes | Target entity UUID (camera, door, policy, etc.) to see what has been done to it. Required for 'audit-by-target'. | |
| maxResults | Yes | Maximum number of audit events to return. Defaults to 50. | |
| includeFields | Yes | Dot-notation field paths to include in the response (e.g. "vehicleEvents.vehicleLicensePlate"). Pass null to return all fields. WARNING: some responses can exceed 400k characters — use includeFields to request only the data you need. For high-volume tools this may be required to get a complete answer. | |
| filterBy | Yes | Filter array items in the response by field values. All conditions are ANDed. Example: [{field: "vehicleLicensePlate", op: "=", value: "ABC123"}, {field: "confidence", op: ">", value: 0.8}] Use alongside includeFields to get only the specific records and fields you need. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| auditEvents | No | List of audit events, most recent first | |
| error | No | An error message if the request failed. |