Introduction
The 26.07 release saw the OIC audit stream augmented with logging of OIC activity stream views. Essentially telling us who looked at what in the activity stream. Let's try this out -
I click on the
Instance ID link and check out the activity stream -
Now let's check the audit log -
I click the
Audit link -
User niall.commiskey@oracle.com viewed activity stream for
integration id: AA_ERRORS/SYNC_UPDATE_ORDER (1.0),
instance id: clbG7JACEfG9ee_6FVinEA, business identifiers: (orderNr: 123),
tracing level: Audit
So how can we download such via the OIC api?
/ic/api/integration/v1/monitoring/auditRecords?integrationInstance=yourOICInstance
Here's an example from Postman -
Note the query filter parameters available -
So let's try out some of these -
https://design.integration.us-phoenix-1.ocp.oraclecloud.com/ic/api/integration/v1/monitoring/auditRecords?integrationInstance=yourOICInstance&q={timewindow:'6h'}The above applies a timewindow of 6 hours to the query.
{
"items": [
{
"auditTrailMessage": "User niall.commiskey@oracle.com viewed activity stream for integration id: AA_ERRORS/A_CALLING_B (1.0), instance id: 7WR6yZAEEfG8D-EccQuiTg, business identifiers: (orderNr: 310397), tracing level: Production",
"operationName": "view",
"resourceType": "activity stream",
"timeStamp": "2026-08-04T13:04:27.897+0000",
"userName": "niall.commiskey@oracle.com"
},
{
"auditTrailMessage": "User niall.commiskey@oracle.com viewed activity stream for integration id: AA_ERRORS/A_CALLING_B (1.0), instance id: 7WR6yZAEEfG8D-EccQuiTg, business identifiers: (orderNr: 310397), tracing level: Production",
"operationName": "view",
"resourceType": "activity stream",
"timeStamp": "2026-08-04T13:03:51.287+0000",
"userName": "niall.commiskey@oracle.com"
},
{
"auditTrailMessage": "User niall.commiskey@oracle.com unlocked lookup AA_ERRORS/orderValues ",
"operationName": "unlock",
"resourceCode": "orderValues",
"resourceName": "orderValues",
"resourceType": "ICS_DVM",
"timeStamp": "2026-08-04T13:03:15.409+0000",
"userName": "niall.commiskey@oracle.com"
},
{
"auditTrailMessage": "User niall.commiskey@oracle.com updated lookup AA_ERRORS/orderValues ",
"operationName": "update",
"resourceCode": "orderValues",
"resourceName": "orderValues",
"resourceType": "ICS_DVM",
"timeStamp": "2026-08-04T12:59:42.378+0000",
"userName": "niall.commiskey@oracle.com"
},
{
"auditTrailMessage": "User niall.commiskey@oracle.com locked lookup AA_ERRORS/orderValues ",
"operationName": "lock",
"resourceCode": "orderValues",
"resourceName": "orderValues",
"resourceType": "ICS_DVM",
"timeStamp": "2026-08-04T12:59:24.919+0000",
"userName": "niall.commiskey@oracle.com"
},
{
"auditTrailMessage": "User niall.commiskey@oracle.com viewed activity stream for integration id: AA_ERRORS/SYNC_UPDATE_ORDER (1.0), instance id: clbG7JACEfG9ee_6FVinEA, business identifiers: (orderNr: 123), tracing level: Audit",
"operationName": "view",
"resourceType": "activity stream",
"timeStamp": "2026-08-04T12:47:03.378+0000",
"userName": "niall.commiskey@oracle.com"
},
{
"auditTrailMessage": "User niall.commiskey@oracle.com viewed activity stream for integration id: AA_ERRORS/SYNC_UPDATE_ORDER (1.0), instance id: clbG7JACEfG9ee_6FVinEA, business identifiers: (orderNr: 123), tracing level: Audit",
"operationName": "view",
"resourceType": "activity stream",
"timeStamp": "2026-08-04T12:46:08.602+0000",
"userName": "niall.commiskey@oracle.com"
},
{
"auditTrailMessage": "User niall.commiskey@oracle.com viewed activity stream for integration id: AA_2607_NEW_FEATURES/DATA_TRANSLATE_DEMO (1.0), instance id: yvkVeo__EfGSfZ-fcacITg, business identifiers: (orderNr: 123), tracing level: Production",
"operationName": "view",
"resourceType": "activity stream",
"timeStamp": "2026-08-04T12:27:07.547+0000",
"userName": "niall.commiskey@oracle.com"
}
],
"links": [
{
"href": "https://design.integration.us-phoenix-1.ocp.oraclecloud.com/ic/api/integration/v1/monitoring/auditRecords?integrationInstance=...",
"rel": "self"
},
{
"href": "https://design.integration.us-phoenix-1.ocp.oraclecloud.com/ic/api/integration/v1/monitoring/auditRecords?integrationInstance=...",
"rel": "canonical"
}
],
"totalResults": "8"
}
As you can see - log entries for viewing the activity stream, updating a lookup etc.
Now I query for log entries related to the lookup - q={timewindow:'6h', type:/ICS_DVM/}
Now I query for just a specific integration, HELLOWORLD -q={timewindow:'6h', code:'HELLOWORLD'}
We can also add the integration version number -
q={timewindow:'6h', code:'HELLOWORLD', version: '01.00.0000'}
Back to the type filter - for auditing just schedules I can use - ICS_Schedule - q={timewindow:'1h', type:'ICS_Schedule'}
For auditing libraries use -
q={timewindow:'1h', type:'API_LIBRARY'}
The filter parameter -
ICS_ProjectV2 - refers to integrations -
Another Approach
One can download the audit trail from the OIC UI -
Internally, this operation uses the following factory api -
https://design.integration.yourRegion.ocp.oraclecloud.com/ic/api/integration/v1/monitoring/logs/icsauditlog?q=%7Btimewindow%3A%271d%27%7D&integrationInstance=yourOIC
I try this out in Postman -
I can save this to a file -
Here is a short extract -
[2026-08-04 15:44:17.007 Z] [userID: niall.commiskey@oracle.com] [niall.commiskey@oracle.com,UNLOCK,ICS_ProjectV2,BLAH,BLAH,01.00.0000,] User niall.commiskey@oracle.com unlocked integration BLAH (1.0)
[2026-08-04 15:44:15.618 Z] [userID: niall.commiskey@oracle.com] [niall.commiskey@oracle.com,UPDATE,ICS_ProjectV2,BLAH,blah,01.00.0000,] User niall.commiskey@oracle.com updated integration BLAH (1.0)
[2026-08-04 15:44:05.760 Z] [userID: niall.commiskey@oracle.com] [niall.commiskey@oracle.com,UPDATE,ICS_ProjectV2,BLAH,blah,01.00.0000,] User niall.commiskey@oracle.com updated integration BLAH (1.0)
[2026-08-04 15:44:04.362 Z] [userID: niall.commiskey@oracle.com] [niall.commiskey@oracle.com,LOCK,ICS_ProjectV2,BLAH,BLAH,01.00.0000,] User niall.commiskey@oracle.com locked integration BLAH (1.0)
[2026-08-04 15:43:20.055 Z] [userID: niall.commiskey@oracle.com] [niall.commiskey@oracle.com,UNLOCK,ICS_ProjectV2,BLAH,BLAH,01.00.0000,] User niall.commiskey@oracle.com unlocked integration BLAH (1.0)
[2026-08-04 15:43:18.303 Z] [userID: niall.commiskey@oracle.com] [niall.commiskey@oracle.com,UPDATE,ICS_ProjectV2,BLAH,blah,01.00.0000,] User niall.commiskey@oracle.com updated integration BLAH (1.0)
[2026-08-04 15:43:11.085 Z] [userID: niall.commiskey@oracle.com] [niall.commiskey@oracle.com,UPDATE,ICS_ProjectV2,BLAH,blah,01.00.0000,] User niall.commiskey@oracle.com updated integration BLAH (1.0)
[2026-08-04 15:43:09.583 Z] [userID: niall.commiskey@oracle.com] [niall.commiskey@oracle.com,LOCK,ICS_ProjectV2,BLAH,BLAH,01.00.0000,] User niall.commiskey@oracle.com locked integration BLAH (1.0)
[2026-08-04 15:43:04.313 Z] [userID: niall.commiskey@oracle.com] [niall.commiskey@oracle.com,UNLOCK,ICS_ProjectV2,HELLOWORLD,HELLOWORLD,01.00.0000,] User niall.commiskey@oracle.com unlocked integration HELLOWORLD (1.0)
Note the format -
[2026-08-04 15:44:17.007 Z] [userID: niall.commiskey@oracle.com] [niall.commiskey@oracle.com,UNLOCK,ICS_ProjectV2,BLAH,BLAH,01.00.0000,] User niall.commiskey@oracle.com unlocked integration BLAH (1.0)
Compare this to the structured response from the previous api -
{"auditTrailMessage": "User niall.commiskey@oracle.com unlocked
integration BLAH (1.0)",
"operationName": "unlock",
"resourceCode": "BLAH",
"resourceName": "BLAH",
"resourceType": "ICS_ProjectV2",
"resourceVersion": "01.00.0000",
"timeStamp": "2026-08-04T15:44:17.007+0000",
"userName": "niall.commiskey@oracle.com"
}
The UI offers other filters -
Let's look at the api call OIC makes to retrieve audit records for the project AA_NEW_PROJECT.
https://design.integration.us-phoenix-1.ocp.oraclecloud.com/ic/api/integration/v1/monitoring/auditRecords?offset=0&limit=50&q=%7Btimewindow%3A%271d%27%2C+projectCode%3A%27AA_NEW_PROJECT%27%7D&integrationInstance=yourOICInstance
As you can see, it's using the api we discussed earlier, just with a different query.
This time query is set to q={timewindow:'1d', projectCode:'AA_NEW_PROJECT'}
I try this out in Postman - works a dream, so this is another filter we can use. We can also leverage the other filters available in the UI. These are listed below.
Summa Summarum
As I hope I've shown, /ic/api/integration/v1/monitoring/auditRecords, is a useful api, with a powerful set of filters.
Let's recap on them, firstly, those I garnered from the OUC designtime -
- projectCode - filter on a specific project
- code - filter on a specific integration
- action - designtime action e.g. UNLOCK
- userName - filter on OIC user
Now to the documented filter - type -
- API_LIBRARY - filter to return only Library related log entries
- ICS_Schedule - filter to return only Schedule related log entries
- ICS_DVM - filter to return only Lookup related log entries
- ICS_ProjectV2 - filter to return only Integration related log entries, albeit a cryptically name type.
Net, net - I hope it can help in ensuring your design time audit trail can be exported efficiently.
Cerevisia aestiva
Today's beer is a Export Dunkel (Dark) from Spalter Brauerei. A stronger beer, 5.5%, with a true caramel colour. This is a perfect malt infused beer, which can be enjoyed at any time of the year. Spalter Brauerei is the only communally owned brewery in Germany. Ca. 5000 locals are involved in keeping this great brewing tradition alive.