Unable to Fetch Org Audit Logs via API on Premium Plan – Is Enterprise Plan Required?

[Atlassian Log]

Hi everyone,

I’m trying to download audit logs from the Atlassian admin portal using API calls and a PowerShell script, because the audit logs on the portal are only available for 6 months and I want to archive them on my own server.

Here’s an example snippet of the API call I’m using:

# ========== FETCH ORG AUDIT LOG ==========
$auditUrl = "https://api.atlassian.com/admin/v1/orgs/$orgId/audit?limit=$limit&start=$startIso&end=$endIso"
$allRecords = @()

$response = Invoke-RestMethod -Method GET -Uri $auditUrl -Headers $headers

if ($response.records) {
    $allRecords += $response.records
    Write-Host "[INFO] Retrieved $($response.records.Count) audit records from org $orgId"
}

if (-not $allRecords) {
    Write-Host "[INFO] No audit logs available for the selected period."

    # Send warning email
    Send-MailMessage -From $fromEmail -To $toEmail -Subject $emailSubject `
        -Body "No Jira ORG audit logs found from $startIso to $endIso." `
        -SmtpServer $smtpServer -Port $smtpPort
    exit
}

My configuration looks like this:

# ========== CONFIGURATION ==========
$apiKey = "XXXXX" # API key generated from Atlassian admin
$orgId = "XXXX"
$logFolder = "D:\Logs\JiraAudit"
$limit = 1000
$retentionDays = 7

However, I always get this error:

[ERROR] The remote server returned an error: (404) Not Found.  

From what I understand, this happens because the Org Audit Logs API is only available for Enterprise plans, and I have a Premium plan.

Could you please confirm if this is correct?

Also, is there any workaround to export the audit logs programmatically on a Premium plan so that I can forward them to Graylog for long-term storage?

Thanks a lot in advance and have a great day!

[Aaron Pavez [ServiceRocket]]

Hi @Atlassian Log 

Do you have mobaxterm or any other linux terminal?

Test this:

curl --request GET --url 'https://api.atlassian.com/admin/v1/orgs/ORIDHERE/events' --header 'Authorization: Bearer YOURORGTOKENHERE' --header 'Accept: application/json'

Maybe the API token doesn't have the proper permissions?

https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/

The Docs says

https://developer.atlassian.com/cloud/admin/organization/rest/api-group-events/#api-v1-orgs-orgid-events-get

OAuth 2.0 scopes required: Not supported (use API Key without scopes)

Create a new API token with no scopes. full access.

Regards - Aaron