How To
ForgeRock Identity Platform
Does not apply to Identity Cloud

How do I create a queryFilter for an audit field in IDM (All versions)?

Last updated Apr 8, 2021

The purpose of this article is to provide information on writing a queryFilter for an audit field record in IDM.

Creating a queryFilter

You can create a queryFilter for an audit field record to return activity for a specific object. If you look at the type of audit entries you want to query, you should be able to create a queryFilter accordingly. See Object Modeling Guide › Construct Queries for further information on creating queryFilter queries.


You can use a curl command such as the following, where the double quotes have been escaped using backslashes:

  • IDM 7 and later: $ curl -X GET -H "X-OpenIDM-Username: openidm-admin" -H "X-OpenIDM-Password: openidm-admin" -H "Accept-API-Version: resource=1.0" -H "Content-Type: application/json" http://localhost:8080/idm/audit/activity?_queryFilter=/after+co+'\"name\":\"Employee\"'"
  • Pre-IDM 7: $ curl -X GET -H "X-OpenIDM-Username: openidm-admin" -H "X-OpenIDM-Password: openidm-admin" -H "Content-Type: application/json" http://localhost:8080/idm/audit/activity?_queryFilter=/after+co+'\"name\":\"Employee\"'"

If you use a REST client such as Postman, you do not need to escape the double quotes, for example:

GET http://localhost:8080/idm/audit/activity?_queryFilter=/after+co+'"name":"Employee"'

These commands will give a response such as the following:

{ "result": [ { "_id": "ddacdf46-d2bf-45c3-ab62-ea55fe4afa38-59", "timestamp": "2016-03-17T15:32:01.292Z", "eventName": "activity", "transactionId": "ddacdf46-d2bf-45c3-ab62-ea55fe4afa38-52", "userId": "openidm-admin", "trackingIds": null, "runAs": "openidm-admin", "objectId": "managed/role/Employee", "operation": "CREATE", "before": null, "after": "{\"name\":\"Employee\",\"description\":\"Role assigned to workers on the payroll.\",\"_id\":\"Employee\",\"_rev\":\"0\"}", "changedFields": [], "revision": "0", "passwordChanged": "false", "message": "create", "status": "SUCCESS" }, ], "resultCount": 1, "pagedResultsCookie": null, "totalPagedResultsPolicy": "NONE", "totalPagedResults": -1, "remainingPagedResults": -1 }

See Also


Using the REST API in IDM

Object Modeling Guide › Define and Call Data Queries

Audit Guide › Query Audit Logs Over REST

Audit Guide

Related Training


Related Issue Tracker IDs


Copyright and Trademarks Copyright © 2021 ForgeRock, all rights reserved.