Return Events from One Organization

GET /api/atlas/v2/orgs/{orgId}/events
Service accounts Digest auth

Returns events for the specified organization. Events identify significant database, billing, or security activities or status changes. To use this resource, the requesting Service Account or API Key must have the Organization Member role.

This resource remains under revision and may change.

Path parameters

  • orgId string Required

    Unique 24-hexadecimal digit string that identifies the organization that contains your projects. Use the /orgs endpoint to retrieve all organizations to which the authenticated user has access.

    Format should match the following pattern: ^([a-f0-9]{24})$.

Query parameters

  • envelope boolean

    Flag that indicates whether Application wraps the response in an envelope JSON object. Some API clients cannot access the HTTP response headers or status code. To remediate this, set envelope=true in the query. Endpoints that return a list of results use the results object as an envelope. Application adds the status parameter to the response body.

    Default value is false.

  • includeCount boolean

    Flag that indicates whether the response returns the total number of items (totalCount) in the response.

    Default value is true.

  • itemsPerPage integer

    Number of items that the response returns per page.

    Minimum value is 1, maximum value is 500. Default value is 100.

  • pageNum integer

    Number of the page that displays the current set of the total objects that the response returns.

    Minimum value is 1. Default value is 1.

  • pretty boolean

    Flag that indicates whether the response body should be in the prettyprint format.

    Default value is false.

    Prettyprint
  • eventType array[object | string]

    Category of incident recorded at this moment in time.

    IMPORTANT: The complete list of event type values changes frequently.

    One of:
    Alert Audit Types string Alert Audit Types string API User Event Types string Service Account Event Types string Billing Event Types string Federation Settings Event Types string Group Audit Types string Mlab Migration Audit Types string NDS Audit Types string Org Event Types string Partner Event Types string Support Event Types string Team Event Types string User Event Types string Resource Event Types string Atlas Resource Policy Audit Types string

    Values are ALERT_ACKNOWLEDGED_AUDIT or ALERT_UNACKNOWLEDGED_AUDIT.

    Values are ALERT_CONFIG_DISABLED_AUDIT, ALERT_CONFIG_ENABLED_AUDIT, ALERT_CONFIG_ADDED_AUDIT, ALERT_CONFIG_DELETED_AUDIT, or ALERT_CONFIG_CHANGED_AUDIT.

    Values are API_KEY_CREATED, API_KEY_DELETED, API_KEY_ACCESS_LIST_ENTRY_ADDED, API_KEY_ACCESS_LIST_ENTRY_DELETED, API_KEY_ROLES_CHANGED, API_KEY_DESCRIPTION_CHANGED, API_KEY_ADDED_TO_GROUP, API_KEY_REMOVED_FROM_GROUP, API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or API_KEY_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.

    Values are SERVICE_ACCOUNT_CREATED, SERVICE_ACCOUNT_DELETED, SERVICE_ACCOUNT_ROLES_CHANGED, SERVICE_ACCOUNT_DETAILS_CHANGED, SERVICE_ACCOUNT_ADDED_TO_GROUP, SERVICE_ACCOUNT_REMOVED_FROM_GROUP, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_ADDED, SERVICE_ACCOUNT_ACCESS_LIST_ENTRY_DELETED, SERVICE_ACCOUNT_SECRET_ADDED, SERVICE_ACCOUNT_SECRET_DELETED, SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_ENABLED, or SERVICE_ACCOUNT_UI_IP_ACCESS_LIST_INHERITANCE_DISABLED.

    Values are CHARGE_SUCCEEDED, CHARGE_FAILED, CHARGE_PROCESSING, CHARGE_PENDING_REVERSAL, BRAINTREE_CHARGE_FAILED, INVOICE_CLOSED, CHECK_PAYMENT_RECEIVED, WIRE_TRANSFER_PAYMENT_RECEIVED, DISCOUNT_APPLIED, CREDIT_ISSUED, CREDIT_PULLED_FWD, CREDIT_END_DATE_MODIFIED, PROMO_CODE_APPLIED, PAYMENT_FORGIVEN, REFUND_ISSUED, ACCOUNT_DOWNGRADED, ACCOUNT_UPGRADED, ACCOUNT_MODIFIED, SUPPORT_PLAN_ACTIVATED, SUPPORT_PLAN_CANCELLED, SUPPORT_PLAN_CANCELLATION_SCHEDULED, INITIATE_SALESFORCE_SERVICE_CLOUD_SYNC, INVOICE_ADDRESS_CHANGED, INVOICE_ADDRESS_ADDED, PREPAID_PLAN_ACTIVATED, ELASTIC_INVOICING_MODE_ACTIVATED, ELASTIC_INVOICING_MODE_DEACTIVATED, TERMINATE_PAID_SERVICES, BILLING_EMAIL_ADDRESS_ADDED, BILLING_EMAIL_ADDRESS_CHANGED, BILLING_EMAIL_ADDRESS_REMOVED, AWS_BILLING_ACCOUNT_CREDIT_ISSUED, GCP_BILLING_ACCOUNT_CREDIT_ISSUED, CREDIT_SFOLID_MODIFIED, PREPAID_PLAN_MODIFIED, AWS_USAGE_REPORTED, AZURE_USAGE_REPORTED, GCP_USAGE_REPORTED, VERCEL_USAGE_REPORTED, BECAME_PAYING_ORG, NEW_LINKED_ORG, UNLINKED_ORG, ORG_LINKED_TO_PAYING_ORG, ORG_UNLINKED_FROM_PAYING_ORG, ORG_UNLINK_REQUESTED, ORG_UNLINK_CANCELLED, PAYMENT_UPDATED_THROUGH_API, AZURE_BILLING_ACCOUNT_CREDIT_ISSUED, CREDIT_START_DATE_MODIFIED, CREDIT_ELASTIC_INVOICING_MODIFIED, CREDIT_TYPE_MODIFIED, CREDIT_AMOUNT_CENTS_MODIFIED, CREDIT_AMOUNT_REMAINING_CENTS_MODIFIED, CREDIT_TOTAL_BILLED_CENTS_MODIFIED, CREDIT_AWS_CUSTOMER_ID_MODIFIED, CREDIT_AWS_PRODUCT_CODE_MODIFIED, CREDIT_GCP_MARKETPLACE_ENTITLEMENT_ID_MODIFIED, CREDIT_AZURE_SUBSCRIPTION_ID_MODIFIED, CREDIT_AZURE_PRIVATE_PLAN_ID_MODIFIED, TARGETED_REBILL_EXECUTED, LEGACY_REBILL_EXECUTED, EVERGREEN_DEAL_CANCELLED, GRACE_PERIOD_ACTIVATED, GRACE_PERIOD_NO_LONGER_IN_EFFECT, PENDING_DEAL_ACTIVATION_ADDED, PENDING_DEAL_ACTIVATION_CANCELED, PENDING_DEAL_APPLIED, PENDING_DEAL_ACTIVATION_FAILED, or EVERGREEN_PRIORITY_MODIFIED.

    Values are FEDERATION_SETTINGS_CREATED, FEDERATION_SETTINGS_DELETED, FEDERATION_SETTINGS_UPDATED, IDENTITY_PROVIDER_CREATED, IDENTITY_PROVIDER_UPDATED, IDENTITY_PROVIDER_DELETED, IDENTITY_PROVIDER_ACTIVATED, OIDC_IDENTITY_PROVIDER_UPDATED, IDENTITY_PROVIDER_DEACTIVATED, IDENTITY_PROVIDER_JWKS_REVOKED, OIDC_IDENTITY_PROVIDER_ENABLED, OIDC_IDENTITY_PROVIDER_DISABLED, DOMAINS_ASSOCIATED, DOMAIN_CREATED, DOMAIN_DELETED, DOMAIN_VERIFIED, ORG_SETTINGS_CONFIGURED, ORG_SETTINGS_UPDATED, ORG_SETTINGS_DELETED, RESTRICT_ORG_MEMBERSHIP_ENABLED, RESTRICT_ORG_MEMBERSHIP_DISABLED, ROLE_MAPPING_CREATED, ROLE_MAPPING_UPDATED, or ROLE_MAPPING_DELETED.

    Values are GROUP_DELETED, GROUP_CREATED, or GROUP_MOVED.

    Values are MLAB_MIGRATION_COMPLETED, MLAB_MIGRATION_TARGET_CLUSTER_CREATED, MLAB_MIGRATION_DATABASE_USERS_IMPORTED, MLAB_MIGRATION_IP_WHITELIST_IMPORTED, MLAB_MIGRATION_TARGET_CLUSTER_SET, MLAB_MIGRATION_DATABASE_RENAMED, MLAB_MIGRATION_LIVE_IMPORT_STARTED, MLAB_MIGRATION_LIVE_IMPORT_READY_FOR_CUTOVER, MLAB_MIGRATION_LIVE_IMPORT_CUTOVER_COMPLETE, MLAB_MIGRATION_LIVE_IMPORT_ERROR, MLAB_MIGRATION_LIVE_IMPORT_CANCELLED, MLAB_MIGRATION_DUMP_AND_RESTORE_TEST_STARTED, MLAB_MIGRATION_DUMP_AND_RESTORE_TEST_SKIPPED, MLAB_MIGRATION_DUMP_AND_RESTORE_STARTED, MLAB_MIGRATION_SUPPORT_PLAN_SELECTED, or MLAB_MIGRATION_SUPPORT_PLAN_OPTED_OUT.

    Value is ORG_LIMIT_UPDATED.

    Values are ORG_CREATED, CUSTOM_SESSION_TIMEOUT_MODIFIED, SECURITY_CONTACT_MODIFIED, ORG_CREDIT_CARD_ADDED, ORG_CREDIT_CARD_UPDATED, ORG_CREDIT_CARD_CURRENT, ORG_CREDIT_CARD_ABOUT_TO_EXPIRE, ORG_PAYPAL_LINKED, ORG_PAYPAL_UPDATED, ORG_PAYPAL_CANCELLED, ORG_OVERRIDE_PAYMENT_METHOD_ADDED, ORG_ACTIVATED, ORG_TEMPORARILY_ACTIVATED, ORG_SUSPENSION_DATE_CHANGED, ORG_SUSPENDED, ORG_ADMIN_SUSPENDED, ORG_ADMIN_LOCKED, ORG_CLUSTERS_DELETED, ORG_CLUSTERS_PAUSED, ORG_LOCKED, ORG_UNDER_FINANCIAL_PROTECTION, ORG_NO_FINANCIAL_PROTECTION, ORG_RENAMED, ALL_ORG_USERS_HAVE_MFA, ORG_USERS_WITHOUT_MFA, ORG_INVOICE_UNDER_THRESHOLD, ORG_INVOICE_OVER_THRESHOLD, ORG_DAILY_BILL_UNDER_THRESHOLD, ORG_DAILY_BILL_OVER_THRESHOLD, ORG_GROUP_CHARGES_UNDER_THRESHOLD, ORG_GROUP_CHARGES_OVER_THRESHOLD, ORG_TWO_FACTOR_AUTH_REQUIRED, ORG_TWO_FACTOR_AUTH_OPTIONAL, ORG_PUBLIC_API_ACCESS_LIST_REQUIRED, ORG_PUBLIC_API_ACCESS_LIST_NOT_REQUIRED, ORG_EMPLOYEE_ACCESS_RESTRICTED, ORG_EMPLOYEE_ACCESS_UNRESTRICTED, ORG_SFDC_ACCOUNT_ID_CHANGED, ORG_CONNECTED_TO_MLAB, ORG_DISCONNECTED_FROM_MLAB, ORG_IDP_CERTIFICATE_CURRENT, ORG_IDP_CERTIFICATE_ABOUT_TO_EXPIRE, ORG_CONNECTED_TO_VERCEL, ORG_DISCONNECTED_TO_VERCEL, ORG_CONNECTION_UNINSTALLED_FROM_VERCEL, ORG_UI_IP_ACCESS_LIST_ENABLED, ORG_UI_IP_ACCESS_LIST_DISABLED, ORG_EDITED_UI_IP_ACCESS_LIST_ENTRIES, ORG_SERVICE_ACCOUNT_MAX_SECRET_VALIDITY_EDITED, ORG_SERVICE_ACCOUNT_SECRETS_EXPIRED, ORG_SERVICE_ACCOUNT_SECRETS_NO_LONGER_EXPIRED, ORG_SERVICE_ACCOUNT_SECRETS_EXPIRING, ORG_SERVICE_ACCOUNT_SECRETS_NO_LONGER_EXPIRING, ORG_MONGODB_VERSION_EOL_EXTENSION_ACCEPTED, ORG_MONGODB_VERSION_EOL_EXTENSION_PENDING, ORG_MONGODB_VERSION_EOL_EXTENSION_CANCELLED, GROUP_MOVED_FROM_ORG, SANDBOX_ENABLED_FOR_ORG, or SANDBOX_DISABLED_FOR_ORG.

    Values are AWS_SELF_SERVE_ACCOUNT_LINKED, AWS_SELF_SERVE_ACCOUNT_LINK_PENDING, AWS_SELF_SERVE_ACCOUNT_CANCELLED, AWS_SELF_SERVE_ACCOUNT_LINK_FAILED, GCP_SELF_SERVE_ACCOUNT_LINK_PENDING, GCP_SELF_SERVE_ACCOUNT_LINK_FAILED, AZURE_SELF_SERVE_ACCOUNT_LINKED, AZURE_SELF_SERVE_ACCOUNT_LINK_PENDING, AZURE_SELF_SERVE_ACCOUNT_CANCELLED, AZURE_SELF_SERVE_ACCOUNT_LINK_FAILED, GCP_SELF_SERVE_ACCOUNT_LINKED, GCP_SELF_SERVE_ACCOUNT_CANCELLED, VERCEL_SELF_SERVE_ACCOUNT_LINKED, VERCEL_SELF_SERVE_ACCOUNT_LINK_PENDING, VERCEL_SELF_SERVE_ACCOUNT_CANCELLED, VERCEL_SELF_SERVE_ACCOUNT_LINK_FAILED, VERCEL_INVOICE_CREATED, VERCEL_INVOICE_NOT_PAID, VERCEL_INVOICE_PAID, or VERCEL_INVOICE_REFUNDED.

    Values are SUPPORT_EMAILS_SENT_SUCCESSFULLY or SUPPORT_EMAILS_SENT_FAILURE.

    Values are TEAM_CREATED, TEAM_DELETED, TEAM_UPDATED, TEAM_NAME_CHANGED, TEAM_ADDED_TO_GROUP, TEAM_REMOVED_FROM_GROUP, or TEAM_ROLES_MODIFIED.

    Values are JOINED_ORG, JOINED_TEAM, INVITED_TO_ORG, ORG_INVITATION_DELETED, REMOVED_FROM_ORG, REMOVED_FROM_TEAM, USER_ROLES_CHANGED_AUDIT, ORG_FLEX_CONSULTING_PURCHASED, ORG_FLEX_CONSULTING_PURCHASE_FAILED, or INVITED_TO_TEAM.

    Values are TAGS_MODIFIED or GROUP_TAGS_MODIFIED.

    Values are RESOURCE_POLICY_CREATED, RESOURCE_POLICY_MODIFIED, RESOURCE_POLICY_DELETED, or RESOURCE_POLICY_VIOLATED.

  • includeRaw boolean

    Flag that indicates whether to include the raw document in the output. The raw document contains additional meta information about the event.

    Default value is false.

  • maxDate string(date-time)

    Date and time from when MongoDB Cloud stops returning events. This parameter uses the ISO 8601 timestamp format in UTC.

    ISO 8601
  • minDate string(date-time)

    Date and time from when MongoDB Cloud starts returning events. This parameter uses the ISO 8601 timestamp format in UTC.

    ISO 8601

Responses

  • 200 application/vnd.atlas.2023-01-01+json

    OK

    Hide response attributes Show response attributes object
    • links array[object]

      List of one or more Uniform Resource Locators (URLs) that point to API sub-resources, related API resources, or both. RFC 5988 outlines these relationships.

      Web Linking Specification (RFC 5988)
      Hide links attributes Show links attributes object
      • href string

        Uniform Resource Locator (URL) that points another API resource to which this response has some relationship. This URL often begins with https://cloud.mongodb.com/api/atlas.

      • rel string

        Uniform Resource Locator (URL) that defines the semantic relationship between this resource and another API resource. This URL often begins with https://cloud.mongodb.com/api/atlas.

    • results array[object]

      List of returned documents that MongoDB Cloud provides when completing this request.

      One of:
      DefaultEventViewForOrg object AlertAudit object AlertConfigAudit object ApiUserEventViewForOrg object ServiceAccountOrgEvents object BillingEventViewForOrg object NDSAuditViewForOrg object OrgEventViewForOrg object TeamEvent object UserEventViewForOrg object ResourceEventViewForOrg object AtlasResourcePolicyAuditForOrg object
    • totalCount integer(int32)

      Total number of documents available. MongoDB Cloud omits this value if includeCount is set to false. The total number is an estimate and may not be exact.

      Minimum value is 0.
  • 400 application/json

    Bad Request.

    Hide response attributes Show response attributes object
    • badRequestDetail object

      Bad request detail.

      Hide badRequestDetail attribute Show badRequestDetail attribute object
      • fields array[object]

        Describes all violations in a client request.

        Hide fields attributes Show fields attributes object
        • description string Required

          A description of why the request element is bad.

        • field string Required

          A path that leads to a field in the request body.

    • detail string

      Describes the specific conditions or reasons that cause each type of error.

    • error integer(int32) Required

      HTTP status code returned with this error.

      External documentation
    • errorCode string Required

      Application error code returned with this error.

    • parameters array[object]

      Parameters used to give more information about the error.

    • reason string

      Application error message returned with this error.
  • 401 application/json

    Unauthorized.

    Hide response attributes Show response attributes object
    • badRequestDetail object

      Bad request detail.

      Hide badRequestDetail attribute Show badRequestDetail attribute object
      • fields array[object]

        Describes all violations in a client request.

        Hide fields attributes Show fields attributes object
        • description string Required

          A description of why the request element is bad.

        • field string Required

          A path that leads to a field in the request body.

    • detail string

      Describes the specific conditions or reasons that cause each type of error.

    • error integer(int32) Required

      HTTP status code returned with this error.

      External documentation
    • errorCode string Required

      Application error code returned with this error.

    • parameters array[object]

      Parameters used to give more information about the error.

    • reason string

      Application error message returned with this error.
  • 403 application/json

    Forbidden.

    Hide response attributes Show response attributes object
    • badRequestDetail object

      Bad request detail.

      Hide badRequestDetail attribute Show badRequestDetail attribute object
      • fields array[object]

        Describes all violations in a client request.

        Hide fields attributes Show fields attributes object
        • description string Required

          A description of why the request element is bad.

        • field string Required

          A path that leads to a field in the request body.

    • detail string

      Describes the specific conditions or reasons that cause each type of error.

    • error integer(int32) Required

      HTTP status code returned with this error.

      External documentation
    • errorCode string Required

      Application error code returned with this error.

    • parameters array[object]

      Parameters used to give more information about the error.

    • reason string

      Application error message returned with this error.
  • 404 application/json

    Not Found.

    Hide response attributes Show response attributes object
    • badRequestDetail object

      Bad request detail.

      Hide badRequestDetail attribute Show badRequestDetail attribute object
      • fields array[object]

        Describes all violations in a client request.

        Hide fields attributes Show fields attributes object
        • description string Required

          A description of why the request element is bad.

        • field string Required

          A path that leads to a field in the request body.

    • detail string

      Describes the specific conditions or reasons that cause each type of error.

    • error integer(int32) Required

      HTTP status code returned with this error.

      External documentation
    • errorCode string Required

      Application error code returned with this error.

    • parameters array[object]

      Parameters used to give more information about the error.

    • reason string

      Application error message returned with this error.
  • 500 application/json

    Internal Server Error.

    Hide response attributes Show response attributes object
    • badRequestDetail object

      Bad request detail.

      Hide badRequestDetail attribute Show badRequestDetail attribute object
      • fields array[object]

        Describes all violations in a client request.

        Hide fields attributes Show fields attributes object
        • description string Required

          A description of why the request element is bad.

        • field string Required

          A path that leads to a field in the request body.

    • detail string

      Describes the specific conditions or reasons that cause each type of error.

    • error integer(int32) Required

      HTTP status code returned with this error.

      External documentation
    • errorCode string Required

      Application error code returned with this error.

    • parameters array[object]

      Parameters used to give more information about the error.

    • reason string

      Application error message returned with this error.
GET /api/atlas/v2/orgs/{orgId}/events 
atlas api events listOrgEvents --help
import (
	"os"
	"context"
	"log"
	sdk "go.mongodb.org/atlas-sdk/v20250312001/admin"
)

func main() {
	ctx := context.Background()
	clientID := os.Getenv("MONGODB_ATLAS_CLIENT_ID")
	clientSecret := os.Getenv("MONGODB_ATLAS_CLIENT_SECRET")

	// See https://dochub.mongodb.org/core/atlas-go-sdk-oauth
	client, err := sdk.NewClient(sdk.UseOAuthAuth(clientID, clientSecret))

	if err != nil {
		log.Fatalf("Error: %v", err)
	}

	params = &sdk.ListOrgEventsApiParams{}
	sdkResp, httpResp, err := client.EventsApi.
		ListOrgEventsWithParams(ctx, params).
		Execute()
}

curl --include --header "Authorization: Bearer ${ACCESS_TOKEN}" \
  --header "Accept: application/vnd.atlas.2025-03-12+json" \
  -X GET "https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/events?pretty=true"
curl --user "${PUBLIC_KEY}:${PRIVATE_KEY}" \
  --digest --include \
  --header "Accept: application/vnd.atlas.2025-03-12+json" \
  -X GET "https://cloud.mongodb.com/api/atlas/v2/orgs/{orgId}/events?pretty=true"
Response examples (200) 
{
  "links": [
    {
      "href": "https://cloud.mongodb.com/api/atlas",
      "rel": "self"
    }
  ],
  "results": [
    {
      "apiKeyId": "32b6e34b3d91647abb20e7b8",
      "created": "2025-05-04T09:42:00Z",
      "eventTypeName": "FEDERATION_SETTINGS_CREATED",
      "groupId": "32b6e34b3d91647abb20e7b8",
      "id": "32b6e34b3d91647abb20e7b8",
      "isGlobalAdmin": true,
      "links": [
        {
          "href": "https://cloud.mongodb.com/api/atlas",
          "rel": "self"
        }
      ],
      "orgId": "32b6e34b3d91647abb20e7b8",
      "publicKey": "string",
      "raw": {
        "_t": "ALERT_AUDIT",
        "alertConfigId": "32b6e34b3d91647abb20e7b8",
        "cid": "32b6e34b3d91647abb20e7b8",
        "cre": "2025-05-04T09:42:00Z",
        "description": "Alert Acknowledged",
        "gn": "Test Project",
        "id": "32b6e34b3d91647abb20e7b8",
        "orgId": "32b6e34b3d91647abb20e7b8",
        "orgName": "Test Organization",
        "severity": "INFO"
      },
      "remoteAddress": "216.172.40.186",
      "userId": "32b6e34b3d91647abb20e7b8",
      "username": "hello@example.com"
    }
  ],
  "totalCount": 42
}
Response examples (400) 
{
  "error": 400,
  "detail": "(This is just an example, the exception may not be related to this endpoint) No provider AWS exists.",
  "reason": "Bad Request",
  "errorCode": "VALIDATION_ERROR"
}
Response examples (401) 
{
  "error": 401,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Unauthorized",
  "errorCode": "NOT_ORG_GROUP_CREATOR"
}
Response examples (403) 
{
  "error": 403,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Forbidden",
  "errorCode": "CANNOT_CHANGE_GROUP_NAME"
}
Response examples (404) 
{
  "error": 404,
  "detail": "(This is just an example, the exception may not be related to this endpoint) Cannot find resource AWS",
  "reason": "Not Found",
  "errorCode": "RESOURCE_NOT_FOUND"
}
Response examples (500) 
{
  "error": 500,
  "detail": "(This is just an example, the exception may not be related to this endpoint)",
  "reason": "Internal Server Error",
  "errorCode": "UNEXPECTED_ERROR"
}