# Audit Trail

Returns a list of audit trails.

**Sync Type: Incremental**

## Requirements

Before you connect Monad to Clumio, you need an Access Token, and need to determine the region of your account. 

[Create an API Service Token](https://help.clumio.com/docs/api-tokens#service-tokens)
[Determine the Region associated with your Clumio account](https://help.clumio.com/docs/aws-regions-supported-by-clumio)

## Details

Monad uses the `timestamp` filter on the [API](https://help.clumio.com/reference/list-audit-trails) to determine what data to display. This field is updated every time a request to get audit trails is successful with the last time a request to get audit trails was initiated. If this was the first time requesting for data, a full sync of the data is performed. 

## Configuration
The following configuration defines the input parameters. Each field's specifications, such as type, requirements, and descriptions, are detailed below.

#### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Region | string | No | The region associated with your Clumio account. |
| Protection Group S3 Asset ID | string | No | Filter by the ID of the protection group S3 asset. |
| Parent Protection Group Backup ID | string | No | Filter by the ID of the parent protection group backup. |
| Bucket Region | string | No | Filter by the bucket region (e.g., us-west-2). |
| Backfill Start Time | string | No | The date to start fetching data from. If not specified, no past records will be fetched. |


#### Secrets

| Secret | Type | Required | Description |
|---------|------|----------|-------------|
| Access Token | string | Yes | Token used to authenticate with the Clumio APIs. |



## Sample Record

```json
{
  "action": "user_deleted",
  "category": "backup",
  "details": "{\"request_body\":{\"email\":\"user@monad.com\",\"org_id\":123456789012345678},\"tags\":[{\"type\":\"auth\",\"id\":\"Password\",\"value\":\"Password\"},{\"type\":\"organizational_unit\",\"id\":\"00000000-0000-0000-0000-000000000000\",\"value\":\"IT Department\"}]}",
  "id": "d38fcaa9-200d-538e-a661-fbed769b1fc5",
  "interface": "webhook",
  "ip_address": "49.45.32.190",
  "parent_entity": null,
  "primary_entity": {
    "id": "Restore_Task",
    "type": "auth",
    "value": "Multi-Factor Authentication"
  },
  "status": "failure",
  "timestamp": "2025-08-11T23:46:28.285759Z",
  "user_email": "Peter Miller@example.com"
}
```