# Audit Logs

Ingests audit log events from the Experian developer platform for security monitoring and compliance.

**Sync Type: Incremental**

## Prerequisites

Before connecting Monad to Experian, you need:

1. An **Experian developer account**: sign up or log in at [developer.experian.com](https://developer.experian.com/get-started).
2. An **application** created in the Experian developer portal. Creating an app generates the Client ID and Client Secret used to authenticate API requests.
3. A **service account**: a dedicated email address and password provisioned for non-interactive API access. Your Experian account manager can provision a service account. Using your personal developer-portal credentials works but is not recommended because developer-portal passwords expire every 90 days.
4. Confirmed access to the **Client Gateway API** (Experian One / Ascend Technology platform). If the `/v1/audits` endpoint returns a 403, contact your Experian account manager to have Client Gateway API access enabled on your account.

> **Regional endpoint:** Experian exposes region-specific API hosts (US, UK, EU, IN, SG, AU). The connector defaults to the **US production host** `https://us-api.experian.com`; override the **Base URL** setting to target another region - replace the `us-` prefix with the region code (`uk-`, `eu-`, `in-`, etc.) following Experian's [OAuth 2.0 tutorial](https://developer.experian.com/tutorials/oauth-20-tutorial). For sandbox testing, use the corresponding sandbox host (e.g. `https://sandbox-us-api.experian.com`).

### Obtaining Credentials

1. Log in to [developer.experian.com](https://developer.experian.com/get-started).
2. Navigate to **My Apps** and create a new application (or select an existing one).
3. Copy the **Client ID** and **Client Secret** from the application settings page.
4. The **Username** is the email address of your service account (or your developer-portal login for testing).
5. The **Password** is the corresponding service-account password.

## Configuration

### Settings

| Setting | Type | Required | Description |
| ------- | ---- | -------- | ----------- |
| Base URL | string | Yes | The Experian API base URL for your region. Defaults to `https://us-api.experian.com` (US production). Override for other regions using the pattern `https://{region}-api.experian.com` — see [Experian's OAuth 2.0 tutorial](https://developer.experian.com/tutorials/oauth-20-tutorial) for the full list of regional hostnames. Must be an `https://` URL. |
| Client ID | string | Yes | The Experian application client ID. Found in your Experian Client Gateway application settings. |
| Username | string | Yes | The Experian portal email address for the service account used to authenticate. |
| Backfill Start Time | string | No | The date (ISO 8601 / RFC3339) to start fetching audit events from. If not specified, only events received after the connector first runs will be collected. Example: `2026-01-01T00:00:00Z`. |

### Secrets

| Secret | Type | Required | Description |
| ------ | ---- | -------- | ----------- |
| Client Secret | string | Yes | The Experian application client secret. Found in your Experian Client Gateway application settings. |
| Password | string | Yes | The Experian portal password for the service account used to authenticate. |

## Setup Walk-through

1. **Create or identify your Experian application**: follow the Authentication section above to locate the Client ID and Client Secret for your application in the Experian developer portal.

2. **Provision a service account**: contact your Experian account manager to create a dedicated service-account email and password with access to the Client Gateway API.

3. **Create the input in Monad**:
   - Open your Monad workspace and navigate to **Inputs**.
   - Click **Add Input** and select **Experian: Audit Logs**.

4. **Fill in the configuration**:
   - Leave **Base URL** on its default (`https://us-api.experian.com`) for US production, or set it to your region's host (e.g. `https://uk-api.experian.com`, `https://sandbox-us-api.experian.com` for sandbox testing).
   - Enter the **Client ID** and **Username** (service-account email address) in the Settings section.
   - Optionally set a **Backfill Start Time** (RFC3339, e.g. `2026-01-01T00:00:00Z`) to load historical audit events from that date onward.
   - Enter the **Client Secret** and **Password** in the Secrets section.

5. **Save and test**: click **Test Connection**. Monad will authenticate against the Experian token endpoint and query the audit logs API to confirm the credentials are valid.

6. **Activate**: once the connection test passes, enable the input. Monad will incrementally sync audit events, advancing its cursor after each run so only new events are fetched on subsequent runs.

## Troubleshooting

### Common Issues

1. **Authentication Errors (401 / invalid_grant)**
   - Confirm all four credentials (Client ID, Client Secret, Username, Password) are correct and belong to the same Experian application and service account.
   - Experian developer-portal passwords expire every 90 days. If authentication was previously working and suddenly fails, the service-account password may need to be rotated.
   - Verify the application in the Experian developer portal is active and not suspended.

2. **403 Forbidden on `/v1/audits`**
   - Your account or application may not have Client Gateway API access enabled. Contact your Experian account manager to request access to the Experian One / Ascend Technology platform audit logs endpoint.

3. **No Records Returned**
   - If **Backfill Start Time** is set in the future, no historical events will fall within the window. Clear or adjust the value.
   - Confirm your Experian organization has audit activity by checking the Experian One console directly.
   - Verify the **Base URL** matches the environment your credentials are provisioned for — sandbox credentials will not authenticate against production hosts (and vice versa).

4. **Wrong Region / Base URL**
   - If authentication fails with 401 or 404 across every endpoint, the configured **Base URL** may be pointing at a region your account isn't provisioned in. The default (`https://us-api.experian.com`) targets US production; use the regional host for your account (`uk-`, `eu-`, etc.) — see [Experian's OAuth 2.0 tutorial](https://developer.experian.com/tutorials/oauth-20-tutorial) for the full regional list.

## Related Articles

- [Experian Developer Portal](https://developer.experian.com/get-started)
- [Experian OAuth 2.0 Tutorial](https://developer.experian.com/tutorials/oauth-20-tutorial) — lists sandbox regional hostnames and references production equivalents.
- [Experian Client Gateway API](https://developer.experian.com/products/client-gateway-api)
- [Experian Quick Start Guide](https://developer.experian.com/tutorials/quick-start-guide)