Syntax and options for `uip admin audit`, which queries and exports UiPath admin audit events at organization and tenant scope and manages organization audit exclusion rules.

uip admin audit queries and exports UiPath audit events — the platform-level admin audit trail (distinct from uip or audit-logs, which covers Orchestrator entity changes). Part of uip admin (overview), the UiPath admin tool.

Two scope subgroups register the identical three-verb read shape (sources, events, export):

The org subgroup also has an exclusions subgroup, which manages the rules that stop matching events from being recorded. There is no tenant-scoped exclusions subgroup. A rule names the tenants it applies to with --exclude-tenant.

Typical workflow: audit <scope> sources (discover source IDs) → audit <scope> events --source <guid> --from-date … --to-date … (find the rows) → audit <scope> export --from-date … --to-date … --output-path … (download them).

tenant verbs additionally accept --tenant-id <guid> to override the tenant from your login context; org verbs do not (organization scope has no tenant to override).

List the audit event sources visible at this scope — each source is a top-level event category (for example Identity, Tenant, Robot). Use the returned Id values with events --source <guid>.

Code is AuditTenantSources under tenant.

Query audit events at this scope, paginated. Returns { AuditEvents, Next, Previous } — not a bare array. Cursor naming is chronological: Next is newer events, Previous is older. When --limit exceeds 200 the CLI paginates internally (following the older-events cursor) since the server clamps each call to 200 rows.

Code is AuditTenantEvents under tenant.

Export audit events from the long-term store. Issues one HTTP call per UTC day inside [--from-date, --to-date] and aggregates the results in memory before writing anything out — the full window is fetched first, and on any single day's failure the export aborts atomically (nothing is written; the failure names the day that failed).

--output-path is a base directory, not a file path — pass a folder, and the CLI generates a uniquely-named output inside it, stamped with the window and generation time (e.g. audit_2026-01-01_2026-02-01_20260617T112630), so repeated exports of the same window never collide:

JSON format:

CSV format adds an Events count in place of Files:

Code is AuditTenantExport under tenant.

Manage the organization's audit exclusion rules, which define the events the audit trail stops recording.

A rule carries at most one selector per dimension: Tenant, EventSource, EventTarget, EventType, and Status. Values inside a selector are OR-ed, and selectors are AND-ed: --type A --type B --status Success excludes successful events of type A or type B. A rule with no selector is refused, because it would exclude every event.

Exclusion starts when a rule becomes active and is never retroactive. Events already in the trail stay there, and widening a rule's match set resets its exclusion start time. An inactive rule excludes nothing, so you can stage a replacement next to the rule it replaces.

UiPath's own monitoring events and audit-configuration changes, including changes to the exclusion rules themselves, can never be excluded.

get, update, and delete take a <rule> positional: the rule's name or its policy ID. A name is unique only among active rules. If an inactive rule shares the name, the CLI asks for the policy ID instead of picking one. A rule name shaped like a GUID is refused.

Reading rules requires audit-read permission. Creating, updating, and deleting rules requires a user token whose identity is in the Administrators group. Service-to-service tokens are refused on writes.

create and update accept the same options. Pass either --file or the inline flags, not both.

Pass at least one selector flag. Selector values are GUIDs, except for --status.

A --file body accepts only the name, enforcement, isActive, and selectors keys. Each selector carries a type (one of the dimension names) and a non-empty values array. enforcement defaults to Exclude, the only accepted value, and isActive defaults to true. Server-owned fields, such as policyId and the timestamps, are rejected. The body uses camelCase field names, while get and list print PascalCase keys, so re-case the fields when you build a body from a rule you read.

List every exclusion rule in the organization, ordered by name. The result is not paginated. A rule whose stored definition cannot be parsed is listed with an empty Selectors array, so you can still delete it.

Data shape (--output json):

Read one exclusion rule by name or policy ID.

Returns Code: AuditOrgExclusionsGet with a single rule object under Data, in the same shape as a list entry.

Create an exclusion rule. The rule is active unless you pass --inactive. An active rule is refused when another active rule has the same name, or already excludes every event the new rule would.

Returns Code: AuditOrgExclusionsCreated with the created rule under Data. A rule created with --inactive has IsActive: false and ActivatedOn: null.

Replace an exclusion rule in full. Any selector you omit is dropped, so resend every flag the rule keeps. Read the rule first with exclusions get. Without --inactive, the rule is saved as active, even when it was inactive before the update.

Renaming a rule keeps its exclusion start time. Changing the events it matches resets that time.

Returns Code: AuditOrgExclusionsUpdated with the replaced rule under Data.

Delete an exclusion rule. Events the rule was excluding are recorded again from that point on. Events suppressed while the rule was active are not restored.

Data shape (--output json):