auditLogSearches

Audit Log Searches. Run and queue searches across unified and mailbox audit logs. The auditLogSearches entity set lives under /exchange/v1.0/auditLogSearches in the eDiscovery & audit category.

Fact	Value
Path	/exchange/v1.0/auditLogSearches
Category	eDiscovery & audit
Tier	Tier 5, Compliance
Read role	Compliance.IPPS.Read.All (Community)
Write role	none (read-only)
Backing cmdlets	Get-AuditLogSearch, Search-UnifiedAuditLog, New-MailboxAuditLogSearch

Routes

Method	Path	Synopsis	Role	Plan
GET	/exchange/v1.0/auditLogSearches	List auditLogSearches entries.	Compliance.IPPS.Read	Community
GET	/exchange/v1.0/auditLogSearches/{key}	Get a single auditLogSearches entry by Identity.	Compliance.IPPS.Read	Community

GET /exchange/v1.0/auditLogSearches

List auditLogSearches entries.

Backing cmdlet: Get-AuditLogSearch. Role: Compliance.IPPS.Read (Community).

Parameter	In	Type	Required	Description
type	query	string		Filter by search type (admin | mailbox).
createdAfter	query	datetime		Created after this UTC timestamp.
createdBefore	query	datetime		Created before this UTC timestamp.
resultSize	query	int		Limit on rows returned. Honors -ResultSize.

List Purview saved audit log searches

Lists current (pending) audit log search jobs created via New-AdminAuditLogSearch or New-MailboxAuditLogSearch, plus EAC-initiated audit exports. Completed searches drop off the list automatically. Backed by Get-AuditLogSearch (EXO pool - Wiki applicable: Exchange Online). NOTE: this is the SAVED-SEARCH definition list - for ad-hoc audit record queries see Search-UnifiedAuditLog (deferred to a dedicated slice). Optional ?type=admin|mailbox, ?createdAfter, ?createdBefore narrow the result.

GET /exchange/v1.0/auditLogSearches HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#auditLogSearches",
  "value": []
}

Related: GET /exchange/v1.0/auditLogSearches/{key}

GET /exchange/v1.0/auditLogSearches/{key}

Get a single auditLogSearches entry by Identity.

Backing cmdlet: Get-AuditLogSearch. Role: Compliance.IPPS.Read (Community).