Download an ArcGIS Online Organization Audit log for events related to a specific item ID

Summary

This article describes the steps for a URL Query workflow that allows any user to pull up to 10,000 records related to a single item ID from an Organization's Audit history in ArcGIS Online. This allows retrieving the entire history of a single ArcGIS Online item without having to search or filter through thousands of unrelated events.

Sometimes items exist in Organizations for a very long time, but at some point require the history of the item to be investigated. Rather than pulling the entire audit log for multiple months of events from the Organization, it is possible to create a query to download a log of events related only to one specific item ID. This avoids the confusion of having to piece together a history for a specific item ID from several different event logs containing many unrelated entries.

Procedure

Step 1: Generate a Token

1. Open developer tools in your browser. In the Chrome options menu: More tools > Developer tools
2. Sign into arcgis.com with your administrator credentials.
3. In the developer tools, click the Network tab and type self into the filter box.
4. Click the first URL in the Name list, click the Headers tab, and scroll to Query String Parameters (the very last section).
5. Copy the token value to use in requests.

Step 2: Modify the following URL to fit your needs, and paste your token on the end:

https://<SHORTNAME>.maps.arcgis.com/sharing/rest/portals/self/history?all=true&start=0&sortOrder=asc&fromDate=<YYYY-MM-DD>&num=10000&f=csv&type=i&id=<ITEMID>&token=<TOKEN>

• Organization <SHORTNAME> can be obtained from your Organization settings page.
• <YYYY-MM-DD> Indicates the beginning date of the log to query events from.

Note:
Make sure to set the beginning date to be a few days before the estimated creation date of the item you are querying!

• <ITEMID> is the item ID of the item you are querying in ArcGIS Online. This can be found on the item details page for the item, at the end of the URL for the page.
• <TOKEN> is the token value from Step 1.