API actions are governed by named ACLs. When filtering the audit log, pass one of these names in the <acl> filter (optionally together with an HTTP method). The names are grouped below by event category.
<acl>
Devices
Device
DevAttr
DevPeers
DevPeerAcct
DeviceReport
DeviceReports
DevRevive
DevAccessListMember
DevAccessList
CCScheduleRestore
CCSchedulesRestore
CCScheduleSRestore
DevRestoreItems
DevRestore
DownFile
SPath
BPath
BSearch
BSearchInfoCategories
Shares
Share
SsoConfig
SsoConfigs
MFAConfig
MFAPolicyAttrs
MFARuleAttrs
UserSiemIntegration
DevRTBFBatches