Forum Discussion

JMP99's avatar
JMP99
Icon for Joining the Conversation rankJoining the Conversation
1 month ago

Has anyone successfully queried the auditFeed endpoint using the Cato API?

I’m trying to automate daily audit/change reporting from our Cato tenant by using the auditFeed GraphQL endpoint. I can successfully authenticate and run other queries (such as accountMetrics), but every valid auditFeed request results in the following error:

{
  "errors": [
    {
      "message": "internal server error",
      "path": ["auditFeed", "timeFrame"]
    }
  ],
  "data": { "auditFeed": null }
}

Here is the minimal reproducible query:


Query

query TestAuditFeed($accountIds: [ID!]!, $timeFrame: TimeFrame!) {
  auditFeed(accountIDs: $accountIds, timeFrame: $timeFrame) {
    from
    to
    fetchedCount
    hasMore
    marker
    accounts { id }
  }
}


Variables:

{
  "accountIds": ["<my-account-id>"],
  "timeFrame": { "last": "P1D" }
}

This request passes schema validation but the resolver returns an internal error every time.
Attempts with from/to, small windows, and other valid TimeFrame shapes produce the same error.
Introspection (__type) is disabled for my tenant, so I cannot check field-level definitions.

Question:
Has anyone successfully used auditFeed in a production Cato tenant?
If so, could you share a working query + variables example, or any insight on required schema structure or known limitations?

Appreciate any help in validating that this will work or if there is some issue I am running up against. Thank you.

1 Reply

  • JMP99's avatar
    JMP99
    Icon for Joining the Conversation rankJoining the Conversation

    I found the solution:

    The timeFrame parameter should be a string (type TimeFrame!), not an object. The API expects a specific string format. According to the documentation, the timeFrame should be formatted as a UTC string like:

    "utc.2023-02-{28/00:00:00--28/23:59:59}"

    Or for relative time periods, use the format:

    "last.P1D"

    In order to fix it I changed it to:

    "timeFrame": "last.P1D"