topic Re: API access to cdFMC audit log configuration changes in Network Security

API access to cdFMC audit log configuration changes

rc11 — Mon, 20 Oct 2025 20:23:15 GMT

Hi there,

I tried posting this in the Technology and Support forums and it was marked as spam within minutes. It's been an absolute nightmare to get any clear information on the API endpoints that we're trying to access, and this community is my only hope...

So YES, this is a repost of my previously posted topic, but it is NOT SPAM. I am trying to get some help here!

My developer colleague and I (detection engineer) would like to call the following API endpoint:

GET/api/fmc_platform/v1/domain/{domainUUID}/audit/configchanges

However, according to the documentation in API Explorer, this call requires a parameter called snapshotId that is not documented anywhere else, and doesn't even show up anywhere in the GUI. Furthermore, there is no API endpoint that would return valid snaphot IDs.

Does anyone know what this parameter represents, and how to get any or all valid snapshotId values for a tenant?

Thanks in advance.

Re: API access to cdFMC audit log configuration changes

bigevilbeard — Mon, 20 Oct 2025 20:53:44 GMT

Might be putting two a two together and getting a dog here. But from what I can gather in this doc https://www.cisco.com/c/en/us/td/docs/security/cdo/cloud-delivered-firewall-management-center-in-cdo/API/cloud_delivered_firewall_management_center_rest_api_quick_start_guide/Objects_In_The_REST_API.pdf

The snapshotId you provide is the uuid of the corresponding entry from the main audit records log. It looks like Ytou would first query the GET auditrecords endpoint to find the ID of the configuration change event, and then use that ID as the snapshotId to get the detailed diff

Re: API access to cdFMC audit log configuration changes

rc11 — Mon, 20 Oct 2025 21:12:25 GMT

We'll try that and report back with the results! Thank you 🙂

Re: API access to cdFMC audit log configuration changes

rc11 — Wed, 19 Nov 2025 22:28:18 GMT

Hey there bigevilbeard, we tried passing auditrecords IDs as snapshotId parameters, and that did not work out. We're going to try to get a TAC case going for the logs we were unable to pull from API calls. Thank you for weighing in!

Edit: we noticed a snapshotId attribute in a Save Policy log, so we tested it out. Those are the actual snapshotId values we needed for a successful GET from the configchanges endpoint. This answers my question. Thank you!