Searching Audit Data (Queries)
To search for audit messages, use the QueryAuditHistory service. The service takes the following optional parameters:
Default Value
The maximum number of results to return from the query. (INTEGER)
500 items
The language in which to return the results. (STRING)
The locale of the logged-in user submitting the query
A date and time. The query will look up audit messages, starting from the date and time you specify here. (DATETIME)
A date and time. The query will stop looking up audit messages when the date/time of the messages reaches the date and time you specify here. (DATETIME)
A query string (in JSON format).
The category of audit messages that you want to search. See the table of audit categories in Audit Categories.
This parameter contains the i18n non-localized category name.
The format for this service follows:

QueryAuditHistory(maxItems [INTEGER], startDate [DATETIME], endDate [DATETIME],
auditCategory [STRING],query[QUERY], locale[STRING])
By default, a query returns 500 rows. To change the number of rows returned by the query, set the maxItems parameter to the desired number of rows. There is an upper limit to the number of rows that you can specify for the maxItems parameter. A system administrator sets this limit when configuring the Audit Subsystem. To change the upper limit for maxItems, a system administrator should update the setting,Highest value that can be set for maxItems parameter for QueryAuditHistory, in the configuration of the Audit Subsystem. This service takes a single parameter, MaxItemsQueryUpperLimit, which has a ThingWorx base type of NUMBER. This value must be greater than or equal to 500 rows.