GetClassificationLogs API¶

Returns the full classification history log for the specified document or folder path. Each log entry records a change to the security classification level, including the new level, who made the change, the reason, and any associated downgrade or declassify dates. Use this API to audit classification changes for compliance and governance reporting.

Endpoint¶

/srv.asmx/GetClassificationLogs

Methods¶

• GET /srv.asmx/GetClassificationLogs?AuthenticationTicket=...&Path=...
• POST /srv.asmx/GetClassificationLogs (form data)
• SOAP Action: http://tempuri.org/GetClassificationLogs

Parameters¶

Required Permissions¶

The Path is resolved to a document or folder, and the caller passes when either holds:

• the library's read classification log policy grants them the item. By default that is the item's owner, the library's managers, and users with Full Control on it; each library can change this in its policies (SetDomainPolicies);
• they are an administrator, a member of [Audit Managers], or a manager of the item's library.

Up to 8.7 only the second was checked: the policy was ignored, so the owner and the users it named were refused. This is how GetSoxLogs and GetISOLogs already worked.

Response¶

Success Response¶

Returns a <response> element with success="true" containing a <Value> element with zero or more <ClassificationLogEntry> child elements. Entries are ordered by ActionDate ascending (oldest first).

<response success="true" error="">
  <Value>
    <ClassificationLogEntry>
      <ObjectTypeId>1</ObjectTypeId>
      <ObjectType>DOCUMENT</ObjectType>
      <ObjectId>9871</ObjectId>
      <ObjectName>Q1-2024-Report.pdf</ObjectName>
      <DomainId>5</DomainId>
      <DomainName>Finance</DomainName>
      <Path>/Finance/Reports/Q1-2024-Report.pdf</Path>
      <BeforeClassificationLevelId>0</BeforeClassificationLevelId>
      <BeforeClassificationLevel>NoMarkings</BeforeClassificationLevel>
      <BeforeDowngradeOn>0001-01-01T00:00:00</BeforeDowngradeOn>
      <BeforeDeclassifyOn>0001-01-01T00:00:00</BeforeDeclassifyOn>
      <ClassificationLevelId>3</ClassificationLevelId>
      <ClassificationLevel>Secret</ClassificationLevel>
      <DowngradeOn>2026-01-01T00:00:00</DowngradeOn>
      <DeclassifyOn>2028-06-01T00:00:00</DeclassifyOn>
      <ReasonForAction>Classified for Q1 sensitivity review period.</ReasonForAction>
      <ActionDate>2024-06-15T14:30:00</ActionDate>
      <ActionbyId>12</ActionbyId>
      <ActionByName>jsmith</ActionByName>
      <FolderId>0</FolderId>
      <Agency>Finance Division</Agency>
    </ClassificationLogEntry>
  </Value>
</response>

ClassificationLogEntry Field Reference¶

ClassificationLevel Values¶

No Entries Response¶

<response success="true" error="">
  <Value />
</response>

Error Response¶

<response success="false" error="Insufficient rights." />

Example Requests¶

GET¶

GET /srv.asmx/GetClassificationLogs?AuthenticationTicket=3f2504e0-4f89-11d3-9a0c-0305e82c3301&Path=/Finance/Reports/Q1-2024-Report.pdf HTTP/1.1
Host: server.example.com

POST¶

POST /srv.asmx/GetClassificationLogs HTTP/1.1
Content-Type: application/x-www-form-urlencoded

AuthenticationTicket=3f2504e0-4f89-11d3-9a0c-0305e82c3301&Path=/Finance/Reports/Q1-2024-Report.pdf

SOAP 1.1¶

POST /srv.asmx HTTP/1.1
Content-Type: text/xml; charset=utf-8
SOAPAction: "http://tempuri.org/GetClassificationLogs"

<?xml version="1.0" encoding="utf-8"?>
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
  <soap:Body>
    <GetClassificationLogs xmlns="http://tempuri.org/">
      <AuthenticationTicket>3f2504e0-4f89-11d3-9a0c-0305e82c3301</AuthenticationTicket>
      <Path>/Finance/Reports/Q1-2024-Report.pdf</Path>
    </GetClassificationLogs>
  </soap:Body>
</soap:Envelope>

JavaScript¶

Every call answers XML with HTTP 200, success or not, so success is the thing to branch on and errorCode is the number to report.

async function call(action, params) {
  const response = await fetch(`/srv.asmx/${action}?${new URLSearchParams(params)}`);
  const root = new DOMParser()
    .parseFromString(await response.text(), 'text/xml')
    .documentElement;

  if (root.getAttribute('success') !== 'true') {
    throw new Error(`${root.getAttribute('errorCode')}: ${root.getAttribute('error')}`);
  }
  return root;
}

Reports how a document’s classification has changed. Entries are under <Value>, and a document with none is a success with nothing in it rather than an error.

const root = await call('GetClassificationLogs', {
  authenticationTicket: ticket,
  Path: '/Public/ApiTests/test-document.txt'
});

Notes¶

• Library-level permission only: because Path always resolves to a specific object, the access check is always scoped to that object's library. System-wide admin rights are not required.
• Documents and folders: the Path parameter accepts both document and folder paths.
• Chronological order: entries are always returned in ascending ActionDate order (oldest first).
• Before fields: Before* fields reflect the state before the change. In older log entries these may be 0 / NoMarkings / 0001-01-01 if the previous state was not recorded at the time.
• Date format: ActionDate, DowngradeOn, DeclassifyOn, and their Before* counterparts are ISO 8601 date-time strings. A value of 0001-01-01T00:00:00 indicates that no date was set.
• Path not found: if Path does not resolve to any existing document or folder, an error is returned.
• No date or user filter: this API returns all classification events for the exact path specified. Use Path alone to scope the results.

Error Codes¶

The errorCode values this operation returns, checked against a running server:

Related APIs¶

• SetClassificationLevel - Set the classification level of a document or folder
• GetDeleteLog - Get the deletion log for documents and folders
• GetSecurityChangeLog - Get the security (access control) change log
• GetOwnershipChangeLog - Get the ownership change log