I'm receiving incomplete / invalid JSON responses for certain Graph requests in the new AuditLog beta
I have used the https://graph.microsoft.com/beta/security/auditLog/queries
beta API URI to create three different AuditLogQuery searches. All three were created in the same way, and all three succeeded.
I can make requests to https://graph.microsoft.com/beta/security/auditLog/queries/f48207db-1a74-4735-9b81-2206bb274b5b/records
(using the relevant query ID) to fetch records, and follow the @odata.nextLink
values to handle pageified data.
However, for one of my three searches, when I make my request to fetch records, I receive an incomplete JSON object for the first page. Requesting the second page via the nextLink
does NOT provide me with completing JSON. i.e. combining page 1 and 2 does not "complete" the first response's JSON.
I've included below an anonymised version of the last object in the value
array, and you can see that it is incomplete:
{
"id": "2fec18db-25c7-f171-ee53-1c2313e25dce",
"createdDateTime": "2024-01-25T17:20:43Z",
"auditLogRecordType": "Yammer",
"operation": "O365SyncAdminUserPromotion",
"organizationId": "ce88f12e-332b-41cc-be1d-664529afd86d",
"userType": "Regular",
"userId": "10032001121ddbf8",
"service": "Yammer",
"objectId": "NoObjectIdSpecified",
"userPrincipalName": "steve@acme.onmicrosoft.com",
"clientIp": null,
"administrativeUnits": [
""
]{
"error": {
"code": "UnknownError",
"message": "Unexpected Jsontoken. Check response for property value[56].auditData.ActorYammerUserId",
"innerError": {
"date": "2024-04-04T16:07:31",
"request-id": "25ce8ee1-4662-442a-b71a-aa9ac33d85cb",
"client-request-id": "25ce8ee1-4662-442a-b71a-aa9ac33d85cb"
}
}
}