---
updatedAt: 2026-05-21T16:41:02.000Z
---

# Enable WS-Federation audit trace for the tenant

Enable audit logging of the Security Token Response in the WS-Federation or WS-Trust response for the tenant.<br><br><b>enabled</b><br>Set to true to enable tenant level audit logging of the Security Token Response in the WS-Federation or WS-Trust response.<br><b>allUsers</b><br>Enabling tenant level audit logging of the Security Token Response in WS-Federation or WS-Trust response is applied to all users.<br>This field will be ignored.<br><b>users</b><br>Enabling tenant level audit logging of the Security Token Response in WS-Federation or WS-Trust response is applied to all users.<br>This field will be ignored.<br><b>expiry</b><br>Period to enable audit logging of the Security Token Response in WS-Federation or WS-Trust response for. <br>The value can be specified in seconds, minutes or hours. e.g. 120s, 10m, 1h. <br>If expiry is not specified or is specified in an invalid format, the default expiry of 10 minutes will be used. <br>The maximum expiry is 1 hour. If the expiry specified is more than 1 hour, e.g. 2h, the maximum expiry of 1 hour will be used.<br><br><br><b>Example payload</b>: <br>&nbsp&nbsp{<br>&nbsp&nbsp&nbsp&nbsp"enabled": true,<br>&nbsp&nbsp&nbsp&nbsp"expiry": "10m"<br>&nbsp&nbsp}<br>

# OpenAPI definition

```json
{
  "openapi": "3.0.1",
  "info": {
    "version": "1.0.0",
    "description": "Federation",
    "title": "Federation"
  },
  "servers": [
    {
      "url": "https://{tenanturl}",
      "variables": {
        "tenanturl": {
          "default": "{tenant_url}",
          "description": "URL of your IBM Security Verify tenant"
        }
      }
    }
  ],
  "tags": [
    {
      "name": "WS Federation Management"
    }
  ],
  "paths": {
    "/v1.0/wsf/federations/trace": {
      "post": {
        "tags": [
          "WS Federation Management"
        ],
        "summary": "Enable WS-Federation audit trace for the tenant",
        "description": "Enable audit logging of the Security Token Response in the WS-Federation or WS-Trust response for the tenant.<br><br><b>enabled</b><br>Set to true to enable tenant level audit logging of the Security Token Response in the WS-Federation or WS-Trust response.<br><b>allUsers</b><br>Enabling tenant level audit logging of the Security Token Response in WS-Federation or WS-Trust response is applied to all users.<br>This field will be ignored.<br><b>users</b><br>Enabling tenant level audit logging of the Security Token Response in WS-Federation or WS-Trust response is applied to all users.<br>This field will be ignored.<br><b>expiry</b><br>Period to enable audit logging of the Security Token Response in WS-Federation or WS-Trust response for. <br>The value can be specified in seconds, minutes or hours. e.g. 120s, 10m, 1h. <br>If expiry is not specified or is specified in an invalid format, the default expiry of 10 minutes will be used. <br>The maximum expiry is 1 hour. If the expiry specified is more than 1 hour, e.g. 2h, the maximum expiry of 1 hour will be used.<br><br><br><b>Example payload</b>: <br>&nbsp&nbsp{<br>&nbsp&nbsp&nbsp&nbsp\"enabled\": true,<br>&nbsp&nbsp&nbsp&nbsp\"expiry\": \"10m\"<br>&nbsp&nbsp}<br>",
        "operationId": "updateTenantTrace",
        "requestBody": {
          "description": "Trace enablement payload",
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/AuditTrace"
              }
            }
          },
          "required": true
        },
        "responses": {
          "204": {
            "description": "No content",
            "content": {}
          },
          "400": {
            "description": "Bad Request",
            "content": {}
          },
          "500": {
            "description": "Internal Server Error",
            "content": {}
          }
        },
        "x-category": "Federation",
        "x-publicAPI": "true",
        "x-codegen-request-body-name": "body"
      }
    }
  },
  "components": {
    "schemas": {
      "AuditTrace": {
        "required": [
          "enabled"
        ],
        "type": "object",
        "properties": {
          "enabled": {
            "type": "boolean",
            "description": "Enable audit logging of the Security Token Response in WS-Federation or WS-Trust response.",
            "example": true
          },
          "allUsers": {
            "type": "boolean",
            "description": "Enable audit logging of the Security Token Response in WS-Federation or WS-Trust response for all users.",
            "example": false
          },
          "users": {
            "type": "array",
            "description": "Specify the list of users' uids, for whom to enable audit logging of the Security Token Response in the WS-Federation or WS-Trust response. This is required when enabled is set to true and allUsers is set to false.",
            "items": {
              "type": "string"
            }
          },
          "expiry": {
            "type": "string",
            "description": "Enable audit logging of the Security Token Response in WS-Federation or WS-Trust response for the specified period. The value can be specified in seconds, minutes or hours. e.g. 120s, 10m, 1h. If the expiry is not specified or invalid format, the default expiry will be used, which is 10 minutes.The maximum expiry is 1 hour, if the expiry specified is more than 1 hour, e.g. 2h, the maximum expiry 1 hour will be used.",
            "example": "10m"
          }
        }
      }
    }
  },
  "x-original-swagger-version": "2.0",
  "x-explorer-enabled": false
}
```