From 99ec877df6e06759aeb242abda397370f6a173e1 Mon Sep 17 00:00:00 2001
From: Ivan Dimov <78815270+idimov-keeper@users.noreply.github.com>
Date: Mon, 4 May 2026 19:15:07 -0500
Subject: [PATCH] Fix audit_report: route named event types to audit_event_type

AuditReportFilter.event_type accepts both numeric IDs and symbolic
names (e.g. 'login'), but get_filter() always sent them under the
'event_type' API key. The server expects symbolic names under
'audit_event_type' and only numeric IDs under 'event_type', so
name-based filters were being silently ignored.

Split mixed input across both keys; preserve the existing
single-value-vs-list collapsing.
---
 .../src/keepersdk/enterprise/audit_report.py  | 40 +++++++++----------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/keepersdk-package/src/keepersdk/enterprise/audit_report.py b/keepersdk-package/src/keepersdk/enterprise/audit_report.py
index 4612d578..2a2e32ef 100644
--- a/keepersdk-package/src/keepersdk/enterprise/audit_report.py
+++ b/keepersdk-package/src/keepersdk/enterprise/audit_report.py
@@ -127,27 +127,27 @@ def get_filter(self) -> Optional[Dict[str, Any]]:
                 else:
                     raise ValueError(f'Invalid created filter: {self.filter.created}')
         if self.filter.event_type is not None:
-            if isinstance(self.filter.event_type, str):
-                if self.filter.event_type.isnumeric():
-                    report_filter['event_type'] = int(self.filter.event_type)
-                else:
-                    report_filter['event_type'] = self.filter.event_type
-            elif isinstance(self.filter.event_type, int):
-                report_filter['event_type'] = self.filter.event_type
-            elif isinstance(self.filter.event_type, list):
-                report_filter['event_type'] = []
-                for x in self.filter.event_type:
-                    if isinstance(x, str):
-                        if x.isnumeric():
-                            report_filter['event_type'].append(int(x))
-                        else:
-                            report_filter['event_type'].append(x)
-                    elif isinstance(x, int):
-                        report_filter['event_type'].append(x)
-                    else:
-                        raise ValueError(f'Invalid event_type filter: {x}')
+            # API contract: numeric IDs go under 'event_type', symbolic names under 'audit_event_type'.
+            numeric_ids: List[int] = []
+            named_types: List[str] = []
+            if isinstance(self.filter.event_type, list):
+                items: List[Union[str, int]] = list(self.filter.event_type)
             else:
-                raise ValueError(f'Invalid event type filter: {self.filter.event_type}')
+                items = [self.filter.event_type]
+            for x in items:
+                if isinstance(x, int):
+                    numeric_ids.append(x)
+                elif isinstance(x, str):
+                    if x.isnumeric():
+                        numeric_ids.append(int(x))
+                    else:
+                        named_types.append(x)
+                else:
+                    raise ValueError(f'Invalid event_type filter: {x}')
+            if numeric_ids:
+                report_filter['event_type'] = numeric_ids[0] if len(numeric_ids) == 1 else numeric_ids
+            if named_types:
+                report_filter['audit_event_type'] = named_types[0] if len(named_types) == 1 else named_types
         if self.filter.keeper_version:
             if isinstance(self.filter.keeper_version, (str, int)):
                 report_filter['keeper_version'] = self.filter.keeper_version