Continuation Mark

When exporting data from the Audit Database, a successful response includes:

  • For XML—A <ContinuationMark> inside the <ActivityRecordsList> root element.
  • For JSON—An object with the "ContinuationMark" field.

Continuation mark is a checkpoint, use it to retrieve data starting with the next Activity Record.

Send a POST request containing Continuation mark to the following endpoints:

Method Endpoint Description



Returns next Activity Records.



Returns next Activity Records matching a filter criteria.

NOTE: Ensure to pass information about transferred data, including Content-Type:application/xml or application/json and encoding. The syntax greatly depends on the tool you use.

You can send as many POST requests as you want. A new response returns next Activity Records and a new Continuation mark. Once all the Activity Records are retrieved, you will receive a 200 OK response with no Activity Records inside the ActivityRecordList root element (XML) or array (JSON).


Copy the contents of ContinuationMark to a separate XML or JSON file (e.g., ContMark.xml).

Format Schema description


The file must be compatible with the XML schema. On the computer where Netwrix Auditor Server resides, you can find XSD file under Netwrix_Auditor_installation_folder\Audit Core\API Schemas.

The ContinuationMark root element contains a value previously returned by Netwrix Auditor Integration API.


JSON-formatted Continuation mark includes the field value in quotes.

If you want to retrieve next Activity Records for your search, include the Continuation mark to your Search parameters file. See Search Parameters for more information.


Retrieve Activity Records
<?xml version="1.0" standalone="yes"?>
<ContinuationMark xmlns="">
Search Activity Records
<?xml version="1.0" standalone="yes"?>
<ActivityRecordSearch xmlns="">
<DataSource>Active Directory</DataSource>
<ObjectType Operator="DoesNotContain">Group</ObjectType>
Retrieve Activity Records
Search Activity Records
"ContinuationMark": "PG5yPjxuIG49IntFNzA...PjwvYT48L24+PC9ucj4A+PC9ucj4A",
"FilterList": {
"Who": "Administrator",
"DataSource": "Active Directory",
"Action": "Added",
"ObjectType": { "DoesNotContain": "Group"},
"When": {
"From": "2016-09-16T16:30:00+11:00",
"To": "2017-03-16T00:00:00Z"