Thank you so much. You were very helpful.

Thanks for the answer. If i understand correctly, this specific line should be place inside REST API for make audit to work? So, if i don't have any access to the REST API code the desired audit is not possible?

Hi! 

Thanks for your answer. I've read the docs through out couple times to find the explanation but did not find any. I'll try to express my self more crystal

Suppose i have some myUI app in my IRIS instance. This myUI using DeepSee REST API to get the data. I need to get track of any activity on that UI at any time (in general when a user requests the data)

What should i need as the audit source? 

myUI? Some endpoint from API? Some class executing by this endpoint?

Documentation says:
"Event Source*

The component of the InterSystems IRIS instance that is the source of the event. For InterSystems IRIS events, this is “%System” or “%Ensemble”. For user-defined events, the name can be any string that includes alphanumeric characters or punctuation, except for colons and commas; it can begin with any of these characters except for the percent sign. This can be up to 64 bytes."

Ok, what string? How any random string can be serve as audit source? Same for the audit type 

I get that the string represents my app or part of it, but how that will track actions from myUI?