Для пользователя по потокам тело вот таким будет:
{
"resourceType" : "Stream",
"subjectRef" : {
"resourceFilter" : "((((userId eq 'e.semina'))))",
},
"actions" : 46, // The actions to audit.
"environmentAttributes" : "",
"resourceProperties" : ["name"],
"subjectProperties" : ["name", "userid", "userdirectory"],
"auditLimit" : 1000,
"outputObjectsPrivileges" : "4 ",
}