Skip to content

Audit log

Every change, refusal and security event in the organization.

Paths are relative to your API address. See Authentication.

Request and response examples are generated from the schema; the tables under Schemas are the reference.

List audit events

GET /v1/orgs/{org_id}/audit-events

The organization's audit log, newest first, a page at a time, filtered by time, category, name, outcome, actor, target or operation.

Input parameters

Parameter In Type Default Nullable Description
Authorization header string N/A No Bearer followed by a service account's API key. The console uses your signed-in session instead.
actor query string Yes
actor_type query string Yes Who acted, by kind: human, service, support, operator or system, or several separated by commas, such as human,operator,support.
category query string Yes
cursor query string Yes
from query string Yes
limit query integer Yes
name query string Yes
operation query string Yes
org_id path string No
outcome query string Yes
target query string Yes
to query string Yes

Responses

{
    "items": [
        {
            "action": "string",
            "actor": {
                "function": "string",
                "id": "string",
                "type": "string"
            },
            "category": "string",
            "description": "string",
            "id": "string",
            "name": "string",
            "occurred_at": "2022-04-13T15:42:05.901Z",
            "operation_id": "string",
            "outcome": "string",
            "reason": "string",
            "request_id": "string",
            "severity": "string",
            "summary": {},
            "target": {
                "id": "string",
                "type": "string"
            }
        }
    ],
    "next_cursor": "string",
    "taxonomy_version": 0
}

{
    "detail": [
        {
            "ctx": {},
            "input": null,
            "loc": [
                null
            ],
            "msg": "string",
            "type": "string"
        }
    ]
}

Get an audit event

GET /v1/orgs/{org_id}/audit-events/{event_id}

One audit event: who did what to which target, when, and the outcome.

Input parameters

Parameter In Type Default Nullable Description
Authorization header string N/A No Bearer followed by a service account's API key. The console uses your signed-in session instead.
event_id path string No
org_id path string No

Responses

{
    "action": "string",
    "actor": {
        "function": "string",
        "id": "string",
        "type": "string"
    },
    "category": "string",
    "description": "string",
    "id": "string",
    "name": "string",
    "occurred_at": "2022-04-13T15:42:05.901Z",
    "operation_id": "string",
    "outcome": "string",
    "reason": "string",
    "request_id": "string",
    "severity": "string",
    "summary": {},
    "target": {
        "id": "string",
        "type": "string"
    },
    "taxonomy_version": 0
}

{
    "detail": [
        {
            "ctx": {},
            "input": null,
            "loc": [
                null
            ],
            "msg": "string",
            "type": "string"
        }
    ]
}

Export audit events

GET /v1/orgs/{org_id}/audit-events:export

The audit events matching the same filters as the list, streamed as JSON lines or CSV for keeping or analysis elsewhere.

Input parameters

Parameter In Type Default Nullable Description
Authorization header string N/A No Bearer followed by a service account's API key. The console uses your signed-in session instead.
actor query string Yes
actor_type query string Yes Who acted, by kind: human, service, support, operator or system, or several separated by commas, such as human,operator,support.
category query string Yes
format query string jsonl No
from query string Yes
name query string Yes
operation query string Yes
org_id path string No
outcome query string Yes
target query string Yes
to query string Yes

Responses

"string"

{
    "detail": [
        {
            "ctx": {},
            "input": null,
            "loc": [
                null
            ],
            "msg": "string",
            "type": "string"
        }
    ]
}

Schemas

AuditActor

Name Type Description
function string | null For NubeStack Cloud itself: which part of it acted.
id string | null The person or service account (usr_…).
type string human, service, support, operator or system.

AuditEvent

Name Type Description
action string The action as recorded, for support.
actor AuditActor
category string
description string
id string The event (evt_…).
name string The event's systematic name, such as project.create.
occurred_at string(date-time)
operation_id string | null
outcome string accepted, succeeded, failed or denied.
reason string | null The reason given for the change, if one was.
request_id string | null
severity string
summary What changed, with secrets left out.
target AuditTarget

AuditEventList

Name Type Description
items Array<AuditEvent>
next_cursor string | null Pass as cursor for the next page; null on the last page.
taxonomy_version integer

AuditEventView

Name Type Description
action string The action as recorded, for support.
actor AuditActor
category string
description string
id string The event (evt_…).
name string The event's systematic name, such as project.create.
occurred_at string(date-time)
operation_id string | null
outcome string accepted, succeeded, failed or denied.
reason string | null The reason given for the change, if one was.
request_id string | null
severity string
summary What changed, with secrets left out.
target AuditTarget
taxonomy_version integer The version of the names and categories.

AuditTarget

Name Type Description
id string | null
type string | null

HTTPValidationError

Name Type Description
detail Array<ValidationError>

ValidationError

Name Type Description
ctx
input
loc Array<>
msg string
type string