List audit logs
GET /v1/audit-logs
Get a paginated list of audit logs.
Token scope required: audit-logs:list
Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Query Parameters
Section titled “Query Parameters ”Cursor value at which to start the results, provided in nextCursor or prevCursor of a prior request
Example
bmV4dA.eyJsb2dzLmNyZQ5iIiwiX3ZhbHVlIjo9In19Number of records to return in each page
Order in which to return results. Each endpoint sorts on its own key (for example, hosts by
name and audit logs by creation time). Matching is case-insensitive, and any value other than
desc sorts ascending.
Return only audit logs for the specified target
Return only audit logs matching the specified target type
Responses
Section titled “ Responses ”Successful operation
object
object
object
An API key which used to perform the action.
Null if the API key has since been deleted.
object
A user who signed in through an endpoint OIDC provider to enroll or renew a host.
object
A host. Used for example when hosts are enrolled.
Null if the host has since been deleted.
object
A user who logged in using SSO.
object
A member of Defined Networking support staff.
object
System actor, used for events such as creation or rotation of Certificate Authorities.
object
A logged-in user.
Null if the user has since been deleted.
An actor type not listed above. New actor types may be added, so clients should accept this shape and ignore fields they don’t recognize.
object
The entity being acted upon.
object
The kind of entity acted upon. New values may be added, so clients should accept values not listed here.
Known values:
apiKeycadomainendpointOIDChostnetworkoidcProviderorganizationroleroutetaguser
Information about what happened, including relevant values before & after the change.
object
The type of event that occurred. New values may be added, so clients should accept values not listed here.
Known values:
CREATEDUPDATEDDELETEDDELETED_TOTPCREATED_TOTPSUCCEEDED_AUTHFAILED_AUTHENROLLEDRENEWEDCREATED_ENROLL_CODESET_NETWORK_CABLOCKED_HOSTUNBLOCKED_HOSTSET_OVERRIDESUPDATED_TOTPUPDATED_SUBSCRIPTIONCHANGED_DOMAIN_VERIFICATIONCREATED_WEBAUTHNDELETED_WEBAUTHNUPDATED_WEBAUTHNENABLED_MANAGED_LIGHTHOUSESIGNED_MANAGED_LIGHTHOUSERENEWED_NETWORK_ACCESS
The state of the target before the change was made. The shape depends on the target and event type. Can also be a string or null (e.g. target was created).
The state of the target after the change was made. The shape depends on the target and event type. Can also be a string or null (e.g. target was deleted).
object
The total number of resources existing in the account. Only present when includeCounts is true.
Is there a page of data that can be fetched using the nextCursor?
Is there a page of data that can be fetched using the prevCursor?
An opaque string that can be used to fetch the next page of results. Not provided if result set is empty.
An opaque string that can be used to fetch the previous page of results. Not provided if result set is empty.
Only present when includeCounts is true.
object
The number of results returned in the response.
The zero-based index of the first result within the overall list. For example, the first page will have a start of 0. If 25 results are fetched, and the nextCursor used to fetch a new page of results, the second request’s start will be 25.
Examples
Paginated list of audit logs
{ "data": [ { "id": "log-F3TTIDMKZH5XFH37RTRLIP3TOA", "organizationID": "org-F63A24JGCLJV3ZEUTLCBISGETA", "timestamp": "2023-02-15T13:59:09.828868Z", "actor": { "id": "dnkey-DXALSPQONG7H45QZAVTPRDMAPU", "name": "example api key", "type": "apiKey" }, "target": { "id": "role-LO4SPDSWTZNJC676WFCZKUB3ZQ", "type": "role" }, "event": { "type": "CREATED", "before": null, "after": { "name": "My New Role", "description": "", "firewallRules": null } } } ], "metadata": { "hasNextPage": true, "hasPrevPage": true, "nextCursor": "bmV4dA.bHVlIjoieGJVS0UvYkRjQmZsY1pUbGJCc", "prevCursor": "cHJldg.SI6ImIiLCJfdmFsdWUiOiI0dDVuREQreU" }}The API key is missing, invalid or expired.
object
object
A static name for the error type
A short human readable description of the error
Describes the variable missing or malformed
The query parameter the error relates to, such as filter.targetType
Machine-readable details about the error. ERR_LIMIT_EXCEEDED errors carry limit and limitName.
object
The maximum number of resources allowed
The kind of resource the limit applies to
Example
{ "errors": [ { "code": "ERR_UNAUTHORIZED", "message": "unauthorized" } ]}The API key lacks a required scope.
object
object
A static name for the error type
A short human readable description of the error
Describes the variable missing or malformed
The query parameter the error relates to, such as filter.targetType
Machine-readable details about the error. ERR_LIMIT_EXCEEDED errors carry limit and limitName.
object
The maximum number of resources allowed
The kind of resource the limit applies to
Examples
The API key lacks a required scope.
{ "errors": [ { "code": "ERR_FORBIDDEN", "message": "api key must support the following scopes: hosts:read" } ]}The organization has exceeded its API request rate limit. Retry the request after a short delay.
object
object
A static name for the error type
A short human readable description of the error
Describes the variable missing or malformed
The query parameter the error relates to, such as filter.targetType
Machine-readable details about the error. ERR_LIMIT_EXCEEDED errors carry limit and limitName.
object
The maximum number of resources allowed
The kind of resource the limit applies to
Example
{ "errors": [ { "code": "ERR_TOO_MANY_REQUESTS", "message": "too many requests" } ]}