audit
Open an operation to see its authentication, its parameters and the fields of its request and response.
7 operations
GET/v1/audit
The organization’s audit log, newest first, with filters (owners and admins).
/v1/auditAuthentication: Dashboard session
Parameters
| Name | Type | Description |
|---|---|---|
fromquery | string (date-time) | string | |
toquery | string (date-time) | string | |
actorquery | string | |
actor_typequery | enum | Values user | agent | system | customer | github |
actionquery | string | |
workspace_idquery | string | |
targetquery | string | |
qquery | string | |
cursorquery | string | |
limitquery | integer |
Response 200
| Name | Type | Description |
|---|---|---|
itemsrequired | array of object | |
items[].idrequired | string | |
items[].org_idrequired | string | |
items[].workspace_idrequired | string | |
items[].actorrequired | string | |
items[].actor_typerequired | enum | Values user | agent | system | customer | github |
items[].actionrequired | string | |
items[].targetrequired | string | |
items[].metadatarequired | object | |
items[].iprequired | string | |
items[].created_atrequired | string (date-time) | |
items[].actor_labelrequired | string | |
items[].workspace_namerequired | string | |
next_cursorrequired | string | |
export_availablerequired | boolean |
GET/v1/audit/export
Exports the entries matching the filters as CSV or JSON Lines (Enterprise).
/v1/audit/exportAuthentication: Dashboard session
Parameters
| Name | Type | Description |
|---|---|---|
fromquery | string (date-time) | string | |
toquery | string (date-time) | string | |
actorquery | string | |
actor_typequery | enum | Values user | agent | system | customer | github |
actionquery | string | |
workspace_idquery | string | |
targetquery | string | |
qquery | string | |
formatquery | enum | Values csv | jsonl |
Response 200
No fields.
GET/v1/audit/stream
The SIEM stream of the audit log and its delivery state.
/v1/audit/streamAuthentication: Dashboard session
Response 200
| Name | Type | Description |
|---|---|---|
availablerequired | boolean | |
streamrequired | object | |
stream.endpointrequired | string | |
stream.enabledrequired | boolean | |
stream.actionsrequired | array of string | |
stream.secret_last4required | string | |
stream.last_attempt_atrequired | string (date-time) | |
stream.last_success_atrequired | string (date-time) | |
stream.last_statusrequired | integer | |
stream.last_errorrequired | string | |
stream.consecutive_failuresrequired | integer | |
stream.next_attempt_atrequired | string (date-time) | |
stream.delivered_countrequired | integer | |
stream.delivered_untilrequired | string (date-time) | |
stream.created_atrequired | string (date-time) | |
stream.updated_atrequired | string (date-time) | |
secretrequired | string |
PUT/v1/audit/stream
Creates or changes the SIEM stream (Enterprise); the signing secret is shown once.
/v1/audit/streamAuthentication: Dashboard session
Request body
| Name | Type | Description |
|---|---|---|
endpoint_url | string (uri) | |
enabled | boolean | |
actions | array of string | |
start | enum | Values now | beginning |
Response 200
The same fields as GET /v1/audit/stream.
DELETE/v1/audit/stream
Removes the SIEM stream and its signing secret.
/v1/audit/streamAuthentication: Dashboard session
Response 200
| Name | Type | Description |
|---|---|---|
okrequired | true |
POST/v1/audit/stream/rotate-secret
Replaces the signing secret of the SIEM stream; the new one is shown once.
/v1/audit/stream/rotate-secretAuthentication: Dashboard session
Response 200
The same fields as GET /v1/audit/stream.
POST/v1/audit/stream/test
Sends a signed test batch to the SIEM endpoint.
/v1/audit/stream/testAuthentication: Dashboard session
Response 200
| Name | Type | Description |
|---|---|---|
okrequired | boolean | |
statusrequired | integer | |
errorrequired | string | |
duration_msrequired | integer |