REST API Reference v2.1 -- Audit Logs
GET /audit-log
Returns paginated audit log entries for the organization. Every API request, authentication event, configuration change, and security event generates an audit log entry. Query parameters: actor_id (user or API key ID), action (login, create, update, delete, export, etc.), resource_type (user, team, policy, scan, alert, api_key), resource_id, start (ISO 8601), end (ISO 8601), outcome (success, failure), page, limit.
Response: {"data": [{"id": "audit_001", "timestamp": "2025-08-12T14:30:00Z", "actor": {"id": "user_abc", "type": "user", "email": "admin@example.com", "ip": "203.0.113.42"}, "action": "update", "resource": {"type": "policy", "id": "pol_abc", "name": "Production Gate"}, "outcome": "success", "changes": {"before": {"enforcement": "warn"}, "after": {"enforcement": "strict"}}}]}. Change entries include before/after values for update operations, enabling full change tracking.
POST /audit-log/search
Advanced audit log search with full-text search and boolean operators. Supports complex queries for incident investigation. Request body: {"query": "action:delete AND resource_type:api_key AND outcome:success", "start": "2025-08-01T00:00:00Z", "end": "2025-08-12T23:59:59Z", "sort": "timestamp:desc", "limit": 50}. The query language supports field-specific search, wildcards, and boolean operators (AND, OR, NOT).
Search results include aggregations for quick analysis: {"data": [...], "aggregations": {"actions": {"create": 45, "update": 123, "delete": 7}, "actors": {"user_abc": 89, "api_key_xyz": 86}, "outcomes": {"success": 168, "failure": 7}}}. Use aggregations to identify patterns such as which actors performed the most sensitive operations or which resources were most frequently modified.
POST /audit-log/export
Exports audit logs for a date range in JSON or CSV format. Requires audit-log:export scope. Request body: {"start": "2025-07-01T00:00:00Z", "end": "2025-07-31T23:59:59Z", "format": "json", "filters": {"resource_type": ["user", "api_key", "policy"]}}. Exports are generated asynchronously and delivered via a presigned download URL.
Response: {"export_id": "exp_abc", "status": "processing", "estimated_rows": 15420, "download_url": null}. Poll GET /audit-log/export/:id until status changes to completed and download_url is populated. Download URLs expire after 24 hours. For exports exceeding 1 million rows, the output is split into multiple files and delivered as a ZIP archive.
Updated April 2025. Some URLs may require authentication for full access.