Sign in

v1

latestOpenAPI 3.1.0Apache 2.02026-07-264001921002.3 KB
Audit Logs

List audit logs

Retrieves CADF-compliant audit log events with filtering, search, and pagination via query parameters. Most filter dimensions accept either a single value (singular parameter, e.g. action) or a JSON-encoded array of values (plural parameter, e.g. actions); when both are supplied the plural array takes precedence.

get/api/audit-logs

Query parameters

pageinteger

Page number for offset-based pagination (default 1).

limitinteger

Number of events to return per page (default 100, max 1000).

cursorstring

Opaque cursor for cursor-based pagination (from next_cursor).

searchstring

Free-text search across audit event fields.

action'create' | 'read' | 'update' | 'delete' | 'authenticate' | 'authorize' | 'access' | 'enable' | 'disable' | 'start' | 'stop' | 'backup' | 'restore' | 'export' | 'import'

The CADF action performed.

Filter by a single CADF action.

actionsstring

JSON array of CADF actions to filter by (OR match).

outcome'success' | 'failure' | 'pending'

The CADF outcome of the action.

Filter by a single outcome.

outcomesstring

JSON array of outcomes to filter by (OR match).

event_type'activity' | 'monitor' | 'control'

Classifies the audit event.

Filter by a single event type.

event_typesstring

JSON array of event types to filter by (OR match).

initiator_idstring

Filter by a single initiator ID.

initiator_idsstring

JSON array of initiator IDs to filter by (OR match).

initiator_type'user' | 'api_key' | 'system' | 'provider' | 'virtual_key' | 'team' | 'customer' | 'role' | 'permission' | 'guardrail' | 'mcp_client' | 'mcp_tool_group' | 'plugin' | 'config' | 'session' | 'inference'

The type of resource involved in an audit event (initiator or target).

Filter by a single initiator resource type.

initiator_typesstring

JSON array of initiator resource types to filter by (OR match).

target_idstring

Filter by a single target ID.

target_idsstring

JSON array of target IDs to filter by (OR match).

target_type'user' | 'api_key' | 'system' | 'provider' | 'virtual_key' | 'team' | 'customer' | 'role' | 'permission' | 'guardrail' | 'mcp_client' | 'mcp_tool_group' | 'plugin' | 'config' | 'session' | 'inference'

The type of resource involved in an audit event (initiator or target).

Filter by a single target resource type.

target_typesstring

JSON array of target resource types to filter by (OR match).

start_datestring

Filter events at or after this time (RFC3339 or YYYY-MM-DD).

end_datestring

Filter events at or before this time (RFC3339 or YYYY-MM-DD; a date is treated as end-of-day).

periodstring

Relative time window that overrides start_date/end_date when set (e.g. 24h, 7d).

request_methodstring

Filter by a single HTTP request method.

request_methodsstring

JSON array of HTTP request methods to filter by (OR match).

request_pathstring

Filter by a single request path prefix.

request_pathsstring

JSON array of request path prefixes to filter by (OR match).

request_ipstring

Filter by a single client IP address.

request_ipsstring

JSON array of client IP addresses to filter by (OR match).

tagsstring

JSON array of tags to filter by (any match).

sort_bystring

Field to sort by (default event_time).

sort_order'asc' | 'desc'

Sort direction.

Response

Successful response

totalinteger required

Total count of events matching the filter.

pageinteger required

Current page number.

limitinteger required

Page size.

total_pagesinteger required

Total number of pages.

has_moreboolean required

Whether there are more results.

next_cursorstring

Opaque cursor for the next page (cursor-based pagination).