List audit logs

Can be used by the following roles assigned at the organization scope:

• ORG_ADMIN
• AUDITOR

GET /api/v1/auditlogevents

cURL

cURL

curl --request GET \
  --url 'https://cockroachlabs.cloud/api/v1/auditlogevents?starting_from=SOME_STRING_VALUE&sort_order=SOME_STRING_VALUE&limit=SOME_INTEGER_VALUE' \
  --header 'Authorization: Bearer REPLACE_BEARER_TOKEN'

200

{
  "entries": [
    {
      "action": "AUDIT_LOG_ACTION_CREATE_CLUSTER",
      "cluster_id": "<string>",
      "cluster_name": "<string>",
      "created_at": "2023-11-07T05:31:56Z",
      "error": "<string>",
      "id": "<string>",
      "metadata": {
        "ip_address": "<string>"
      },
      "payload": "<string>",
      "service_account_name": "<string>",
      "session_id": "<string>",
      "source": "AUDIT_LOG_SOURCE_CC_API",
      "system_actor_name": "SYSTEM_ACTOR_NAME_SYSTEM",
      "trace_id": "<string>",
      "user_email": "<string>"
    }
  ],
  "next_starting_from": "2023-11-07T05:31:56Z"
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

starting_from · string<date-time>

starting_from is the (exclusive) timestamp from which log entries will be returned in the response based on their created_at time, respecting the sort order specified in pagination. If unset, the default will be the current time if results are returned in descending order and the beginning of time if results are in ascending order.

sort_order · enum<string>

sort_order is the direction of pagination, with starting_from as the start point. If unset, the default is ascending order.

• ASC: Sort in ascending order. This is the default unless otherwise specified.
• DESC: Sort in descending order.

Available options: ASC, DESC

limit · integer<int32>

limit is the number of entries requested in the response. Note that the response may still contain slightly more results, since the response will always contain every entry at a particular timestamp.

Response

200

application/json

A successful response.

entries · object[]

entries is the contiguous list of audit log entries matching the pagination request, sorted in the order requested.

Show child attributes

next_starting_from · string<date-time>

next_starting_from is the timestamp the caller should use to continue paginating in the same direction. If the timestamp is unset, it means that there are no more entries in the direction of the request, and there never will be.