Skip to content
StratumStratum Docs

List audit events.

GET
/v1/audit
Code sample: Shell / cURL
curl --request GET \
  --url 'https://stratum.example.com/v1/audit?outcome=success&order=asc' \
  --header 'Authorization: Bearer <token>'

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
organizationId
string
projectId
string
principalId
string
action
string
resourceArn
string
outcome
string
Allowed values: success failure denied
name
string

Exact match on the audit event name (dotted form, e.g. iam.access.denied). page one event class exactly instead of over-fetching by outcome and narrowing client-side.

errorCode
string

Exact match on outcome.errorCode (e.g. INSUFFICIENT_PERMISSIONS) — slice denials/failures by reason.

from
string format: date-time
to
string format: date-time
limit
integer
>= 1 <= 200
pageToken
string
order
string
default: asc
Allowed values: asc desc

Page order by event timestamp. asc (the default) is oldest-first and is what every existing caller and page token assumes.

desc exists because oldest-first is the wrong default for reading a log: on a cluster with any history the first page is the install bootstrap, and an operator handed an event id by /v1/audit/integrity/verify cannot reach that row without paging the whole log. A page token is only valid for the order it was issued under; reusing one across orders walks the wrong way.

Responses

Section titled “Responses”

200

Section titled “200”

Audit events.

Media typeapplication/json
object
events
required
Array<object>
object
id
required
string
timestamp
required
string format: date-time
name
required
string
principal
required
object
type
required
string
id
required
string
emailSnapshot
string
authMethod
string
sessionId
string
request
required
object
id
required
string
traceId
string
sourceIp
string
userAgent
string
scope
object
organizationId
string
projectId
string
region
string
action
required
string
resource
object
arn
string
type
string
id
string
outcome
required
object
status
required
string
Allowed values: success failure denied
errorCode
string
errorDetail
string
parameters
changes
nextPageToken
string

Example 

{
  "events": [
    {
      "outcome": {
        "status": "success"
      }
    }
  ]
}