Audit

Search your Audit Logs events over HTTP.

POST https://api.ap1.datadoghq.com/api/v2/audit/events/searchhttps://api.datadoghq.eu/api/v2/audit/events/searchhttps://api.ddog-gov.com/api/v2/audit/events/searchhttps://api.datadoghq.com/api/v2/audit/events/searchhttps://api.us3.datadoghq.com/api/v2/audit/events/searchhttps://api.us5.datadoghq.com/api/v2/audit/events/search

Présentation

List endpoint returns Audit Logs events that match an Audit search query. Results are paginated.

Use this endpoint to build complex Audit Logs events filtering and search.

This endpoint requires the audit_logs_read permission.

Requête

Body Data

Expand All

Champ

Type

Description

filter

object

Search and filter query settings.

from

string

Minimum time for the requested events. Supports date, math, and regular timestamps (in milliseconds).

default: now-15m

query

string

Search query following the Audit Logs search syntax.

default: *

to

string

Maximum time for the requested events. Supports date, math, and regular timestamps (in milliseconds).

default: now

options

object

Global query options that are used during the query. Note: Specify either timezone or time offset, not both. Otherwise, the query fails.

time_offset

int64

Time offset (in seconds) to apply to the query.

timezone

string

The timezone can be specified as GMT, UTC, an offset from UTC (like UTC+1), or as a Timezone Database identifier (like America/New_York).

default: UTC

page

object

Paging attributes for listing events.

cursor

string

List following results with a cursor provided in the previous query.

limit

int32

Maximum number of events in the response.

default: 10

sort

enum

Sort parameters when querying events. Allowed enum values: timestamp,-timestamp

{
  "filter": {
    "from": "now-15m",
    "query": "@type:session AND @session.type:user",
    "to": "now"
  },
  "options": {
    "time_offset": 0,
    "timezone": "GMT"
  },
  "page": {
    "limit": 25
  },
  "sort": "timestamp"
}
{
  "filter": {
    "from": "now-15m",
    "to": "now"
  },
  "options": {
    "timezone": "GMT"
  },
  "page": {
    "limit": 2
  },
  "sort": "timestamp"
}

Réponse

OK

Response object with all events matching the request and pagination information.

Expand All

Champ

Type

Description

data

[object]

Array of events matching the request.

attributes

object

JSON object containing all event attributes and their associated values.

attributes

object

JSON object of attributes from Audit Logs events.

message

string

Message of the event.

service

string

Name of the application or service generating Audit Logs events. This name is used to correlate Audit Logs to APM, so make sure you specify the same value when you use both products.

tags

[string]

Array of tags associated with your event.

timestamp

date-time

Timestamp of your event.

id

string

Unique ID of the event.

type

enum

Type of the event. Allowed enum values: audit

default: audit

links

object

Links attributes.

next

string

Link for the next set of results. Note that the request can also be made using the POST endpoint.

meta

object

The metadata associated with a request.

elapsed

int64

Time elapsed in milliseconds.

page

object

Paging attributes.

after

string

The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of page[cursor].

request_id

string

The identifier of the request.

status

enum

The status of the response. Allowed enum values: done,timeout

warnings

[object]

A list of warnings (non-fatal errors) encountered. Partial results may return if warnings are present in the response.

code

string

Unique code for this type of warning.

detail

string

Detailed explanation of this specific warning.

title

string

Short human-readable summary of the warning.

{
  "data": [
    {
      "attributes": {
        "attributes": {
          "customAttribute": 123,
          "duration": 2345
        },
        "message": "string",
        "service": "web-app",
        "tags": [
          "team:A"
        ],
        "timestamp": "2019-01-02T09:42:36.320Z"
      },
      "id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA",
      "type": "audit"
    }
  ],
  "links": {
    "next": "https://app.datadoghq.com/api/v2/audit/event?filter[query]=foo\u0026page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ=="
  },
  "meta": {
    "elapsed": 132,
    "page": {
      "after": "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ=="
    },
    "request_id": "MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR",
    "status": "done",
    "warnings": [
      {
        "code": "unknown_index",
        "detail": "indexes: foo, bar",
        "title": "One or several indexes are missing or invalid, results hold data from the other indexes"
      }
    ]
  }
}

Bad Request

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Not Authorized

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Too many requests

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Exemple de code

                          # Curl command
curl -X POST "https://api.ap1.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/audit/events/search" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \ -d @- << EOF { "filter": { "from": "now-15m", "query": "@type:session AND @session.type:user", "to": "now" }, "options": { "time_offset": 0, "timezone": "GMT" }, "page": { "limit": 25 }, "sort": "timestamp" } EOF
                          # Curl command
curl -X POST "https://api.ap1.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/audit/events/search" \ -H "Accept: application/json" \ -H "Content-Type: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}" \ -d @- << EOF { "filter": { "from": "now-15m", "to": "now" }, "options": { "timezone": "GMT" }, "page": { "limit": 2 }, "sort": "timestamp" } EOF

GET https://api.ap1.datadoghq.com/api/v2/audit/eventshttps://api.datadoghq.eu/api/v2/audit/eventshttps://api.ddog-gov.com/api/v2/audit/eventshttps://api.datadoghq.com/api/v2/audit/eventshttps://api.us3.datadoghq.com/api/v2/audit/eventshttps://api.us5.datadoghq.com/api/v2/audit/events

Présentation

List endpoint returns events that match a Audit Logs search query. Results are paginated.

Use this endpoint to see your latest Audit Logs events.

This endpoint requires the audit_logs_read permission.

Arguments

Chaînes de requête

Nom

Type

Description

filter[query]

string

Search query following Audit Logs syntax.

filter[from]

string

Minimum timestamp for requested events.

filter[to]

string

Maximum timestamp for requested events.

sort

enum

Order of events in results.
Allowed enum values: timestamp, -timestamp

page[cursor]

string

List following results with a cursor provided in the previous query.

page[limit]

integer

Maximum number of events in the response.

Réponse

OK

Response object with all events matching the request and pagination information.

Expand All

Champ

Type

Description

data

[object]

Array of events matching the request.

attributes

object

JSON object containing all event attributes and their associated values.

attributes

object

JSON object of attributes from Audit Logs events.

message

string

Message of the event.

service

string

Name of the application or service generating Audit Logs events. This name is used to correlate Audit Logs to APM, so make sure you specify the same value when you use both products.

tags

[string]

Array of tags associated with your event.

timestamp

date-time

Timestamp of your event.

id

string

Unique ID of the event.

type

enum

Type of the event. Allowed enum values: audit

default: audit

links

object

Links attributes.

next

string

Link for the next set of results. Note that the request can also be made using the POST endpoint.

meta

object

The metadata associated with a request.

elapsed

int64

Time elapsed in milliseconds.

page

object

Paging attributes.

after

string

The cursor to use to get the next results, if any. To make the next request, use the same parameters with the addition of page[cursor].

request_id

string

The identifier of the request.

status

enum

The status of the response. Allowed enum values: done,timeout

warnings

[object]

A list of warnings (non-fatal errors) encountered. Partial results may return if warnings are present in the response.

code

string

Unique code for this type of warning.

detail

string

Detailed explanation of this specific warning.

title

string

Short human-readable summary of the warning.

{
  "data": [
    {
      "attributes": {
        "attributes": {
          "customAttribute": 123,
          "duration": 2345
        },
        "message": "string",
        "service": "web-app",
        "tags": [
          "team:A"
        ],
        "timestamp": "2019-01-02T09:42:36.320Z"
      },
      "id": "AAAAAWgN8Xwgr1vKDQAAAABBV2dOOFh3ZzZobm1mWXJFYTR0OA",
      "type": "audit"
    }
  ],
  "links": {
    "next": "https://app.datadoghq.com/api/v2/audit/event?filter[query]=foo\u0026page[cursor]=eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ=="
  },
  "meta": {
    "elapsed": 132,
    "page": {
      "after": "eyJzdGFydEF0IjoiQVFBQUFYS2tMS3pPbm40NGV3QUFBQUJCV0V0clRFdDZVbG8zY3pCRmNsbHJiVmxDWlEifQ=="
    },
    "request_id": "MWlFUjVaWGZTTTZPYzM0VXp1OXU2d3xLSVpEMjZKQ0VKUTI0dEYtM3RSOFVR",
    "status": "done",
    "warnings": [
      {
        "code": "unknown_index",
        "detail": "indexes: foo, bar",
        "title": "One or several indexes are missing or invalid, results hold data from the other indexes"
      }
    ]
  }
}

Bad Request

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Not Authorized

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Too many requests

API error response.

Expand All

Champ

Type

Description

errors [required]

[string]

A list of errors.

{
  "errors": [
    "Bad Request"
  ]
}

Exemple de code

                  # Curl command
curl -X GET "https://api.ap1.datadoghq.com"https://api.datadoghq.eu"https://api.ddog-gov.com"https://api.datadoghq.com"https://api.us3.datadoghq.com"https://api.us5.datadoghq.com/api/v2/audit/events" \ -H "Accept: application/json" \ -H "DD-API-KEY: ${DD_API_KEY}" \ -H "DD-APPLICATION-KEY: ${DD_APP_KEY}"

PREVIEWING: drodriguezhdez/add_public_docs_log_summarization
Your Privacy Choices