List Data Audit Events

GET

/v1/audit/events

GET

/v1/audit/events

curl -G https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events \
     -H "Authorization: Bearer <token>" \
     -d filterOps.accountID=filterOps.accountID

{
  "event": [
    {
      "context": {
        "changeID": "a13de9af-3331-4bee-b45c-95031d4c5b5d",
        "requestID": "5a682b12-1a44-922b-a487-ab108f018cc4",
        "traceID": "9f1707bd-3da0-4946-bf7a-ca99e7e12e5b",
        "actor": "web31628f5a74bf7994459921c67eef8",
        "actorType": "USER",
        "accessType": "API",
        "ipAddress": "27.116.16.50",
        "authMode": "PAT_JWT",
        "jwtID": "o82d1d5bcbf148eb890a937593321ff8",
        "origin": "https://area51-beta.skyflow.dev",
        "bearerTokenContextID": "bcf4b254-a415-4b3f-a8b9-0a1f02e52e18",
        "keyID": "y72c0826fb1146b3bb8a0d48ab4d0653",
        "sessionID": "cb598f8c-786e-48da-898d-830ec92417b7"
      },
      "response": {
        "code": 200,
        "message": "success",
        "timestamp": "2023-06-27 14:01:14.271659365"
      },
      "accountID": "f244fg04bgh876qemk6c3a32256e2k90",
      "parentAccountID": "b894gg34fbn866eabd6c2ce1457r4b45",
      "request": {
        "actionType": "READ",
        "apiName": "/v1.QueryService/ExecuteQuery",
        "data": {
          "content": "select * from persons where skyflow_id=\"5b6c8110-58b3-4aa0-8b36-d2cfd5c7b259\""
        },
        "httpInfo": {
          "URI": "/v1/vaults/cd1d815aa09b4cbfbb803bd20349f202/query",
          "method": "POST"
        },
        "resourceType": "RECORD",
        "tags": [
          "dml"
        ],
        "timestamp": "2023-06-27 14:01:14.264739714",
        "vaultID": "cd1d815aa09b4cbfbb803bd20349f202",
        "workspaceID": "e01054d5ff3411eab9f2360c405de1ab"
      },
      "resourceIDs": [
        "ACCOUNT/f244fg04bgh876qemk6c3a32256e2k90",
        "TABLE/persons",
        "VAULT/cd1d815aa09b4cbfbb803bd20349f202"
      ]
    }
  ],
  "nextOps": {
    "timestamp": "2023-06-27 14:01:14.264739714",
    "changeID": "a13de9af-3331-4bee-b45c-95031d4c5b5d"
  }
}

Lists data audit events that match query parameters.

Authentication

AuthorizationBearer

Access token, prefixed by Bearer .

Query parameters

filterOps.context.changeIDstringOptional

ID for the audit event. Use this to uniquely identify a specific audit record.

filterOps.context.requestIDstringOptional

ID for the request that caused the event. Use to correlate multiple audit events triggered by a single API request.

filterOps.context.sessionIDstringOptional

ID for the session in which the request was sent. Present when a session context is available.

filterOps.context.actorstringOptional

Member who sent the request. Depending on actorType, this may be a user ID or a service account ID. For users this is their email address.

filterOps.context.actorTypeenumOptional

Type of member who sent the request.

Allowed values:

filterOps.context.accessTypeenumOptional

Type of access for the request.

Allowed values:

filterOps.context.ipAddressstringOptional

IP Address of the client that made the request.

filterOps.context.originstringOptional

HTTP Origin request header (including scheme, hostname, and port) of the request. Present only for browser-originated requests. Absent for server-to-server API calls.

filterOps.context.authModeenumOptional

Authentication mode the actor used. OKTA_JWT: Federated identity via Okta SSO. SERVICE_ACCOUNT_JWT: Service account JWT (machine-to-machine). PAT_JWT: Personal Access Token issued as a JWT. API_KEY: Static API key.

filterOps.context.jwtIDstringOptional

ID of the JWT token (the jti claim). Identifies the specific token used for this request.

filterOps.context.bearerTokenContextIDstringOptional

User context embedded in the bearer token. Present when a bearer token encodes additional user context.

filterOps.context.clientTraceIDstringOptional

Correlation ID supplied by the caller, so you can find audit events by the request ID your own systems already use. Opaque to Skyflow: recorded as sent and never interpreted. Distinct from traceID, which is Skyflow’s own internal trace. Capped at 128 characters.

filterOps.parentAccountIDstringOptional

Resources with the specified parent account ID.

filterOps.accountIDstringRequired

filterOps.workspaceIDstringOptional

Resources with the specified workspace ID.

filterOps.vaultIDstringOptional

Resources with the specified vault ID.

filterOps.resourceIDsstringOptional

Resources with a specified ID. If a resource matches at least one ID, the associated event is returned. Format is a comma-separated list of “<resourceType>/<resourceID>”. For example, “VAULT/12345, USER/67890”.

filterOps.request.clientInfo.userEmailstringOptional

Email of the end user on whose behalf the caller made the request, from the ctx.email claim of the bearer token.

Response headers

X-Request-IDstringOptional

Unique identifier for the request.

Response

eventlist of objectsOptional

Events matching the query.

nextOpsobjectOptional

Errors

400

Bad Request Error

401

Unauthorized Error

404

Not Found Error

500

Internal Server Error