Skip to content
ReplicaDBReplicaDB

List audit events

GET
/api/v1/audit

Returns durable audit events matching optional actor, action, resource, and UTC time filters. ADMIN is required.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
actorUserId
string format: uuid

Actor user identifier. System actors do not have a user identifier.

action
string

Case-insensitive AuditAction enum name.

resourceType
string
Allowed values: USER DATASOURCE JOB_DEFINITION JOB_RUN SESSION

Case-insensitive resource category.

resourceId
string

Exact audited resource identifier.

from
string format: date-time

Inclusive lower event timestamp bound in UTC ISO-8601 date-time format.

to
string format: date-time

Exclusive upper event timestamp bound in UTC ISO-8601 date-time format.

page
string
default: 0

Zero-based page number.

size
string
default: 50 >= 1 <= 200

Requested page size, clamped to the range 1 through 200.

Responses

Section titled “Responses”

200

Section titled “200”

Audit events returned

Zero-based page of resource results.

object
content

Results in this page.

Array<object>

Durable audit record for an authenticated or system action.

object
action

Audited action category.

string
Allowed values: LOGIN_SUCCEEDED LOGIN_FAILED LOGOUT USER_CREATED USER_UPDATED USER_PASSWORD_CHANGED DATASOURCE_CREATED DATASOURCE_UPDATED DATASOURCE_DELETED DATASOURCE_PERMISSION_REPLACED DATASOURCE_PERMISSION_REVOKED KEYRING_REENCRYPTED JOB_CREATED JOB_UPDATED JOB_DELETED JOB_DATASOURCE_BINDING_REPLACED JOB_DATASOURCE_BINDING_ENABLED JOB_DATASOURCE_BINDING_DISABLED JOB_PERMISSION_REPLACED JOB_PERMISSION_REVOKED JOB_SCHEDULE_UPSERTED JOB_SCHEDULE_DELETED RUN_TRIGGERED RUN_CANCEL_REQUESTED RUN_RETRIED RUN_SUCCEEDED RUN_FAILED RUN_CANCELLED
actorUserId

Actor user identifier, or null for a system actor.

string format: uuid
nullable
actorUsername

Username snapshot or stable system actor name.

string
detail

Bounded, non-secret action context. Keys vary by action.

object
key
additional properties

Bounded, non-secret action context. Keys vary by action.

string
id

Audit event identifier.

string format: uuid
occurredAt

Event timestamp in UTC.

string format: date-time
outcome

Recorded action outcome.

string
Allowed values: SUCCESS FAILURE
resourceId

Resource identifier as recorded by the owning operation.

string
resourceType

Type of resource affected by the action.

string
Allowed values: USER DATASOURCE KEYRING JOB_DEFINITION JOB_RUN SESSION
sourceAddress

Recorded source address when available.

string
nullable
page

Zero-based page number.

integer format: int32
size

Effective page size, from 1 through 200.

integer format: int32
>= 1 <= 200
totalElements

Total matching resources across all pages.

integer format: int64

400

Section titled “400”

The request is malformed or fails validation.

RFC 7807 problem response. Dynamic detail text is credential-redacted.

object
detail
string
instance
string format: uri-reference
status
integer format: int32
title
string
type
string format: uri-reference

401

Section titled “401”

Authentication is required or credentials are invalid.

RFC 7807 problem response. Dynamic detail text is credential-redacted.

object
detail
string
instance
string format: uri-reference
status
integer format: int32
title
string
type
string format: uri-reference

403

Section titled “403”

The authenticated identity lacks the required permission.

RFC 7807 problem response. Dynamic detail text is credential-redacted.

object
detail
string
instance
string format: uri-reference
status
integer format: int32
title
string
type
string format: uri-reference