# List Data Audit Events

```http
GET https://%7B%7Bvault_uri%7D%7D.vault.skyflowapis.com/v1/audit/events
```

Lists data audit events that match query parameters.

## Authentication

- `Authorization` header (bearer token, required) — Access token, prefixed by `Bearer `.

## Servers

- `https://%7B%7Bvault_uri%7D%7D.vault.skyflowapis.com` (Production, default)
- `https://%7B%7Bvault_uri%7D%7D.vault.skyflowapis-preview.com` (Sandbox)

## Request

### Query parameters

- `filterOps.context.changeID` (string, optional) — ID for the audit event. Use this to uniquely identify a specific audit record.
- `filterOps.context.requestID` (string, optional) — ID for the request that caused the event. Use to correlate multiple audit events triggered by a single API request.
- `filterOps.context.sessionID` (string, optional) — ID for the session in which the request was sent. Present when a session context is available.
- `filterOps.context.actor` (string, optional) — Member who sent the request. Depending on `actorType`, this may be a user ID or a service account ID. For users this is their email address.
- `filterOps.context.actorType` (enum, optional) — Type of member who sent the request.
  - Allowed values: `NONE`, `USER`, `GROUP`, `SERVICE_ACCOUNT`, `SQL_SERVICE_ACCOUNT`
- `filterOps.context.accessType` (enum, optional) — Type of access for the request.
  - Allowed values: `ACCESS_NONE`, `API`, `SQL`, `OKTA_LOGIN`
- `filterOps.context.ipAddress` (string, optional) — IP Address of the client that made the request.
- `filterOps.context.origin` (string, optional) — HTTP Origin request header (including scheme, hostname, and port) of the request. Present only for browser-originated requests. Absent for server-to-server API calls.
- `filterOps.context.authMode` (enum, optional) — Authentication mode the `actor` used. `OKTA_JWT`: Federated identity via Okta SSO. `SERVICE_ACCOUNT_JWT`: Service account JWT (machine-to-machine). `PAT_JWT`: Personal Access Token issued as a JWT. `API_KEY`: Static API key.
  - Allowed values: `AUTH_NONE`, `OKTA_JWT`, `SERVICE_ACCOUNT_JWT`, `PAT_JWT`, `API_KEY`, `STS`
- `filterOps.context.jwtID` (string, optional) — ID of the JWT token (the `jti` claim). Identifies the specific token used for this request.
- `filterOps.context.bearerTokenContextID` (string, optional) — User context embedded in the bearer token. Present when a bearer token encodes additional user context.
- `filterOps.parentAccountID` (string, optional) — Resources with the specified parent account ID.
- `filterOps.accountID` (string, required)
- `filterOps.workspaceID` (string, optional) — Resources with the specified workspace ID.
- `filterOps.vaultID` (string, optional) — Resources with the specified vault ID.
- `filterOps.resourceIDs` (string, optional) — Resources with a specified ID. If a resource matches at least one ID, the associated event is returned. Format is a comma-separated list of "/". For example, "VAULT/12345, USER/67890".
- `filterOps.request.clientInfo.userEmail` (string, optional) — Email of the end user on whose behalf the caller made the request, from the `ctx.email` claim of the bearer token.

## Response

### 200

OK

- `event` (list of object, optional) — Events matching the query.
  - `context` (object, optional) — Context for an audit event.
    - `changeID` (string, required) — ID for the audit event. Use this to uniquely identify a specific audit record.
    - `requestID` (string, required) — ID for the request that caused the event. Use to correlate multiple audit events triggered by a single API request.
    - `traceID` (string, required) — ID for the request set by the service that received the request. Use with your distributed tracing tool to follow a request across Skyflow services.
    - `actor` (string, required) — Member who sent the request. Depending on `actorType`, this may be a user ID or a service account ID. For users this is their email address.
    - `actorType` (enum, required) — Type of member who sent the request.
      - Allowed values: `USER`, `SERVICE_ACCOUNT`
    - `accessType` (enum, required) — Type of access for the request.
      - Allowed values: `API`, `SQL`
    - `ipAddress` (string, required) — IP Address of the client that made the request.
    - `authMode` (enum, required) — Authentication mode the `actor` used. `OKTA_JWT`: Federated identity via Okta SSO. `SERVICE_ACCOUNT_JWT`: Service account JWT (machine-to-machine). `PAT_JWT`: Personal Access Token issued as a JWT. `API_KEY`: Static API key.
      - Allowed values: `OKTA_JWT`, `SERVICE_ACCOUNT_JWT`, `PAT_JWT`, `API_KEY`, `STS`
    - `jwtID` (string, required) — ID of the JWT token (the `jti` claim). Identifies the specific token used for this request.
    - `origin` (string, optional) — HTTP Origin request header (including scheme, hostname, and port) of the request. Present only for browser-originated requests. Absent for server-to-server API calls.
    - `bearerTokenContextID` (string, optional) — User context embedded in the bearer token. Present when a bearer token encodes additional user context.
    - `keyID` (string, optional) — Key ID of the API key used to make the request. Present when `authMode` is `SERVICE_ACCOUNT_JWT` or `API_KEY`. Absent for `PAT_JWT` and `OKTA_JWT`.
    - `subject` (string, optional) — This represents the user on whose behalf the request is made. It may differ from the actor (act) when delegation is involved.
    - `sessionID` (string, optional, deprecated) — ID for the session in which the request was sent. Present when a session context is available.
  - `response` (object, optional) — Response properties of the event.
    - `code` (integer, required) — Status code for the overall operation. For batch operations, a 200 doesn't mean every item succeeded. Check `nestedResponse` for per-operation outcomes.
    - `message` (string, required) — Status message for the overall operation.
    - `timestamp` (string, required) — Time when the response was created. RFC 3339 format with nanosecond precision.
    - `data` (object, optional) — Data (if any) for the response.
      - `content` (string, optional) — The entire body of the request or response.
    - `nestedResponse` (list of object, optional) — Details for nested operations, if any. An array of per-item results returned for batch operations. Absent for non-batch operations.
      - `code` (integer, required) — Status code for the operation.
      - `message` (string, required) — Status message for the operation. Describes the failure reason for errored items. Empty string on success.
      - `identifier` (string, required) — ID for the resource that was modified, in `{resourceType}/{resourceID}` format. For example, `VAULT/cd1d815aa09b4cbfbb803bd20349f202`. May be empty if the item identifier couldn't be resolved.
      - `data` (object, optional) — Data (if any) for the response.
        - `content` (string, optional) — The entire body of the request or response.
- `nextOps` (object, optional)
  - `timestamp` (string, optional) — Timestamp provided in the previous audit response's `nextOps` attribute. An alternate way to manage response pagination. Can't be used with `sortOps` or `offset`. For the first request in a series of audit requests, leave blank.
  - `changeID` (string, optional) — Change ID provided in the previous audit response's `nextOps` attribute. An alternate way to manage response pagination. Can't be used with `sortOps` or `offset`. For the first request in a series of audit requests, leave blank.

## Errors

### 400 Bad Request Error

Returned when the request is invalid or cannot be served.

- `error` (object, required)
  - `grpc_code` (integer, required) — gRPC status codes. See [https://grpc.io/docs/guides/status-codes](https://grpc.io/docs/guides/status-codes).
  - `http_code` (integer, required) — HTTP status codes. See [https://developer.mozilla.org/en-US/docs/Web/HTTP/Status](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status).
  - `http_status` (string, required)
  - `message` (string, required)
  - `details` (list of map from string to any, optional)

### 401 Unauthorized Error

Returned when the request is unauthorized.

- `error` (object, required)
  - `grpc_code` (integer, required) — gRPC status codes. See [https://grpc.io/docs/guides/status-codes](https://grpc.io/docs/guides/status-codes).
  - `http_code` (integer, required) — HTTP status codes. See [https://developer.mozilla.org/en-US/docs/Web/HTTP/Status](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status).
  - `http_status` (string, required)
  - `message` (string, required)
  - `details` (list of map from string to any, optional)

### 404 Not Found Error

Returned when a resource doesn't exist.

- `error` (object, required)
  - `grpc_code` (integer, required) — gRPC status codes. See [https://grpc.io/docs/guides/status-codes](https://grpc.io/docs/guides/status-codes).
  - `http_code` (integer, required) — HTTP status codes. See [https://developer.mozilla.org/en-US/docs/Web/HTTP/Status](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status).
  - `http_status` (string, required)
  - `message` (string, required)
  - `details` (list of map from string to any, optional)

### 500 Internal Server Error

An unexpected error response.

- `error` (object, required)
  - `grpc_code` (integer, required) — gRPC status codes. See [https://grpc.io/docs/guides/status-codes](https://grpc.io/docs/guides/status-codes).
  - `http_code` (integer, required) — HTTP status codes. See [https://developer.mozilla.org/en-US/docs/Web/HTTP/Status](https://developer.mozilla.org/en-US/docs/Web/HTTP/Status).
  - `http_status` (string, required)
  - `message` (string, required)
  - `details` (list of map from string to any, optional)

## Examples

**Response**

```json
{
  "event": [
    {
      "context": {
        "changeID": "a13de9af-3331-4bee-b45c-95031d4c5b5d",
        "requestID": "5a682b12-1a44-922b-a487-ab108f018cc4",
        "traceID": "9f1707bd-3da0-4946-bf7a-ca99e7e12e5b",
        "actor": "web31628f5a74bf7994459921c67eef8",
        "actorType": "USER",
        "accessType": "API",
        "ipAddress": "27.116.16.50",
        "authMode": "PAT_JWT",
        "jwtID": "o82d1d5bcbf148eb890a937593321ff8",
        "origin": "https://area51-beta.skyflow.dev",
        "bearerTokenContextID": "bcf4b254-a415-4b3f-a8b9-0a1f02e52e18",
        "keyID": "y72c0826fb1146b3bb8a0d48ab4d0653",
        "sessionID": "cb598f8c-786e-48da-898d-830ec92417b7"
      },
      "response": {
        "code": 200,
        "message": "success",
        "timestamp": "2023-06-27 14:01:14.271659365"
      },
      "accountID": "f244fg04bgh876qemk6c3a32256e2k90",
      "parentAccountID": "b894gg34fbn866eabd6c2ce1457r4b45",
      "request": {
        "actionType": "READ",
        "apiName": "/v1.QueryService/ExecuteQuery",
        "data": {
          "content": "select * from persons where skyflow_id=\"5b6c8110-58b3-4aa0-8b36-d2cfd5c7b259\""
        },
        "httpInfo": {
          "URI": "/v1/vaults/cd1d815aa09b4cbfbb803bd20349f202/query",
          "method": "POST"
        },
        "resourceType": "RECORD",
        "tags": [
          "dml"
        ],
        "timestamp": "2023-06-27 14:01:14.264739714",
        "vaultID": "cd1d815aa09b4cbfbb803bd20349f202",
        "workspaceID": "e01054d5ff3411eab9f2360c405de1ab"
      },
      "resourceIDs": [
        "ACCOUNT/f244fg04bgh876qemk6c3a32256e2k90",
        "TABLE/persons",
        "VAULT/cd1d815aa09b4cbfbb803bd20349f202"
      ]
    }
  ],
  "nextOps": {
    "timestamp": "2023-06-27 14:01:14.264739714",
    "changeID": "a13de9af-3331-4bee-b45c-95031d4c5b5d"
  }
}
```

**SDK Code**

```python
import requests

url = "https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events"

querystring = {"filterOps.accountID":"filterOps.accountID"}

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers, params=querystring)

print(response.json())
```

```javascript
const url = 'https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby
require 'uri'
require 'net/http'

url = URI("https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

```java
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```php
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp
using RestSharp;

var client = new RestClient("https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);
```

```swift
import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```