List Data Audit Events

GET https://%7B%7Bvault_uri%7D%7D.vault.skyflowapis.com/v1/audit/events

Lists data audit events that match query parameters.

Authentication

Authorization header (bearer token, required) — Access token, prefixed by Bearer .

Servers

https://%7B%7Bvault_uri%7D%7D.vault.skyflowapis.com (Production, default)
https://%7B%7Bvault_uri%7D%7D.vault.skyflowapis-preview.com (Sandbox)

Request

Query parameters

filterOps.context.changeID (string, optional) — ID for the audit event. Use this to uniquely identify a specific audit record.
filterOps.context.requestID (string, optional) — ID for the request that caused the event. Use to correlate multiple audit events triggered by a single API request.
filterOps.context.sessionID (string, optional) — ID for the session in which the request was sent. Present when a session context is available.
filterOps.context.actor (string, optional) — Member who sent the request. Depending on actorType, this may be a user ID or a service account ID. For users this is their email address.
filterOps.context.actorType (enum, optional) — Type of member who sent the request.
- Allowed values: NONE, USER, GROUP, SERVICE_ACCOUNT, SQL_SERVICE_ACCOUNT
filterOps.context.accessType (enum, optional) — Type of access for the request.
- Allowed values: ACCESS_NONE, API, SQL, OKTA_LOGIN
filterOps.context.ipAddress (string, optional) — IP Address of the client that made the request.
filterOps.context.origin (string, optional) — HTTP Origin request header (including scheme, hostname, and port) of the request. Present only for browser-originated requests. Absent for server-to-server API calls.
filterOps.context.authMode (enum, optional) — Authentication mode the actor used. OKTA_JWT: Federated identity via Okta SSO. SERVICE_ACCOUNT_JWT: Service account JWT (machine-to-machine). PAT_JWT: Personal Access Token issued as a JWT. API_KEY: Static API key.
- Allowed values: AUTH_NONE, OKTA_JWT, SERVICE_ACCOUNT_JWT, PAT_JWT, API_KEY, STS
filterOps.context.jwtID (string, optional) — ID of the JWT token (the jti claim). Identifies the specific token used for this request.
filterOps.context.bearerTokenContextID (string, optional) — User context embedded in the bearer token. Present when a bearer token encodes additional user context.
filterOps.parentAccountID (string, optional) — Resources with the specified parent account ID.
filterOps.accountID (string, required)
filterOps.workspaceID (string, optional) — Resources with the specified workspace ID.
filterOps.vaultID (string, optional) — Resources with the specified vault ID.
filterOps.resourceIDs (string, optional) — Resources with a specified ID. If a resource matches at least one ID, the associated event is returned. Format is a comma-separated list of “/”. For example, “VAULT/12345, USER/67890”.
filterOps.request.clientInfo.userEmail (string, optional) — Email of the end user on whose behalf the caller made the request, from the ctx.email claim of the bearer token.

Response

200

event (list of object, optional) — Events matching the query.
- context (object, optional) — Context for an audit event.
  - changeID (string, required) — ID for the audit event. Use this to uniquely identify a specific audit record.
  - requestID (string, required) — ID for the request that caused the event. Use to correlate multiple audit events triggered by a single API request.
  - traceID (string, required) — ID for the request set by the service that received the request. Use with your distributed tracing tool to follow a request across Skyflow services.
  - actor (string, required) — Member who sent the request. Depending on actorType, this may be a user ID or a service account ID. For users this is their email address.
  - actorType (enum, required) — Type of member who sent the request.
    - Allowed values: USER, SERVICE_ACCOUNT
  - accessType (enum, required) — Type of access for the request.
    - Allowed values: API, SQL
  - ipAddress (string, required) — IP Address of the client that made the request.
  - authMode (enum, required) — Authentication mode the actor used. OKTA_JWT: Federated identity via Okta SSO. SERVICE_ACCOUNT_JWT: Service account JWT (machine-to-machine). PAT_JWT: Personal Access Token issued as a JWT. API_KEY: Static API key.
    - Allowed values: OKTA_JWT, SERVICE_ACCOUNT_JWT, PAT_JWT, API_KEY, STS
  - jwtID (string, required) — ID of the JWT token (the jti claim). Identifies the specific token used for this request.
  - origin (string, optional) — HTTP Origin request header (including scheme, hostname, and port) of the request. Present only for browser-originated requests. Absent for server-to-server API calls.
  - bearerTokenContextID (string, optional) — User context embedded in the bearer token. Present when a bearer token encodes additional user context.
  - keyID (string, optional) — Key ID of the API key used to make the request. Present when authMode is SERVICE_ACCOUNT_JWT or API_KEY. Absent for PAT_JWT and OKTA_JWT.
  - subject (string, optional) — This represents the user on whose behalf the request is made. It may differ from the actor (act) when delegation is involved.
  - sessionID (string, optional, deprecated) — ID for the session in which the request was sent. Present when a session context is available.
- response (object, optional) — Response properties of the event.
  - code (integer, required) — Status code for the overall operation. For batch operations, a 200 doesn’t mean every item succeeded. Check nestedResponse for per-operation outcomes.
  - message (string, required) — Status message for the overall operation.
  - timestamp (string, required) — Time when the response was created. RFC 3339 format with nanosecond precision.
  - data (object, optional) — Data (if any) for the response.
    - content (string, optional) — The entire body of the request or response.
  - nestedResponse (list of object, optional) — Details for nested operations, if any. An array of per-item results returned for batch operations. Absent for non-batch operations.
    - code (integer, required) — Status code for the operation.
    - message (string, required) — Status message for the operation. Describes the failure reason for errored items. Empty string on success.
    - identifier (string, required) — ID for the resource that was modified, in {resourceType}/{resourceID} format. For example, VAULT/cd1d815aa09b4cbfbb803bd20349f202. May be empty if the item identifier couldn’t be resolved.
    - data (object, optional) — Data (if any) for the response.
      - content (string, optional) — The entire body of the request or response.
nextOps (object, optional)
- timestamp (string, optional) — Timestamp provided in the previous audit response’s nextOps attribute. An alternate way to manage response pagination. Can’t be used with sortOps or offset. For the first request in a series of audit requests, leave blank.
- changeID (string, optional) — Change ID provided in the previous audit response’s nextOps attribute. An alternate way to manage response pagination. Can’t be used with sortOps or offset. For the first request in a series of audit requests, leave blank.

Errors

400 Bad Request Error

Returned when the request is invalid or cannot be served.

error (object, required)
- grpc_code (integer, required) — gRPC status codes. See https://grpc.io/docs/guides/status-codes.
- http_code (integer, required) — HTTP status codes. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Status.
- http_status (string, required)
- message (string, required)
- details (list of map from string to any, optional)

401 Unauthorized Error

Returned when the request is unauthorized.

error (object, required)
- grpc_code (integer, required) — gRPC status codes. See https://grpc.io/docs/guides/status-codes.
- http_code (integer, required) — HTTP status codes. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Status.
- http_status (string, required)
- message (string, required)
- details (list of map from string to any, optional)

404 Not Found Error

Returned when a resource doesn’t exist.

error (object, required)
- grpc_code (integer, required) — gRPC status codes. See https://grpc.io/docs/guides/status-codes.
- http_code (integer, required) — HTTP status codes. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Status.
- http_status (string, required)
- message (string, required)
- details (list of map from string to any, optional)

500 Internal Server Error

An unexpected error response.

error (object, required)
- grpc_code (integer, required) — gRPC status codes. See https://grpc.io/docs/guides/status-codes.
- http_code (integer, required) — HTTP status codes. See https://developer.mozilla.org/en-US/docs/Web/HTTP/Status.
- http_status (string, required)
- message (string, required)
- details (list of map from string to any, optional)

Examples

Response

{
  "event": [
    {
      "context": {
        "changeID": "a13de9af-3331-4bee-b45c-95031d4c5b5d",
        "requestID": "5a682b12-1a44-922b-a487-ab108f018cc4",
        "traceID": "9f1707bd-3da0-4946-bf7a-ca99e7e12e5b",
        "actor": "web31628f5a74bf7994459921c67eef8",
        "actorType": "USER",
        "accessType": "API",
        "ipAddress": "27.116.16.50",
        "authMode": "PAT_JWT",
        "jwtID": "o82d1d5bcbf148eb890a937593321ff8",
        "origin": "https://area51-beta.skyflow.dev",
        "bearerTokenContextID": "bcf4b254-a415-4b3f-a8b9-0a1f02e52e18",
        "keyID": "y72c0826fb1146b3bb8a0d48ab4d0653",
        "sessionID": "cb598f8c-786e-48da-898d-830ec92417b7"
      },
      "response": {
        "code": 200,
        "message": "success",
        "timestamp": "2023-06-27 14:01:14.271659365"
      },
      "accountID": "f244fg04bgh876qemk6c3a32256e2k90",
      "parentAccountID": "b894gg34fbn866eabd6c2ce1457r4b45",
      "request": {
        "actionType": "READ",
        "apiName": "/v1.QueryService/ExecuteQuery",
        "data": {
          "content": "select * from persons where skyflow_id=\"5b6c8110-58b3-4aa0-8b36-d2cfd5c7b259\""
        },
        "httpInfo": {
          "URI": "/v1/vaults/cd1d815aa09b4cbfbb803bd20349f202/query",
          "method": "POST"
        },
        "resourceType": "RECORD",
        "tags": [
          "dml"
        ],
        "timestamp": "2023-06-27 14:01:14.264739714",
        "vaultID": "cd1d815aa09b4cbfbb803bd20349f202",
        "workspaceID": "e01054d5ff3411eab9f2360c405de1ab"
      },
      "resourceIDs": [
        "ACCOUNT/f244fg04bgh876qemk6c3a32256e2k90",
        "TABLE/persons",
        "VAULT/cd1d815aa09b4cbfbb803bd20349f202"
      ]
    }
  ],
  "nextOps": {
    "timestamp": "2023-06-27 14:01:14.264739714",
    "changeID": "a13de9af-3331-4bee-b45c-95031d4c5b5d"
  }
}

SDK Code

import requests

url = "https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events"

querystring = {"filterOps.accountID":"filterOps.accountID"}

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers, params=querystring)

print(response.json())

const url = 'https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

package main

import (
  "fmt"
  "net/http"
  "io"
)

func main() {

  url := "https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID"

  req, _ := http.NewRequest("GET", url, nil)

  req.Header.Add("Authorization", "Bearer <token>")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID")
  .header("Authorization", "Bearer <token>")
  .asString();

<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();

using RestSharp;

var client = new RestClient("https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);

import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://{{vault_uri}}.vault.skyflowapis.com/v1/audit/events?filterOps.accountID=filterOps.accountID")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()