Skip to main content

Audit Log Commands

See Audit Log module docs for permissions and data model.

soat list-audit-entries​

List audit entries

  • Method: GET
  • Path: /api/v1/audit-log

Usage​

soat list-audit-entries

Options​

--project-id​

Project ID (scopes results; required if not using project key auth for a specific project)

  • Source: query
  • Required: no
  • Type: string
  • Example: proj_V1StGXR8Z5jdHi6B
--action​

Exact permission-action string, e.g. secrets:DeleteSecret

  • Source: query
  • Required: no
  • Type: string
  • Example: secrets:DeleteSecret
--principal-id​

Public id of the principal (user_… or key_…)

  • Source: query
  • Required: no
  • Type: string
--resource-public-id​

Exact target resource public id, e.g. sec_…

  • Source: query
  • Required: no
  • Type: string
--resource-srn​

SRN prefix match, e.g. srn:\{project\}:secret:. The log is append-only, so a stored SRN is never rewritten; the filter matches it as stored.

  • Source: query
  • Required: no
  • Type: string
--from​

Only entries created at or after this timestamp (ISO 8601)

  • Source: query
  • Required: no
  • Type: string
--to​

Only entries created at or before this timestamp (ISO 8601)

  • Source: query
  • Required: no
  • Type: string
--limit​

Results per page. Above 200 it is clamped, and limit in the response reports the page served; below 1 or not an integer it is 400 VALIDATION_FAILED.

  • Source: query
  • Required: no
  • Type: integer
  • Default: 25

soat export-audit-entries​

Export audit entries as NDJSON

  • Method: GET
  • Path: /api/v1/audit-log/export

Usage​

soat export-audit-entries --project-id <string>

Options​

--project-id​

Project whose entries are exported

  • Source: query
  • Required: yes
  • Type: string
  • Example: proj_V1StGXR8Z5jdHi6B
--action​

Exact permission-action string, e.g. secrets:DeleteSecret

  • Source: query
  • Required: no
  • Type: string
--principal-id​

Public id of the principal (user_… or key_…)

  • Source: query
  • Required: no
  • Type: string
--resource-public-id​

Exact target resource public id, e.g. sec_…

  • Source: query
  • Required: no
  • Type: string
--resource-srn​

SRN prefix match, e.g. srn:\{project\}:secret:. The log is append-only, so a stored SRN is never rewritten; the filter matches it as stored.

  • Source: query
  • Required: no
  • Type: string
--from​

Only entries created at or after this timestamp (ISO 8601)

  • Source: query
  • Required: no
  • Type: string
--to​

Only entries created at or before this timestamp (ISO 8601)

  • Source: query
  • Required: no
  • Type: string

soat get-audit-entry​

Get an audit entry

  • Method: GET
  • Path: /api/v1/audit-log/{entry_id}

Usage​

soat get-audit-entry --entry-id <string>

Options​

--entry-id​

Audit entry ID

  • Source: path
  • Required: yes
  • Type: string
  • Example: audit_V1StGXR8Z5jdHi6B