# Audit Log Commands

> See [Audit Log module docs](../../modules/audit-log) for permissions and data model.

# Audit Log Commands

See [Audit Log module docs](../../modules/audit-log) for permissions and data model.

### `soat list-audit-entries`

List audit entries

- Method: `GET`
- Path: `/api/v1/audit-log`

#### Usage

```bash
soat list-audit-entries
```

#### Options

##### `--project-id`

Project ID (scopes results; required if not using project key auth for a specific project)

- Source: `query`
- Required: no
- Type: `string`
- Example: `proj_V1StGXR8Z5jdHi6B`

##### `--action`

Exact permission-action string, e.g. `secrets:DeleteSecret`

- Source: `query`
- Required: no
- Type: `string`
- Example: `secrets:DeleteSecret`

##### `--principal-id`

Public id of the principal (`user_…` or `key_…`)

- Source: `query`
- Required: no
- Type: `string`

##### `--resource-public-id`

Exact target resource public id, e.g. `sec_…`

- Source: `query`
- Required: no
- Type: `string`

##### `--resource-srn`

SRN prefix match, e.g. `srn:\{project\}:secret:`. The log is append-only, so a stored SRN is never rewritten; the filter matches it as stored.

- Source: `query`
- Required: no
- Type: `string`

##### `--from`

Only entries created at or after this timestamp (ISO 8601)

- Source: `query`
- Required: no
- Type: `string`

##### `--to`

Only entries created at or before this timestamp (ISO 8601)

- Source: `query`
- Required: no
- Type: `string`

##### `--limit`

Number of results per page (1–200, default 25)

- Source: `query`
- Required: no
- Type: `integer`
- Default: `25`

##### `--offset`

Number of results to skip

- Source: `query`
- Required: no
- Type: `integer`
- Default: `0`

### `soat export-audit-entries`

Export audit entries as NDJSON

- Method: `GET`
- Path: `/api/v1/audit-log/export`

#### Usage

```bash
soat export-audit-entries --project-id <string>
```

#### Options

##### `--project-id`

Project whose entries are exported

- Source: `query`
- Required: yes
- Type: `string`
- Example: `proj_V1StGXR8Z5jdHi6B`

##### `--action`

Exact permission-action string, e.g. `secrets:DeleteSecret`

- Source: `query`
- Required: no
- Type: `string`

##### `--principal-id`

Public id of the principal (`user_…` or `key_…`)

- Source: `query`
- Required: no
- Type: `string`

##### `--resource-public-id`

Exact target resource public id, e.g. `sec_…`

- Source: `query`
- Required: no
- Type: `string`

##### `--resource-srn`

SRN prefix match, e.g. `srn:\{project\}:secret:`. The log is append-only, so a stored SRN is never rewritten; the filter matches it as stored.

- Source: `query`
- Required: no
- Type: `string`

##### `--from`

Only entries created at or after this timestamp (ISO 8601)

- Source: `query`
- Required: no
- Type: `string`

##### `--to`

Only entries created at or before this timestamp (ISO 8601)

- Source: `query`
- Required: no
- Type: `string`

### `soat get-audit-entry`

Get an audit entry

- Method: `GET`
- Path: `/api/v1/audit-log/{entry_id}`

#### Usage

```bash
soat get-audit-entry --entry-id <string>
```

#### Options

##### `--entry-id`

Audit entry ID

- Source: `path`
- Required: yes
- Type: `string`
- Example: `audit_V1StGXR8Z5jdHi6B`