Describe an Event Log

curl --request GET \
  --url https://wksusa1b2c3d.provisionr.app/api/v1/audit/logs/{log} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://wksusa1b2c3d.provisionr.app/api/v1/audit/logs/{log}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://wksusa1b2c3d.provisionr.app/api/v1/audit/logs/{log}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "id": "wslog_01hq8xyzabc123def456ghi789",
  "tenant_id": "hqwks_01hq8xyzabc123def456ghi789",
  "tenant_model": "App\\Models\\FederationWorkspace",
  "created_at": "2024-01-15T10:30:00Z",
  "occurred_at": "2024-01-15T10:30:00Z",
  "level": "info",
  "event_type": "policy.user.create.success",
  "method": "\\App\\Actions\\V1\\PolicyUser\\CreatePolicyUser::handle:33",
  "message": "Policy User Qualified and Added to Manifest",
  "errors": {
    "key1": "Value 1",
    "message": "Invalid input"
  },
  "metadata": {
    "key1": "value1",
    "key2": "value2"
  },
  "actor_model": "App\\Models\\WorkspaceUser",
  "actor_type": "workspace_user",
  "actor_id": "wsusr_01hq8xyzabc123def456ghi789",
  "actor_name": "Dade Murphy",
  "actor_handle": "dmurphy",
  "actor_session_id": "A1b2c3D4e5f6G7h8I9J0k1l2m3n4o5p6q7r8s9t0",
  "actor_source": "web",
  "attribute_key": "name",
  "attribute_value_old": "IT Team",
  "attribute_value_new": "Security Team",
  "parent_type": "google_workspace_group",
  "parent_id": "gwgrp_01hq8xyzabc123def456ghi789",
  "record_type": "policy_user",
  "record_id": "pousr_01hq8xyzabc123def456ghi789",
  "record_provider_id": "a1b2c3d4-e5f6-a7b8-c9d0-e1f2g3h4i5j6",
  "related_id": "porul_01hq8xyzabc123def456ghi789",
  "related_type": "policy_rule",
  "subject_id": "drusr_01hq8xyzabc123def456ghi789",
  "subject_type": "directory_user",
  "count_records": 5,
  "job_batch": "xxxxx_01hq8xyzabc123def456ghi789",
  "job_id": "xxxxx_01hq8xyzabc123def456ghi789",
  "job_platform": "<string>",
  "job_pipeline_id": "123456789",
  "job_timestamp": "2024-01-15T10:30:00Z",
  "job_transaction_id": "xxxxx_01hq8xyzabc123def456ghi789"
}

{
  "message": "<string>"
}

{
  "message": "<string>"
}

{
  "message": "<string>"
}

GET

audit

logs

{log}

Describe an Event Log

curl --request GET \
  --url https://wksusa1b2c3d.provisionr.app/api/v1/audit/logs/{log} \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://wksusa1b2c3d.provisionr.app/api/v1/audit/logs/{log}"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.text)

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://wksusa1b2c3d.provisionr.app/api/v1/audit/logs/{log}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

{
  "id": "wslog_01hq8xyzabc123def456ghi789",
  "tenant_id": "hqwks_01hq8xyzabc123def456ghi789",
  "tenant_model": "App\\Models\\FederationWorkspace",
  "created_at": "2024-01-15T10:30:00Z",
  "occurred_at": "2024-01-15T10:30:00Z",
  "level": "info",
  "event_type": "policy.user.create.success",
  "method": "\\App\\Actions\\V1\\PolicyUser\\CreatePolicyUser::handle:33",
  "message": "Policy User Qualified and Added to Manifest",
  "errors": {
    "key1": "Value 1",
    "message": "Invalid input"
  },
  "metadata": {
    "key1": "value1",
    "key2": "value2"
  },
  "actor_model": "App\\Models\\WorkspaceUser",
  "actor_type": "workspace_user",
  "actor_id": "wsusr_01hq8xyzabc123def456ghi789",
  "actor_name": "Dade Murphy",
  "actor_handle": "dmurphy",
  "actor_session_id": "A1b2c3D4e5f6G7h8I9J0k1l2m3n4o5p6q7r8s9t0",
  "actor_source": "web",
  "attribute_key": "name",
  "attribute_value_old": "IT Team",
  "attribute_value_new": "Security Team",
  "parent_type": "google_workspace_group",
  "parent_id": "gwgrp_01hq8xyzabc123def456ghi789",
  "record_type": "policy_user",
  "record_id": "pousr_01hq8xyzabc123def456ghi789",
  "record_provider_id": "a1b2c3d4-e5f6-a7b8-c9d0-e1f2g3h4i5j6",
  "related_id": "porul_01hq8xyzabc123def456ghi789",
  "related_type": "policy_rule",
  "subject_id": "drusr_01hq8xyzabc123def456ghi789",
  "subject_type": "directory_user",
  "count_records": 5,
  "job_batch": "xxxxx_01hq8xyzabc123def456ghi789",
  "job_id": "xxxxx_01hq8xyzabc123def456ghi789",
  "job_platform": "<string>",
  "job_pipeline_id": "123456789",
  "job_timestamp": "2024-01-15T10:30:00Z",
  "job_transaction_id": "xxxxx_01hq8xyzabc123def456ghi789"
}

{
  "message": "<string>"
}

{
  "message": "<string>"
}

{
  "message": "<string>"
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

log

string

required

Audit Log ID

Response

AuditLogDetailedResponseData

string

required

Example:

"wslog_01hq8xyzabc123def456ghi789"

tenant_id

string | null

required

The ID of the workspace tenant this log is attributed to

Example:

"hqwks_01hq8xyzabc123def456ghi789"

tenant_model

string | null

required

The fully-qualified model class name of the tenant

Example:

"App\\Models\\FederationWorkspace"

created_at

string<date-time>

required

The timestamp when the audit log was created

Example:

"2024-01-15T10:30:00Z"

occurred_at

string<date-time> | null

required

The timestamp when the event occurred

Example:

"2024-01-15T10:30:00Z"

level

string | null

required

The industry standard log severity level

Example:

"info"

event_type

string | null

required

The type of event (e.g., namespace.resource.child_resource?.action.result?.context?)

Example:

"policy.user.create.success"

method

string | null

required

The method or action that triggered the log entry and line number

Example:

"\\App\\Actions\\V1\\PolicyUser\\CreatePolicyUser::handle:33"

message

string | null

required

The log message describing the action

Example:

"Policy User Qualified and Added to Manifest"

errors

string[] | null

required

Error messages associated with the action

Example:

{
  "key1": "Value 1",
  "message": "Invalid input"
}

metadata

string[] | null

required

Additional metadata associated with the log entry. This provides context that the ID and type may not cover

Example:

{ "key1": "value1", "key2": "value2" }

actor_model

string | null

required

The fully-qualified model class name of the actor who performed the action

Example:

"App\\Models\\WorkspaceUser"

actor_type

string | null

required

The snake_case type of actor (e.g., workspace_user, workspace_service, workspace_integration)

Example:

"workspace_user"

actor_id

string | null

required

The ID of the actor who performed the action

Example:

"wsusr_01hq8xyzabc123def456ghi789"

actor_name

string | null

required

The name of the actor who performed the action

Example:

"Dade Murphy"

actor_handle

string | null

required

The alphadash handle of the actor that performed the action

Example:

"dmurphy"

actor_session_id

string | null

required

The session ID of the actor

Example:

"A1b2c3D4e5f6G7h8I9J0k1l2m3n4o5p6q7r8s9t0"

actor_source

string | null

required

The source of the actor (system, cli, api, web)

Example:

"web"

attribute_key

string | null

required

The snake_case or camelCase key in the database table (or API response) that was modified. This provides a before and after snapshot for database column or array values that are changed

Example:

"name"

attribute_value_old

string | null

required

The old database or API response value of the attribute before modification. Null for created records

Example:

"IT Team"

attribute_value_new

string | null

required

The new value of the attribute after modification

Example:

"Security Team"

parent_type

string | null

required

The type of the parent resource

Example:

"google_workspace_group"

parent_id

string | null

required

The ID of the parent resource

Example:

"gwgrp_01hq8xyzabc123def456ghi789"

record_type

string | null

required

The type of the record being acted upon

Example:

"policy_user"

record_id

string | null

required

The ID of the record being acted upon

Example:

"pousr_01hq8xyzabc123def456ghi789"

record_provider_id

string | null

required

The Integration Provider API identifier of the record (if applicable)

Example:

"a1b2c3d4-e5f6-a7b8-c9d0-e1f2g3h4i5j6"

The ID of the related resource

Example:

"porul_01hq8xyzabc123def456ghi789"

The type of the related resource

Example:

"policy_rule"

subject_id

string | null

required

The ID of the subject related to the action

Example:

"drusr_01hq8xyzabc123def456ghi789"

subject_type

string | null

required

The type of the subject. The record type is the action that was performed. The subject is on behalf of who

Examples:

"directory_user"

"workspace_service"

"workspace_user"

count_records

integer | null

required

The count of records affected by this action (if applicable for bulk operations)

Example:

5

job_batch

string | null

required

The batch identifier for grouped job operations

Example:

"xxxxx_01hq8xyzabc123def456ghi789"

job_id

string | null

required

The job ID associated with this log entry

Example:

"xxxxx_01hq8xyzabc123def456ghi789"

job_platform

string | null

required

The platform where the job was executed

job_pipeline_id

string | null

required

The pipeline ID for CI/CD operations

Example:

"123456789"

job_timestamp

string<date-time> | null

required

The timestamp when the job was executed

Example:

"2024-01-15T10:30:00Z"

job_transaction_id

string | null

required

The transaction ID for the job

Example:

"xxxxx_01hq8xyzabc123def456ghi789"

Getting Started

Endpoints

Describe an Event Log

Authorizations

Path Parameters

Response