See the full history of a key, user, actor or grant
Read everything the audit trail holds about one object of your tenant: every operation that used a key, every administrative change a user made, and the history of an actor or a capability grant.
Who can do it
A tenant administrator or a tenant auditor, and a platform super administrator or platform auditor working in your tenant. Operations with a key need the permission to read the cryptographic trail; changes and a user's actions need the permission to read the administrative trail. A part you may not read is stated as not readable with your permissions, never shown as empty.
Before you start
- Each object's history is shown on that object's own detail, not only on the Audit Log.
- A key identifier names one key and is never reused in a tenant, so a key's history is the history of that key alone.
Steps
- For a key: open Key Inventory, select the key, and open Audit History. It lists every operation that used the key, with the key identity and the keys each operation used, and the administrative changes to the key.
- For a user: open Users, select the user, and open Activity. It lists the administrative actions that user performed.
- For a cryptographic actor or a capability grant: open Cryptographic Actors or Capability Grants, select it, and open Activity. It lists the operations that name it and the administrative changes made to it. Select Load more for older entries.
- To see the same history with every filter of the audit log, select View in Audit Log. The Audit Log opens already narrowed to that subject over the last 365 days.
- To follow one row across services, select Trace request on it.
What you see when it worked
Each history is listed newest first, with its usage and its administration side by side. The panel says when a part is complete, when older entries are held back until the other part is loaded, and when a read was capped.
If it fails
| What you see | Cause | What to do |
|---|---|---|
| "Usage activity is not readable with your current permissions." or "Administrative activity is not readable with your current permissions." | You may not read that trail | Ask for a role that adds it, such as the tenant auditor role |
| "Activity could not be loaded." | The read failed | Retry |
| "Failed to load activity log" on a user | The user's administrative actions could not be read | Retry |
Without the console
The console has no control for the history of one client (the client identifier an application presented); use the API for that.
| Surface | How |
|---|---|
| API, a key | GET /api/v3/audit/tenants/{tenantId}/crypto/keys/{keyId}/history (operation getKeyHistory), optional materialVersion, startTime, endTime |
| API, a key's use per material version | GET /api/v3/audit/tenants/{tenantId}/crypto/keys/{keyId}/material-usage (getKeyMaterialUsage), optional from and to; the window is capped at 365 days |
| API, a user's or actor's administrative actions | GET /api/v3/audit/tenants/{tenantId}/admin/actors/{actorId}/history (getActorHistory) |
| API, one entity's changes | GET /api/v3/audit/tenants/{tenantId}/admin/entities/{entityType}/{entityId}/history (getEntityHistory), with includeChildren=true to add the records of its child entities |
| API, one client (no console control) | GET /api/v3/audit/tenants/{tenantId}/crypto/clients/{clientId}/history (getClientHistory), optional startTime, endTime |
There is no CLI command and no admin SDK method for audit history.