Skip to content

See the cryptographic activity of an application, actor, grant, counterparty or exchange context

List the cryptographic operations performed by, or under, one object of your control plane: an application, a cryptographic actor, a capability grant, an exchange context or a counterparty.

Who can do it

A tenant administrator or a tenant auditor, and a platform super administrator or platform auditor working in your tenant. Each kind of object has its own audit read permission, and the permission to read every tenant trail covers them all.

Before you start

  • You need the object itself, or its identifier. The console reaches an object from its own screen.
  • Counterparties have no console control for this task; see "Without the console".

Steps

  1. Open Applications, Cryptographic Actors, Capability Grants or Exchange Contexts from your tenant's navigation.
  2. Select the object and open Activity. It lists the operations that name the object, beside the administrative changes made to it.
  3. Select Load more for older entries.
  4. To use every filter and export, select View in Audit Log. Or open Audit Log, set Subject to Application, Cryptographic actor, Exchange context or Capability grant, and type the identifier in Subject ID.

What you see when it worked

The operations and the administrative changes form one list, newest first. Each operation row shows when it ran, the operation, its outcome (ALLOW or DENY) and the key with its material version. Below that the row shows, when the record carries them:

  • the actor that ran the operation, on an application's or an exchange context's activity. On an actor's or a capability grant's own activity every row is that actor's, so no actor is named;
  • the counterparty and the direction;
  • the operation with a link to the capability grant that admitted it;
  • the source and target algorithms of an operation that changes algorithm, and the target key;
  • the constraints evaluated;
  • the key that was requested, when it differs from the key recorded.

Refused operations are listed too, with the outcome DENY.

Over the API, each page holds the stored cryptographic audit records, newest first. Each record carries, among other fields, eventTimestamp, operationType, status, errorCode, keyId, materialVersion, algorithm, actorId, applicationId, grantId, exchangeContextId and counterparty.

If it fails

What you see Cause What to do
"Usage activity is not readable with your current permissions." You may not read that object's cryptographic activity Ask for a role that adds it, such as the tenant auditor role
"Usage activity could not be loaded. The rows below are administrative activity only." The read of the operations failed Retry
403 from the API The path tenant is not your own Address your own tenant

Without the console

The console has no control for a counterparty's activity; use the API for that. Each call is paged with page (from 0) and size (50 by default).

Surface How
API, an application GET /api/v3/audit/tenants/{tenantId}/applications/{applicationId} (operation listApplicationCryptoEvents)
API, a cryptographic actor GET /api/v3/audit/tenants/{tenantId}/actors/{actorId} (listActorCryptoEvents)
API, a capability grant GET /api/v3/audit/tenants/{tenantId}/capability-grants/{grantId} (listCapabilityGrantCryptoEvents)
API, an exchange context GET /api/v3/audit/tenants/{tenantId}/exchange-contexts/{contextId} (listExchangeContextCryptoEvents)
API, a counterparty (no console control) GET /api/v3/audit/tenants/{tenantId}/counterparties/{counterparty} (listCounterpartyCryptoEvents)

There is no CLI command and no admin SDK method for these reads.