Skip to content

Search the audit log

Find out who did what in your tenant, to which key or object, when, and with what outcome: cryptographic operations with your keys, administrative changes to your tenant, and access events such as sign-ins. Operations that failed or were refused are recorded too, with their outcome.

Who can do it

A tenant administrator or a tenant auditor, and a platform super administrator or platform auditor working in your tenant. The console shows Audit Log to a person who holds the permission to read at least one audit trail, or the permission to trace a request. Cryptographic operations, administrative changes and access events are separate permissions; each tab on the screen is a trail you may read. The built-in key manager role carries no audit permission.

Before you start

  • Nothing on this screen changes or removes an event; it only reads them.
  • Know what you are looking for: a key identifier, a user, an event, or one object of your tenant.

Steps

  1. Open Audit Log from your tenant's navigation.
  2. Choose a tab: All shows every trail you may read together; Crypto, Admin and Access show one each.
  3. Narrow the list:
    • Type in the search box to search by key ID, user or event.
    • Select Date range and choose Today, Last 7 days or Last 30 days, or pick days on the calendar. The days are UTC days. A range can span at most 365 days.
    • Choose an outcome. On Crypto you can also choose an operation; on Admin, an action and an entity type.
  4. To narrow to one object, set Subject to Application, Cryptographic actor, Exchange context, Capability grant or Entity ID, and type its identifier in Subject ID. An entity ID also needs an entity type. Clear subject removes it.
  5. Select an event to open its details.
  6. Select Load older to fetch the next page.

What you see when it worked

The list shows the matching events, newest first, 10 to a page. With no date range set, the audit service answers over the last 30 days. The figures above it summarize the trails over the date range you set. An event's details show when it happened, the actor and user behind it, its outcome, and depending on the trail the key, algorithm and material version, what an administrative change changed, or the principal and address of an access event. A decrypt of a token that carried no writer commitment adds Key confirmation: "Unconfirmed: the token carried no writer commitment, so it opens only under a key the request names." The correlation identifier in the details is shared by every event one request produced.

Every filter is kept in the page address, so reloading the page or sharing its address shows the same list to another reader who holds the same audit permissions.

If it fails

What you see Cause What to do
"You are not entitled to read this trail." You do not hold the permission for that trail Ask for a role that adds it, such as the tenant auditor role
"These events could not be read, so this list says nothing about what happened." The read failed Select Try again
"{subject} must be a UUID, such as 3f2b8c1e-5d4a-4e7b-9c1d-2a6f8e0b7c3d." An application, actor, exchange context or grant identifier that is not a UUID Correct the identifier; nothing is read until it is valid
"Choose an entity type to filter by entity ID." An entity ID without an entity type Choose the entity type
"This environment's audit service cannot filter by subject ({subject}). No rows are shown, because an unfiltered list would read as that subject's history." The audit service of this environment does not support the subject filter Search by identifier instead, or ask your administrator
"These events could not be read, so this list says nothing about what happened." after you picked a range of more than 365 days The audit service refuses a range wider than 365 days Pick a range of 365 days or less; see Invalid Input

Without the console

The console reads every tab through the mixed stream. It has no control for the per-trail lists (getCryptoEvents, getOperationsByType, getAdminEvents, getAdminTimeline, getTenantAuthEvents), the time series, the access-trail statistics, a single access event, the history of one client, or the per-tenant reads of the audit access trail. Use the API for those.

Surface How
API, the mixed stream GET /api/v3/audit/tenants/{tenantId}/events (operation getUnifiedEvents), with search, outcome, source, operationType, entityType, action, startTime, endTime, a subject filter (applicationId, actorId, exchangeContextId, capabilityGrantId, or entityId with entityType) and cursor. size is 20 by default and at most 200; a size outside 1 to 200 is refused with 400 and the problem type invalid-input. The window spans at most 365 days, and with no startTime and endTime it is the last 30 days; the response states the window it applied
API, the values each filter accepts GET /api/v3/audit/vocabulary (getAuditFilterVocabulary)
API, per-trail reads GET /api/v3/audit/tenants/{tenantId}/crypto/events (getCryptoEvents), .../crypto/timeline (getCryptoTimeline), .../crypto/events/{eventId} (getTenantCryptoEvent), .../crypto/operations/{operationType} (getOperationsByType), .../admin/events (getAdminEvents), .../admin/timeline (getAdminTimeline), .../auth (getTenantAuthEvents). Their size is 20 by default; a size above 100 is served as 100
API, figures GET /api/v3/audit/tenants/{tenantId}/crypto/stats (getCryptoStats), .../crypto/stats/daily (getDailyCryptoStats), .../crypto/stats/time-series (getTenantCryptoTimeSeries), .../admin/stats (getAdminStats), .../admin/stats/time-series (getTenantAdminTimeSeries)
API, one object's history See See the full history of a key, user, actor or grant
API, access-trail statistics (no console control) GET /api/v3/audit/tenants/{tenantId}/auth/stats (getTenantAuthStats)
API, one access event (no console control) GET /api/v3/audit/tenants/{tenantId}/auth/{eventId} (getTenantAuthEvent)
API, one client's history (no console control) GET /api/v3/audit/tenants/{tenantId}/crypto/clients/{clientId}/history (getClientHistory)
API, who read your audit trail (no console control) GET /api/v3/audit/meta/tenants/{tenantId}/access-logs (getTenantAccessLogs) and GET /api/v3/audit/meta/tenants/{tenantId}/stats (getTenantMetaStats)
API, export See Export audit events (exportTenantEvents)

There is no CLI command and no admin SDK method for the audit log.