GetUserAuditLogs

This method can be used for the following functionality: Get audit logs for a user.

Parameters

The following URL, Headers and Parameters are required for requests to this API endpoint. Where a parameter is optional, it will be indicated. Otherwise treat all parameters as mandatory.

Headers

GET /api/ss/user/:id/auditlogs HTTP/1.1
Host: demo.attackforge.com
X-SSAPI-KEY: APIKey
Content-Type: application/json
Connection: close

Query

id (string)

Id of the user.

Example:

GET /api/ss/user/5d5b27734a83a708c46f4748/auditlogs HTTP/1.1

skip (integer) (optional)

Number of records to skip. Default is 0 (do not skip any records).

Example:

GET /api/ss/user/:id/auditlogs?skip=10 HTTP/1.1

limit (integer) (optional)

Number of records to limit to. Default limit is 100. Max limit is 500.

Example:

GET /api/ss/user/:id/auditlogs?limit=100 HTTP/1.1

include_request_body (boolean) (optional)

Whether to include HTTP request body or not. Defaults to false.

Example:

GET /api/ss/user/:id/auditlogs?include_request_body=true HTTP/1.1

Example

The following example is a cURL request to get last 500 audit logs for a user.

Request

Include API Token instead of stars in 'X-SSAPI-KEY: ***************************************' parameter.

curl -X GET 'https://demo.attackforge.com/api/ss/user/5d5b27734a83a708c46f4748/auditlogs?skip=0&limit=500' -H 'Host: demo.attackforge.com' -H 'X-SSAPI-KEY: ***************************************' -H 'Content-Type: application/json' -H 'Connection: close'

Response

Response contains an array of logs.

{
   "count": 999,
   "logs": [
      {
         "created_timestamp": "...",
         "id": "...",
         "method": "...",
         "url": "...",
         "path": "...",
         "query": {
           "...": "...",
         },
         "endpoint": "...",
         "status_code": 200,
         "user_id": "...",
         "user_role": "...",
         "project_id": "...",
         "source_ip_address": "...",
         "event_description": "...",
         "verbosity": 3,
         "export": true,
         "request_body": {
           "...": "...",
         }
      }
   ]
}