Content Management API > Audit log event

List Audit Log events

The Audit Logs API allows to monitor events happening in an Enterprise project. It ensures continued compliance, safeguarding against any inappropriate system access, and allows you to audit suspicious behavior within your enterprise.

You can use this part of the API to:

Automatically feed DatoCMS access data into an SIEM or other auditing tool;
Proactively monitor for potential security issues or malicious access attempts;
Write custom apps to gain insight into how your organization uses DatoCMS.

Please note that DatoCMS does not perform any kind of automated intrusion detection. The Audit Logs API will return the data but can not automatically determine or indicate whether an action was appropriate.

Pagination

A single request might not return the full results. To get the remaining results, you can use the meta.next_token of a response as a next_token attribute for the next request, until the response returns null as the next token.

Filtering events

You can use the filter parameter to pass an SQL-like query (PartiQL) to filter events. Any attribute of the event payload can be used in a condition.

To filter for date, you can use the event id attribute, which is an ULID (Universally Unique Lexicographically Sortable Identifier) together with the min_ulid() function, which takes a Unix timestamp.

The following query returns actions performed in Q1 2021 (January to March):

1
id >= min_ulid(1609455600) AND id < min_ulid(1617228000)

Other query examples will follow:

1
-- Return actions of type 'items.update' only
2
action_name = 'items.update'
3

4
-- Returns actions whose name begins with 'fields'
5
begins_with(action_name, 'fields') -- Includes `fields.update`, `fields.destroy`, etc,
6

7
-- Returns actions containing 'destroy'
8
contains(action_name, 'update') -- Includes `fields.update`, `plugins.update`, `items.update`, etc.
9

10
-- Return actions performed by a collaborator
11
actor.type = 'user'
12

13
-- Return actions performed by a specific collaborator
14
actor.type = 'user' AND actor.id = '4845293'
15

16
-- Return publishing actions for the record 239408
17
request.path = '/items/239408/publish'
18

19
-- Return all record creations for the model 855832
20
action_name = 'items.create' AND request.payload.data.relationships.item_type.data.id = '855832'

Body parameters

type string Required

Must be exactly "audit_log_query".

attributes.filter string Optional

An SQL-like expression to filter the events

Example:

"id > min_ulid(1624452728)"

attributes.next_token string Optional

Set this value to get remaining results, if a meta.next_token was returned in the previous query response

Example:

"E5188+SCXtvvXVUFkqmwtQJd3V3lJIOsZBjHvTYz"

attributes.detailed_log boolean Optional

Whether a detailed log complete with full request and response payload must be returned or not

Returns

Returns an array of resource objects of type audit_log_event.

Examples

1
POST https://site-api.datocms.com/audit-log-events/query HTTP/1.1
2
Authorization: Bearer YOUR-API-TOKEN
3
Accept: application/json
4
X-Api-Version: 3
5
Content-Type: application/vnd.api+json
6

7
{
8
  "data": {
9
    "type": "audit_log_query",
10
    "attributes": {}
11
  }
12
}

1
curl -g 'https://site-api.datocms.com/audit-log-events/query' \
2
  -X POST \
3
  -H "Authorization: Bearer YOUR-API-TOKEN" \
4
  -H "Accept: application/json" \
5
  -H "X-Api-Version: 3" \
6
  -H "Content-Type: application/vnd.api+json" \
7
  --data-binary '{"data":{"type":"audit_log_query","attributes":{}}}'

1
await fetch("https://site-api.datocms.com/audit-log-events/query", {
2
  method: "POST",
3
  headers: {
4
    Authorization: "Bearer YOUR-API-TOKEN",
5
    Accept: "application/json",
6
    "X-Api-Version": "3",
7
    "Content-Type": "application/vnd.api+json",
8
  },
9
  body: JSON.stringify({ data: { type: "audit_log_query", attributes: {} } }),
10
});

1
HTTP/1.1 200 OK
2
Content-Type: application/json
3
Cache-Control: cache-control: max-age=0, private, must-revalidate
4
X-RateLimit-Limit: 30
5
X-RateLimit-Remaining: 28
6

7
{
8
  "data": [
9
    {
10
      "type": "audit_log_event",
11
      "id": "01F8WDQJR03M4VC6NTK49R83QW",
12
      "attributes": {
13
        "action_name": "items.publish",
14
        "actor": {
15
          "type": "user",
16
          "id": "3845289",
17
          "name": "mark@acme.com"
18
        },
19
        "role": {
20
          "id": "455281",
21
          "name": "Editor"
22
        },
23
        "environment": {
24
          "id": "main",
25
          "primary": true
26
        },
27
        "request": {
28
          "id": "894f9f6c-a693-4f93-a3fb-452454b41313",
29
          "method": "PUT",
30
          "path": "/items/37823421/publish",
31
          "payload": {}
32
        },
33
        "response": {
34
          "status": 200,
35
          "payload": {}
36
        }
37
      },
38
      "meta": {
39
        "occurred_at": "2016-09-20T18:50:24.914Z"
40
      }
41
    }
42
  ],
43
  "meta": {
44
    "next_token": "E5188+SCXtvvXVUFkqmwtQJd3V3lJIOsZBjHvTYz"
45
  }
46
}

Did this doc help you?

Need help?

Explore our forum, contact support, or connect with our sales team . You can also chat live with other users in our Slack channel.