Audit Logs

Endpoint reference for audit log queries and exports. For the guide, see Audit Logs.

Base path: /v1/audit/

GET /v1/audit/logs#

Query the audit log.

Query parameters:

Actions:

read, write, delete, list, rotate, policy_create, policy_update, policy_delete, policy_bind, policy_unbind, pki_issue, pki_sign, pki_revoke, pki_ca_create, dynamic_generate, dynamic_renew, dynamic_revoke, webhook_delivery, subscription_event, federation_sync, identity_sync, export_created.

Response:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

{
  "logs": [
    {
      "id": "log_abc",
      "timestamp": "2026-04-23T...",
      "action": "read",
      "identity_type": "service_account",
      "identity_id": "sa:reporting",
      "secret_path": "integrations/salesforce/oauth",
      "source_ip": "10.0.1.50",
      "user_agent": "scaivault-python/1.0",
      "success": true,
      "duration_ms": 12,
      "request_id": "req_xyz",
      "extra_data": {}
    }
  ],
  "cursor": "...",
  "has_more": true
}

Scope: audit:read.

GET /v1/audit/secrets/{path}#

Secret-specific audit trail with 30-day summary.

Scope: audit:read.

GET /v1/audit/identities/{identity_id}#

Identity-specific audit trail with summary.

Scope: audit:read.

GET /v1/audit/summary#

Aggregate statistics.

Query: from, to.

Response:

1
2
3
4
5
6
7
8

{
  "total_events": 125432,
  "successful_events": 124890,
  "failed_events": 542,
  "actions_breakdown": {"read": 98321, "write": 1432},
  "top_identities": [{"identity_id": "sa:reporting", "count": 35000}],
  "top_resources": [{"path": "integrations/salesforce/oauth", "count": 15000}]
}

Scope: audit:read.

POST /v1/audit/export#

Create an export job.

Body:

Response 202 Accepted: export_id, status, estimated_records.

Scope: audit:export.

GET /v1/audit/exports#

List exports.

Scope: audit:export.

GET /v1/audit/exports/{id}#

Export status and manifest.

Response:

1
2
3
4
5
6
7
8
9

{
  "export_id": "exp_abc",
  "status": "completed",
  "record_count": 125432,
  "files": [
    {"key": "scaivault/2026-01/part-0001.jsonl", "size_bytes": 12345678}
  ],
  "completed_at": "2026-04-23T20:00:00Z"
}

Related#

• Audit Logs Guide
• Error Codes