Kolide Audit Logs API

openapi: 3.0.0
info:
  version: '2023-05-26'
  title: K2 Admin Users Audit Logs API
servers:
- url: https://api.kolide.com/
security:
- api_key: []
tags:
- name: Audit Logs
paths:
  /audit_logs:
    get:
      summary: Fetch a list of Audit logs
      parameters:
      - name: x-kolide-api-version
        in: header
        description: Specify the API version to be used
        required: false
        schema:
          type: string
          default: '2023-05-26'
      - name: cursor
        in: query
        description: Specify the cursor to begin returning results from
        required: false
        schema:
          type: string
          default: ''
      - name: per_page
        in: query
        description: Specify the number of records to return in each response.
        required: false
        schema:
          type: integer
          format: int32
          maximum: 100
          minimum: 1
          default: 25
      - name: query
        in: query
        description: "A query clause used to filter the set of resources returned. Use\n`:` for exact matches (including for boolean fields), `~` for\npartial-string matches. `:[\"a\",\"b\",\"c\"]` or `:[1,2,3]`\ncan be used for fields that support multi-value search.\n Datetime fields support exact-matching\n(`:`) as well as less-than (`<`) and greater-than (`>`). The\nsearchable fields are:\n\n`timestamp` , `actor_name` , `description`\n\nSearch clauses can be combined with the ` AND ` and ` OR ` operators.\n\nFor more information, see the [search documentation](https://www.kolide.com/docs/developers/api#search).\n"
        required: false
        examples:
          'timestamp:':
            summary: search the 'timestamp' property of the Audit Log records using ':' operator
            value: timestamp:2000-01-08T20:38:21Z
          timestamp<:
            summary: search the 'timestamp' property of the Audit Log records using '<' operator
            value: timestamp<2000-01-08T20:38:21Z
          timestamp>:
            summary: search the 'timestamp' property of the Audit Log records using '>' operator
            value: timestamp>2000-01-08T20:38:21Z
          'actor_name:':
            summary: search the 'actor_name' property of the Audit Log records using ':' operator
            value: actor_name:string
          actor_name~:
            summary: search the 'actor_name' property of the Audit Log records using '~' operator
            value: actor_name~string
          'description:':
            summary: search the 'description' property of the Audit Log records using ':' operator
            value: description:string
          description~:
            summary: search the 'description' property of the Audit Log records using '~' operator
            value: description~string
        schema:
          type: string
      responses:
        '200':
          description: A paginated collection of Audit logs
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    description: "Kolide maintains an audit log of user actions in the Kolide web\nconsole. Examples of tracked events include, but are not limited to:\n  - Inviting & removing Kolide team members\n  - Changing the display name of a device\n  - Requesting a device deletion\n  - updating a Check's blocking configuration\n  - Approving/denying a registration or exemption request\n"
                    type: array
                    items:
                      $ref: '#/components/schemas/audit_log'
                  pagination:
                    type: object
                    description: Information about the current and next pages of results
                    properties:
                      next:
                        type: string
                        format: uri
                        description: The full URL that should be used to fetch the next page of results. This will be blank if there are no more results to fetch
                        example: https://api.kolide.com/audit_logs?per_page=10&cursor=Imyw
                      current_cursor:
                        type: string
                        description: the pagination cursor used to fetch this page of results
                        example: Miwy
                      next_cursor:
                        type: string
                        description: 'the pagination cursor that can be used to fetch the page of results following the current page. This will be blank if there are no more results to fetch '
                        example: NCw0
                      count:
                        type: integer
                        description: the number of records in the current page of results
                        example: 10
        '401':
          description: An 'unauthorized' response may occur for features restricted by or unavailable to your organization
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: an error message describing why the endpoint is unavailable
                    example: This feature has been disabled by your organization
        '403':
          description: A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: a succinct error message
                    example: Forbidden
                  message:
                    type: string
                    description: A longer-form error message explaining the reason for the response
                    example: The API key used is not authorized to perform this action
      tags:
      - Audit Logs
  /audit_logs/{id}:
    get:
      summary: Fetch information for a specific Audit log
      parameters:
      - name: x-kolide-api-version
        in: header
        description: Specify the API version to be used
        required: false
        schema:
          type: string
          default: '2023-05-26'
      - name: id
        in: path
        required: true
        description: The ID of the audit log
        schema:
          type: string
      responses:
        '200':
          description: "Kolide maintains an audit log of user actions in the Kolide web\nconsole. Examples of tracked events include, but are not limited to:\n  - Inviting & removing Kolide team members\n  - Changing the display name of a device\n  - Requesting a device deletion\n  - updating a Check's blocking configuration\n  - Approving/denying a registration or exemption request\n"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/audit_log'
        '401':
          description: An 'unauthorized' response may occur for features restricted by or unavailable to your organization
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: an error message describing why the endpoint is unavailable
                    example: This feature has been disabled by your organization
        '403':
          description: A 'forbidden' response may occur if the API key does not have necessary permissions to perform certain actions
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: a succinct error message
                    example: Forbidden
                  message:
                    type: string
                    description: A longer-form error message explaining the reason for the response
                    example: The API key used is not authorized to perform this action
      tags:
      - Audit Logs
components:
  schemas:
    audit_log:
      type: object
      properties:
        id:
          type: string
          description: The canonical identifier for this audit log
        timestamp:
          type: string
          description: The timestamp the event occured
          format: date-time
        actor_name:
          type: string
          description: The name of the entity triggering the event
        description:
          type: string
          description: Description of the event that occured
        actor_info:
          allOf:
          - description: Describes the entity triggering the event, specifically the actor
          - $ref: '#/components/schemas/audit_log_actor'
    audit_log_actor:
      type: object
      properties:
        actor_name:
          type: string
          description: The name of the entity triggering the event
        actor_email:
          type: string
          description: The email of the entity triggering the event. Only present for 'User' actors
        actor_type:
          type: string
          description: The type of entity triggering the event. Is either 'User', 'ApiKey' or 'System', for automated actions such as automatic device removal
  securitySchemes:
    api_key:
      type: http
      scheme: bearer