Export, and optionally purge, audit records

curl --request POST \
  --url https://{host}/api/v3/audit-logs/export \
  --header 'Content-Type: application/json' \
  --header 'X-Qanapi-Authorization: <api-key>' \
  --data '
{
  "from": "2023-11-07T05:31:56Z",
  "to": "2023-11-07T05:31:56Z",
  "action": "<string>",
  "configuration_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "principal_id": "<string>",
  "request_id": "<string>",
  "instance_id": "<string>",
  "format": "jsonl",
  "gzip": false,
  "purge": false
}
'

import requests

url = "https://{host}/api/v3/audit-logs/export"

payload = {
    "from": "2023-11-07T05:31:56Z",
    "to": "2023-11-07T05:31:56Z",
    "action": "<string>",
    "configuration_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "principal_id": "<string>",
    "request_id": "<string>",
    "instance_id": "<string>",
    "format": "jsonl",
    "gzip": False,
    "purge": False
}
headers = {
    "X-Qanapi-Authorization": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'X-Qanapi-Authorization': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    from: '2023-11-07T05:31:56Z',
    to: '2023-11-07T05:31:56Z',
    action: '<string>',
    configuration_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    principal_id: '<string>',
    request_id: '<string>',
    instance_id: '<string>',
    format: 'jsonl',
    gzip: false,
    purge: false
  })
};

fetch('https://{host}/api/v3/audit-logs/export', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{host}/api/v3/audit-logs/export",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'from' => '2023-11-07T05:31:56Z',
    'to' => '2023-11-07T05:31:56Z',
    'action' => '<string>',
    'configuration_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    'principal_id' => '<string>',
    'request_id' => '<string>',
    'instance_id' => '<string>',
    'format' => 'jsonl',
    'gzip' => false,
    'purge' => false
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Qanapi-Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{host}/api/v3/audit-logs/export"

	payload := strings.NewReader("{\n  \"from\": \"2023-11-07T05:31:56Z\",\n  \"to\": \"2023-11-07T05:31:56Z\",\n  \"action\": \"<string>\",\n  \"configuration_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n  \"principal_id\": \"<string>\",\n  \"request_id\": \"<string>\",\n  \"instance_id\": \"<string>\",\n  \"format\": \"jsonl\",\n  \"gzip\": false,\n  \"purge\": false\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Qanapi-Authorization", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://{host}/api/v3/audit-logs/export")
  .header("X-Qanapi-Authorization", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"from\": \"2023-11-07T05:31:56Z\",\n  \"to\": \"2023-11-07T05:31:56Z\",\n  \"action\": \"<string>\",\n  \"configuration_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n  \"principal_id\": \"<string>\",\n  \"request_id\": \"<string>\",\n  \"instance_id\": \"<string>\",\n  \"format\": \"jsonl\",\n  \"gzip\": false,\n  \"purge\": false\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{host}/api/v3/audit-logs/export")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Qanapi-Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"from\": \"2023-11-07T05:31:56Z\",\n  \"to\": \"2023-11-07T05:31:56Z\",\n  \"action\": \"<string>\",\n  \"configuration_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n  \"principal_id\": \"<string>\",\n  \"request_id\": \"<string>\",\n  \"instance_id\": \"<string>\",\n  \"format\": \"jsonl\",\n  \"gzip\": false,\n  \"purge\": false\n}"

response = http.request(request)
puts response.read_body

"<string>"

{
  "message": "Unauthorized.",
  "error": "InvalidApiKeyException"
}

{
  "message": "Unauthorized.",
  "error": "InvalidApiKeyException"
}

{
  "message": "Unauthorized.",
  "error": "InvalidApiKeyException"
}

{
  "message": "Unauthorized.",
  "error": "InvalidApiKeyException"
}

{
  "message": "Unauthorized.",
  "error": "InvalidApiKeyException",
  "errors": {
    "type": [
      "The type field is required."
    ],
    "configuration_ids": [
      "No configuration has the id `...`."
    ]
  }
}

Audit

Export, and optionally purge, audit records

Requires audit:export, and audit:purge as well when purging.

Streams matching records as JSON Lines or CSV, oldest first, optionally gzipped. One export covers at most 100,000 records; narrow the filters and repeat if you have more. The filters are the ones the query endpoint accepts, sent in the body; page and per_page are accepted and ignored.

With purge set, the exported records are deleted in the same transaction that read them, so nothing can be purged that was not successfully exported. A purge is itself recorded, with the window it covered, so a later chain verification can tell an authorised purge apart from tampering.

The body is optional; send none to export everything in the default format.

POST

api

audit-logs

export

Export, and optionally purge, audit records

curl --request POST \
  --url https://{host}/api/v3/audit-logs/export \
  --header 'Content-Type: application/json' \
  --header 'X-Qanapi-Authorization: <api-key>' \
  --data '
{
  "from": "2023-11-07T05:31:56Z",
  "to": "2023-11-07T05:31:56Z",
  "action": "<string>",
  "configuration_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
  "principal_id": "<string>",
  "request_id": "<string>",
  "instance_id": "<string>",
  "format": "jsonl",
  "gzip": false,
  "purge": false
}
'

import requests

url = "https://{host}/api/v3/audit-logs/export"

payload = {
    "from": "2023-11-07T05:31:56Z",
    "to": "2023-11-07T05:31:56Z",
    "action": "<string>",
    "configuration_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
    "principal_id": "<string>",
    "request_id": "<string>",
    "instance_id": "<string>",
    "format": "jsonl",
    "gzip": False,
    "purge": False
}
headers = {
    "X-Qanapi-Authorization": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {'X-Qanapi-Authorization': '<api-key>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    from: '2023-11-07T05:31:56Z',
    to: '2023-11-07T05:31:56Z',
    action: '<string>',
    configuration_id: '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    principal_id: '<string>',
    request_id: '<string>',
    instance_id: '<string>',
    format: 'jsonl',
    gzip: false,
    purge: false
  })
};

fetch('https://{host}/api/v3/audit-logs/export', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://{host}/api/v3/audit-logs/export",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'from' => '2023-11-07T05:31:56Z',
    'to' => '2023-11-07T05:31:56Z',
    'action' => '<string>',
    'configuration_id' => '3c90c3cc-0d44-4b50-8888-8dd25736052a',
    'principal_id' => '<string>',
    'request_id' => '<string>',
    'instance_id' => '<string>',
    'format' => 'jsonl',
    'gzip' => false,
    'purge' => false
  ]),
  CURLOPT_HTTPHEADER => [
    "Content-Type: application/json",
    "X-Qanapi-Authorization: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://{host}/api/v3/audit-logs/export"

	payload := strings.NewReader("{\n  \"from\": \"2023-11-07T05:31:56Z\",\n  \"to\": \"2023-11-07T05:31:56Z\",\n  \"action\": \"<string>\",\n  \"configuration_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n  \"principal_id\": \"<string>\",\n  \"request_id\": \"<string>\",\n  \"instance_id\": \"<string>\",\n  \"format\": \"jsonl\",\n  \"gzip\": false,\n  \"purge\": false\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("X-Qanapi-Authorization", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://{host}/api/v3/audit-logs/export")
  .header("X-Qanapi-Authorization", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"from\": \"2023-11-07T05:31:56Z\",\n  \"to\": \"2023-11-07T05:31:56Z\",\n  \"action\": \"<string>\",\n  \"configuration_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n  \"principal_id\": \"<string>\",\n  \"request_id\": \"<string>\",\n  \"instance_id\": \"<string>\",\n  \"format\": \"jsonl\",\n  \"gzip\": false,\n  \"purge\": false\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://{host}/api/v3/audit-logs/export")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["X-Qanapi-Authorization"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"from\": \"2023-11-07T05:31:56Z\",\n  \"to\": \"2023-11-07T05:31:56Z\",\n  \"action\": \"<string>\",\n  \"configuration_id\": \"3c90c3cc-0d44-4b50-8888-8dd25736052a\",\n  \"principal_id\": \"<string>\",\n  \"request_id\": \"<string>\",\n  \"instance_id\": \"<string>\",\n  \"format\": \"jsonl\",\n  \"gzip\": false,\n  \"purge\": false\n}"

response = http.request(request)
puts response.read_body

"<string>"

{
  "message": "Unauthorized.",
  "error": "InvalidApiKeyException"
}

{
  "message": "Unauthorized.",
  "error": "InvalidApiKeyException"
}

{
  "message": "Unauthorized.",
  "error": "InvalidApiKeyException"
}

{
  "message": "Unauthorized.",
  "error": "InvalidApiKeyException"
}

{
  "message": "Unauthorized.",
  "error": "InvalidApiKeyException",
  "errors": {
    "type": [
      "The type field is required."
    ],
    "configuration_ids": [
      "No configuration has the id `...`."
    ]
  }
}

Authorizations

X-Qanapi-Authorization

string

header

required

A machine credential, qk_ followed by its secret. Only a hash of the secret is stored, so a key is displayed exactly once, when it is created or rotated. A key reaches only the configurations it is linked to.

It may also be sent as Authorization: Bearer qk_..., which is recognised by the prefix.

Body

application/json

Accepts every filter the query endpoint accepts, plus the three fields at the end. page and per_page are accepted and ignored: an export covers the whole matching range up to its ceiling.

from

string<date-time>

action

string

An exact action, or a kms.* style prefix.

configuration_id

string<uuid>

principal_id

string

principal_type

enum<string>

Available options:

user,

api_key,

anonymous,

system

status

enum<string>

Available options:

success,

denied,

error

request_id

string

instance_id

string

format

enum<string>

default:jsonl

jsonl streams one JSON record per line; csv flattens them into a header row and one row per record.

Available options:

jsonl,

csv

gzip

boolean

default:false

Compress the stream. Signalled by Content-Encoding, not by a different content type.

purge

boolean

default:false

Delete the exported records in the same transaction that read them, so nothing is purged that was not successfully exported. Requires audit:purge, and is itself recorded with the window it covered.

Response

The export stream. Content-Type follows format, and a gzipped export is the same content type under Content-Encoding: gzip rather than a type of its own.

The response is of type string.

Details

Encryption

Classifications

Policies

Authentication

Users

Configurations

API Keys

Health

KMS

Audit

Transport

Export, and optionally purge, audit records

Authorizations

Body

Response