Audit
Supported audit log scenarios grouped by target type. Derived from the audited-route table, so it always reflects what can actually appear in the audit log; targets sorted by type, actions alphabetically.
application/json- response
The supported audit scenarios, grouped by target type.
targets*array<>One entry per target type, sorted by target type.
curl -X GET 'https://example.com/audit/scenarios'{ "targets": [ { "actions": [ "string" ], "target_type": "string" } ]}List one organization's audit logs. The caller must hold read:audit: an OIDC user JWT is admitted for any seated member with that permission, and a dtno_ organization API key is additionally admitted on this route when it holds read:audit for the same organization. actor_created_by — the minting user of an actor key — is member identity and is masked to null unless a JWT caller also holds read:members; organization API keys never reveal it.
AuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringOrganization id
uuidlimit?integerPage size (house default/cap)
int64cursor?stringKeyset cursor from a previous page's next_cursor
action?stringEquality filter on action; action[op]=… for the operator DSL (PLAN-AUDIT-FILTER-DSL.md)
target_type?stringEquality filter; target_type[op]=… for operators
target_id?stringEquality filter; target_id[op]=… for operators
actor?stringA user id or key id; a non-UUID value yields an empty page, not a 400
status?integerHTTP status of the audited call; status[op]=… for operators
int32since?stringRFC3339 lower bound (inclusive)
until?stringRFC3339 upper bound (inclusive: created_at <= until on both backends)
Audit-log page
application/json- response
logs*array<>The backend rows, passed through VERBATIM: an audit record is a
compliance artefact, so the query API never re-decodes (and can
never drop or reshape) what the store returned. AuditLogRow is the
documented shape; both adapters produce it, and the store's own
shape tests pin them to it.
next_cursor?string|nullcurl -X GET 'https://example.com/orgs/497f6eca-6276-4993-bfeb-53cbbbba6f08/audit-logs'{ "logs": [ { "action": "string", "actor_created_by": "35765c86-3f6c-4c27-b840-a0903bbdedd6", "actor_email": "string", "actor_key_id": "b9a81dca-0dc5-41dd-a51c-3cd1a6ec03ff", "actor_key_prefix": "string", "actor_kind": "string", "actor_service_account_id": "f8d1a8f6-34ae-45b6-8962-16779520eaec", "actor_user_id": "d6ed4497-4325-4995-9f49-e288b7192e46", "created_at": "2019-08-24T14:15:22Z", "error_message": "string", "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "ip_address": "string", "metadata": null, "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "plane": "string", "project_id": "405d8375-3514-403b-8c43-83ae74cfe0e9", "status_code": 0, "target_id": "string", "target_type": "string", "user_agent": "string" } ], "next_cursor": "string"}Read whether audit-log capture is disabled for one organization. The caller must be a seated member holding read:audit. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringOrganization id
uuidAudit configuration
application/json- response
disabled*booleancurl -X GET 'https://example.com/orgs/497f6eca-6276-4993-bfeb-53cbbbba6f08/audit-logs/config'{ "disabled": true}Enable or disable workload-plane audit-log capture for one organization. The caller must be a seated member holding write:audit. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.
user_jwtAuthorizationBearer <token>OIDC access token of a signed-in user (the dashboard/CLI login) used on the management plane: /me, /orgs*, /projects*, /invitations*, /roles, billing, audit, API-key, and service-account routes. Every management operation documents the org/project permission the authenticated member must hold.
id*stringOrganization id
uuidapplication/json- body
disabled*booleanUpdated audit configuration
application/json- response
disabled*booleancurl -X PATCH 'https://example.com/orgs/497f6eca-6276-4993-bfeb-53cbbbba6f08/audit-logs/config' \ -H 'Content-Type: application/json' \ -d '{ "disabled": true}'{ "disabled": true}