Download Audit Logs
Audience: System Administrators, Data Owners, and users with the AUDIT permission
Content Summary: This page outlines how to download the audit logs for your instance of Immuta through the API.
Deprecation notice
Support for the audit endpoint has been deprecated. Instead, pull audit logs from Kubernetes and push them to your SIEM.
1 - Generate an API Key
Generate your API key on the API Keys tab on your profile page and save the API key somewhere secure.
You will pass this API key in the authorization header when you make a request, as illustrated in the example below:
curl \ --request GET \ --header "Content-Type: application/json" \ --header "Authorization: dea464c07bd07300095caa8" \ https://your-immuta-url.immuta.com/audit
2 - Download Your Audit Logs
Endpoint
Query Parameters
Response Parameters
The response returns the audit records. See below for an example.
Request Example
The request below saves 50 audit logs for https://your-immuta-url.immuta.com in the file audit-logs-file.son, with the audit records sorted by time in descending order.
curl \
--request GET \
--header "Content-Type: application/json" \
--header "Authorization: dea464c07bd07300095caa8" \
--output audit-logs-file.json \
https://your-immuta-url.immuta.com/audit?sortField=dateTime&sortOrder=descResponse Example
{
"hits": [{
"dateTime": "1634144773832",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "29cfa243-5ca9-44a3-8600-35897e13f6fb",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634144525716",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "eea78076-4362-4563-aa3d-52f91eb87da1",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634144482422",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "3ede9275-434e-451e-9166-c2979162b2d0",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634144402132",
"dataSourceName": null,
"projectName": null,
"recordType": "authenticate",
"blobId": null,
"userId": "postgres_system",
"profileId": -1,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "774e50ac-7256-4f7a-8549-2fce65fc4a4a",
"fingerprintVersionName": null,
"email": null
}, {
"dateTime": "1634144332521",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "dc449dc3-1a38-4fcc-860b-14bcdca50ca0",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634144274492",
"dataSourceName": null,
"projectName": null,
"recordType": "apiKey",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "cfad6adf-c734-43a4-be00-bf75c4ab2f7f",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634144170871",
"dataSourceName": null,
"projectName": null,
"recordType": "apiKey",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "3aa0a81b-0079-4c9b-8a4c-3e7416578f26",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634144112457",
"dataSourceName": null,
"projectName": null,
"recordType": "apiKey",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "b932e672-2d58-4fb7-86cc-26d3c5261526",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634144023606",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "e8acc422-a018-4d92-86b6-922994906105",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634143988892",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "ca52c9ac-0997-4d3d-8ce8-d73acb7313df",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634143739542",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "eaf1c1e7-2ef4-4c71-9114-9b69a35b543e",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634143712696",
"dataSourceName": null,
"projectName": null,
"recordType": "authenticate",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "580bc995-efa6-443e-8507-3736c930d6bd",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634138752546",
"dataSourceName": null,
"projectName": null,
"recordType": "handleTask",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "8718e9f1-3c04-4107-8875-8355a404b314",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634138602535",
"dataSourceName": null,
"projectName": null,
"recordType": "authenticate",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "40e9bc73-404b-4ede-9bd0-69ebd5aa211c",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634136717974",
"dataSourceName": null,
"projectName": null,
"recordType": "authenticate",
"blobId": null,
"userId": "postgres_system",
"profileId": -1,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "d11eae77-788e-4ec2-baa5-7a082d3ffed5",
"fingerprintVersionName": null,
"email": null
}, {
"dateTime": "1634079780159",
"dataSourceName": null,
"projectName": null,
"recordType": "authenticate",
"blobId": null,
"userId": "postgres_system",
"profileId": -1,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "3588c9bf-e4a2-436f-94dd-0d2330f6fdb7",
"fingerprintVersionName": null,
"email": null
}, {
"dateTime": "1634067298603",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "07246b92-090d-4a5a-a8e7-7b488ee70b9e",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634067297104",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "cb582e19-f1f3-41fe-a09e-3a5ac309b8b7",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634067294907",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "4972ea2c-bbe9-499c-84be-85d7a5c374af",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634067294126",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "7faeb85f-d372-4c7c-bda5-87260247a701",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634067293686",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "a90cd25a-044a-4cea-8919-39d7c8a429fc",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634067290827",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "9d37b7dd-6b04-4dbb-8852-a10007943c6b",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634067287997",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "9208fb13-9d33-4dc3-a550-f6b8ae70ed8e",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634067273092",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "91c9db98-bd19-4afc-b590-05d139cb3b32",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634067055915",
"dataSourceName": null,
"projectName": null,
"recordType": "taskDelete",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "5896ab8a-c71f-49a2-9279-ec6bb0b00c85",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634066885023",
"dataSourceName": "Fake Medical Claims 2017",
"projectName": null,
"recordType": "queryDebugRequest",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "c929758b-60ce-48d2-9fdd-f33864e97330",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634066884662",
"dataSourceName": null,
"projectName": null,
"recordType": "sqlQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "975c39ec-b0a4-4ac5-baa1-504f8e736a5e",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634066621722",
"dataSourceName": null,
"projectName": null,
"recordType": "sqlQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "1c5cf9c7-4530-4e58-9475-a68257e53c6a",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634066606932",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "7e5a5366-81d5-4306-8561-4ea0fe8bf09c",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634066600664",
"dataSourceName": null,
"projectName": null,
"recordType": "auditQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": [11, 17],
"success": true,
"failureReason": null,
"warning": null,
"id": "65b05960-72bf-4bfe-8e7d-5e1efb9678ab",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634066596494",
"dataSourceName": "Fake Medical Claims 2017",
"projectName": null,
"recordType": "sqlQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": false,
"id": "a1af3329-d096-4cc0-8037-10b63d437dac",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634066592672",
"dataSourceName": null,
"projectName": null,
"recordType": "switchCurrentProject",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "9b457b86-256b-4c39-8c32-a9f346f78fde",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634066586204",
"dataSourceName": "Fake Medical Claims 2017",
"projectName": null,
"recordType": "sqlQuery",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": false,
"failureReason": null,
"warning": false,
"id": "ced83fec-9518-424f-80d6-190dfdecf8ce",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634066290381",
"dataSourceName": "Fake Medical Claims 2017",
"projectName": null,
"recordType": "policyHandlerUpdate",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": [11, 17],
"success": true,
"failureReason": null,
"warning": null,
"id": "4de17c25-875d-412c-bd35-7346eb86c9fe",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634066290361",
"dataSourceName": "Fake Medical Claims 2017",
"projectName": null,
"recordType": "dataSourceSave",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": null,
"success": true,
"failureReason": null,
"warning": null,
"id": "3b79e204-70ff-4271-85ac-ac46042374e6",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634065931127",
"dataSourceName": "Army Army Records",
"projectName": "Purpose Test",
"recordType": "addToProject",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": [11, 17],
"success": true,
"failureReason": null,
"warning": null,
"id": "c8c2ba1b-dc8e-4d4d-aa89-cdb3cfb81dae",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634065922108",
"dataSourceName": null,
"projectName": null,
"recordType": "apiKey",
"blobId": null,
"userId": "katie@example.com",
"profileId": 2,
"purposeIds": [11, 17],
"success": true,
"failureReason": null,
"warning": null,
"id": "6614f079-4508-4ee2-ab6f-1e026da9eaec",
"fingerprintVersionName": null,
"email": "katie@example.com"
}, {
"dateTime": "1634065904373",
"dataSourceName": "Army Army Records",
"projectName": null,