Authdog
Log In

Observability guide

Audit Logs

Start from an event you already know happened, find it in the console, then pull the same window from the API.

Audit logs are the environment's identity activity plus organization-level admin changes. They are how you investigate. They are not an authorization signal, and they are not a retention guarantee.

Prerequisites

  • The tenant, project, and environment you are investigating. Write the IDs down. An empty result in the wrong environment looks like "nothing happened."
  • Console access to Audit.
  • For the API: a server-held Authdog token with only the scope this query needs.
  • A UTC window, a user or external ID, and the event category you expect, when you have them.
  • Somewhere to put evidence that you encrypt, lock down, and retain on your own terms.

Implementation

  1. Select the environment before you filter. Choose the tenant, project, and environment, then open Audit. If the screen is empty, check the neighboring environment before you decide the event never existed.

  2. Query a short window with one strong filter. Use a UTC range you can defend, plus a known user, event type, or external ID. When the row appears, check the timestamp against the timezone you assumed. Widen the window only after that row looks right. A wide query hides the event you wanted inside noise.

  3. Use overview for volume, the feed for the record. Overview tells you something happened and roughly what kind. The event feed is the record you will cite. Save a filter when you run the same combination every incident, so the next one starts from the same query.

  4. Learn the event name from a sample. The event-types explorer groups what this environment has emitted, with counts and samples. Open a sample before you write a parser or an alert. A name you invented will not match, and the alert will sit quiet.

  5. Pull the same window from the API when a person should not be clicking through it.

    curl --get \
  "https://api.authdog.com/v1/tenants/$TENANT_ID/environments/$ENVIRONMENT_ID/audit/logs" \
  -H "Authorization: Bearer $AUTHDOG_API_TOKEN" \
  --data-urlencode "startDateTime=2026-07-01T00:00:00Z" \
  --data-urlencode "endDateTime=2026-07-02T00:00:00Z" \
  --data-urlencode "eventTypes=SIGNIN_SUCCESS,MFA_SIGNIN_FAILURE" \
  --data-urlencode "limit=100"

    Page with numeric offset and limit. Limit maxes out at 500. Keep the filters stable while you advance offset, or you will skip and duplicate rows and then argue about the gap.

  6. Build filters from the catalog, not from a list in code. GET /v1/tenants/{tenantId}/environments/{environmentId}/audit/event-types/catalog returns the event and category pairs this environment knows. Use those strings. A hard-coded list goes stale the first time a new type appears.

  7. Query organization admin actions on their own route. GET /v1/organizations/{organizationId}/audit/logs is the organization record. It will not show up in the environment feed. If you are chasing a membership or role change and the environment query is empty, switch routes before you assume it was not logged.

  8. Write the timeline, then remediate. For each event you will cite, keep the event ID, UTC timestamp, actor, IP, and organization. Read the neighbors in time. Save the raw payload before you revoke, suspend, or rotate anything. The next event will describe the fix. It will not contain the payload you needed from the original.

Security considerations

  • The API token stays on a server. It does not go in browser code, a shared shell history, or a log line.
  • eventPayload is whatever the source sent, and it grows new fields. Parse it defensively. Never allow or deny a request because an audit row said so.
  • Authdog shows you what it recorded. It does not promise how long that record lives or that it satisfies your compliance program. If you need an archive, forward verified events to storage you govern. See SIEM security events.

Validation checklist

  • Query uses the intended tenant, environment, organization, and UTC range.
  • A known test sign-in or administrative action appears in the console.
  • Event type comes from the catalog or an observed record.
  • REST totals and pagination produce no unintended gaps or duplicates.
  • Parser tolerates null fields and unknown keys.
  • Export destination restricts access and applies your retention policy.

Troubleshooting

No rows. Confirm the environment, then the timezone. UTC versus local is the usual miss. Remove one filter at a time until a row you know about appears, then add filters back.

Pages skip or repeat. You changed filters or sort between calls. Freeze them, keep limit at or below 500, and only move offset.

An organization change is missing from the environment feed. It was never going to be there. Query GET /v1/organizations/{organizationId}/audit/logs.

Next steps